Re: Suhosin patch disabled by default in Debian php5 builds

On Sat, Feb 4, 2012 at 10:25 AM, Stefan Esser <stefan@nopiracy.de> wrote: > Grow up Pierre. here we go again... failed. next time.... > See you do it again. You claim I believe EMET has been created because of Suhosin. I never said > that. Although one of the lead developers of EMET compared it himself to it. > You know some features of Suhosin are already in PHP and the HTTP response splitting drama > shows that when you break it there is a secondary layer of defense that protects you in case you use > Suhosin. I was talking about the compilation security options which are similar (in some extends) to what Suhosin does (for some features). > Pierre it is time for you to come out of the delusional state. You repeatedly claim that > everything is now superb. No, I said it is different and better than what you have experienced. And anyone active today in php.net can tell you the same. > Do you forget PHP 5.3.7 and PHP 5.3.9 both times there were security vulnerabilities introduced > right after the last RC. > This is a sign that the PHP development process is still not healthy at all. So any software having security issues at one point or another is not healthy? I consider the opposite, I am very careful when I see a software without any discovered issues for a long time, a sign of lack of activities and users. > You claim I have personal issues, while I repeatedly tell you the technical reasons why I see > it different then you. Sorry but I do not see technical issues in this thread, as in technical explanations about why one given feature is actually a good thing. I did not see any either in the past discussions. Cheers, -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org