Re: Security Diligence

Pádraic Brady wrote:

The RFCs do imply some awareness of security and that's largely unavoidable unless each and every RFC needs to be a 1000 page masterwork;).

Since 'security experts' tend not to wait for fixes to be produced before publishing exploits all I am looking for in this case is enough help in the rfc's to assess if action is required before fixes ARE published! And I hope that since these are security fixes that they are pushed back as far as PHP5.3 since this is still under support for security fixes? It is even more important if the fixes are not being rolled back that the extent of the risk is recorded well enough for users to understand the risk? Are these sort of security issues 'support' issues rather than 'internals'? -- Lester Caine - G8HFL ----------------------------- Contact - http://lsces.co.uk/wiki/?page=contact L.S.Caine Electronic Services - http://lsces.co.uk EnquirySolve - http://enquirysolve.com/ Model Engineers Digital Workshop - http://medw.co.uk Rainbow Digital Media - http://rainbowdigitalmedia.co.uk