Re: [VOTE] Multbye char handling - Remove vulnerability related to multibyte short and long term

Hi all, On Mon, Feb 10, 2014 at 12:56 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > > Short term: Multibyte Char Handling > https://wiki.php.net/rfc/multibyte_char_handling > Add functions required to resolve security issues. CVE-2014-1239 > https://wiki.php.net/rfc/multibyte_char_handling#vote Vote is declined 2 vs 10. > > Long term: Alternative implementation of mbstring using ICU > https://wiki.php.net/rfc/altmbstring > We need multibyte feature as default. However, current mbstring has > license issues. Resolve license issues by alternative mbstring in the > future. Introduce mbstring-ng as EXPERIMENTAL module for further > development, testing, feedback from users. > Vote is declined 1 vs 10. Thank you for voting all! I do not care much about long term solution, but short term solution. It seems there is a misunderstanding how vulnerabilities should be evaluated by developers. If one is developer of a product, vulnerability should be evaluated only by *consequence*, not the probability, number of affected users, etc. One should not evaluate his/her product's vulnerability as an user. If user is not affected, any vulnerabilities are not important even if it is a vulnerability that executes arbitrarily codes. This is a bug that may allow attackers to execute their code. Consequence is fatal. I hope everyone follow this vulnerability evaluation principle next time. I'm sure this is good for us ;) Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net