Re: Suhosin patch disabled by default in Debian php5 builds
| From: | Nikita Popov | Date: | Mon, 06 Feb 2012 17:11:25 +0000 |
| Subject: | Re: Suhosin patch disabled by default in Debian php5 builds | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-57776@lists.php.net to get a copy of this message | ||
On Mon, Feb 6, 2012 at 6:00 PM, Stefan Esser <stefan@nopiracy.de> wrote:
> Hey Nikita,
>
>> Full disclosure sure is controversial, but I don't think it is
>> regarded as necessarily bad. Just look at the way Stefan disclosed the
>> PHP 5.3.9 remote code execution vulnerability: Full disclosure.
>>
>> So please, again, don't call people names.
>
> I guess you are not aware that the bug was disclosed by Stas when he commited the fix to the
> SVN.
> I never told anyone where the bug is before it was already all over the internet.
>
> So please get your facts straight.
Sorry, I was misinformed. My point still stands, that full disclosure
is controversial, but not necessarily bad.
Sorry again for mixing things up.