Re: [PHP-DEV] Regenerating session ID automatically when IP address has changed

2013-09-28 Thread Pierre Joye
On Sat, Sep 28, 2013 at 2:07 PM, Sanford Whiteman wrote: >> ... ESPECIALLY since userland implementation is so trivial. I do not see any new argument in this discussion since a couple of days. If desired, I would suggest to create a RFC (should have been done already :) and move to the next steps

Re: [PHP-DEV] Regenerating session ID automatically when IP address has changed

2013-09-28 Thread Sanford Whiteman
> ... ESPECIALLY since userland implementation is so trivial. "Trivial" for most users means "copy-paste an unmaintained class library you found somewhere" so you haven't solved the problem. Unless something comes from one of the few trusted security extensions or from a top framework, it's doubtf

[PHP-DEV] Remove requirement to escape delimiters in regular expression in PCRE functions

2013-09-28 Thread Sherif Ramadan
Hi, Someone pointed out to me recently that since the delimiters are not a requirement of PCRE, and thus should not be considered a part of the regular expression, there really is no need to escape them inside of the regular expression such as that provided to preg_match functions and similar. I

Re: [PHP-DEV] Gnu/Hurd support

2013-09-28 Thread Lior Kaplan
On Sat, Sep 28, 2013 at 12:57 PM, Derick Rethans wrote: > And bug 31347 is that was a fix for a specific issue on Windows: > https://bugs.php.net/bug.php?id=31347 > The patch originates in Debian, and I can assure you that they don't build for Windows (: So that's a good point, thanks. We could

Re: [PHP-DEV] Gnu/Hurd support

2013-09-28 Thread Derick Rethans
On Sat, 28 Sep 2013, Lior Kaplan wrote: > On Fri, Sep 27, 2013 at 3:02 PM, Derick Rethans wrote: > > > On Thu, 26 Sep 2013, Lior Kaplan wrote: > > > > > Hi, > > > > > > In Debian we build PHP for GNU/Hurd system, which need some minor fixes > > > available here: > > > > > > > > http://anonscm.de

Re: [PHP-DEV] Regenerating session ID automatically when IP address has changed

2013-09-28 Thread Peter Lind
On 28 September 2013 12:25, Leigh wrote: > > On Sep 28, 2013 10:39 AM, "Peter Lind" wrote: > > > > So you're stuck with two choices: accept that PHP security is lax and > that as a result a lot of code will have many attack vectors, or try to > change the language itself for the better. The thir

Re: [PHP-DEV] Regenerating session ID automatically when IP address has changed

2013-09-28 Thread Leigh
On Sep 28, 2013 10:39 AM, "Peter Lind" wrote: > > So you're stuck with two choices: accept that PHP security is lax and that as a result a lot of code will have many attack vectors, or try to change the language itself for the better. The third option of "educate" is a mirage. > PHP provides you

Re: [PHP-DEV] Gnu/Hurd support

2013-09-28 Thread Lior Kaplan
On Fri, Sep 27, 2013 at 3:02 PM, Derick Rethans wrote: > On Thu, 26 Sep 2013, Lior Kaplan wrote: > > > Hi, > > > > In Debian we build PHP for GNU/Hurd system, which need some minor fixes > > available here: > > > > > http://anonscm.debian.org/gitweb/?p=pkg-php/php.git;a=blob;f=debian/patches/116-

Re: [PHP-DEV] Regenerating session ID automatically when IP address has changed

2013-09-28 Thread Peter Lind
On 28 September 2013 11:27, Madara Uchiha wrote: > You guys are missing the point. This isn't a language level issue. I > can imagine some sort of package or a library being made, some sort of > wrapper around the current session commands, perhaps integrated into > some sort of extension. > > But

Re: [PHP-DEV] Regenerating session ID automatically when IP address has changed

2013-09-28 Thread Madara Uchiha
You guys are missing the point. This isn't a language level issue. I can imagine some sort of package or a library being made, some sort of wrapper around the current session commands, perhaps integrated into some sort of extension. But it is NOT a language level issue. This isn't a problem the la