Re: Suhosin patch disabled by default in Debian php5 builds
| From: | Michael Morris | Date: | Mon, 06 Feb 2012 15:23:37 +0000 |
| Subject: | Re: Suhosin patch disabled by default in Debian php5 builds | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-57768@lists.php.net to get a copy of this message | ||
I don't think so. My experience with the attitude he has shown is, when
mistakes get made by such a person, they are hidden away rather than
honestly reported. To paraphrase a line from Harry Potter - brilliant
people don't make many mistakes, but the ones they make tend to be large
and very damaging.
Security is trust. Given what I have seen I do not trust Stefan to report
any vulnerabilities created in PHP by Sushonin in a timely manner. I do not
believe he has the humility necessary to own up to a mistake. Since he is
that project's only caretaker, I cannot trust the code. If I do not trust
it, I don't run it.
On Mon, Feb 6, 2012 at 10:15 AM, Reindl Harald <h.reindl@thelounge.net>wrote:
>
>
> if your make technical decisions especially security ones by
> "The character displayed by Stefan" you are maybe doing the
> wrong job!
>
>