Re: PHP6, drop open_basedir?

On 06/18/2014 05:57 AM, Pierre Joye wrote: > On Wed, Jun 18, 2014 at 5:49 AM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote: > >> I think you have a very narrow view of how this feature is used. >> Security and code quality is about layers. This is a useful layer that >> helps verify that an application, or even a subset of an application, is >> only able to access a given set of directories. If something tries to >> access a file outside of the defined scope, we get an error and we know >> there is a bug in the code. I, and many companies out there, rely quite >> heavily on this feature to catch mistakes. And yes, there are ways of >> getting around it at the PHP-level if you deliberately craft your PHP >> code to do so, but that doesn't make the feature any less useful to all >> the people using it to catch non-deliberate mistakes. > > It gives a false sense of safety, and that alone for me is a good > enough reason to remove it. it is not as bad as safe_mode but simply > not good. Only to people who don't understand how it works. Let's treat our audience like grown ups, please. -Rasmus