Re: [Full-Disclosure] How secure is PHP ?
From: Adam Jacob Muller (adam_at_gotlinux.us)
Date: 11/02/04
- Previous message: Eric Paynter: "Re: [Full-Disclosure] OT-POLITICAL: (Was: www.georgewbush.com)"
- In reply to: Gary E. Miller: "Re: [Full-Disclosure] How secure is PHP ?"
- Next in thread: Morgan Reed: "Re: [Full-Disclosure] How secure is PHP ?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 2 Nov 2004 17:01:16 -0500
What you should do, is write a PHP program without looking at the
security doc. Then make the final exam to harden that program, they are
students, make them do the work for you.
Adam
Civil disobedience is not our problem. Our problem is civil obedience.
Our problem is that numbers of people all over the world have obeyed
the dictates of the leaders of their government and have gone to war,
and millions have been killed because of this obedience. . . Our
problem is that people are obedient all over the world in the face of
poverty and starvation and stupidity, and war, and cruelty. Our problem
is that people are obedient while the jails are full of petty thieves,
and all the while the grand thieves are running the country. That's our
problem.
-Howard Zinn
On Nov 1, 2004, at 2:05 PM, Gary E. Miller wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Yo Nayana!
>
> On Mon, 1 Nov 2004, Nayana Somaratna wrote:
>
>> However, when browsing the web, I found an article which said that "it
>> requires an expert to lockdown php" (Sorry, but I can't quite recall
>> the URL).
>
> Saying PHP in insecure is like saying C is insecure. Until their is
> a programmer involved, writing bad code, there is no problem. Just
> like
> C if the programmer carefully validates and contrains ALL input then
> the program is not only secure but robust.
>
>> So, I'd like to ask the members of this list - how difficult is it to
>> secure php ? Do you really need a security "expert" to do this ?
>
> PHP has very good write ups on security in the online doc. Here is the
> chapter:
>
> http://www.php.net/manual/en/security.php
>
> If you can read, understand and FOLLOW those recomendatins then you
> are OK.
> If not, then get the assistance of an "expert" that does.
>
> RGDS
> GARY
> -
> -----------------------------------------------------------------------
> ----
> Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701
> gem@rellim.com Tel:+1(541)382-8588 Fax: +1(541)382-8676
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (GNU/Linux)
>
> iD8DBQFBhoju8KZibdeR3qURAmzpAJ928ofMk+NqtWLPHNg/FwWQ7HE/UwCfVwpW
> eANLHG73S0GOZcgi5zyIVW0=
> =VsB9
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>
> !DSPAM:4186a5b6167422090414872!
>
On Nov 1, 2004, at 2:05 PM, Gary E. Miller wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Yo Nayana!
On Mon, 1 Nov 2004, Nayana Somaratna wrote:
However, when browsing the web, I found an article which said that "it
requires an expert to lockdown php" (Sorry, but I can't quite recall
the URL).
Saying PHP in insecure is like saying C is insecure. Until their is
a programmer involved, writing bad code, there is no problem. Just like
C if the programmer carefully validates and contrains ALL input then
the program is not only secure but robust.
So, I'd like to ask the members of this list - how difficult is it to
secure php ? Do you really need a security "expert" to do this ?
PHP has very good write ups on security in the online doc. Here is the
chapter:
http://www.php.net/manual/en/security.php
If you can read, understand and FOLLOW those recomendatins then you are
OK.
If not, then get the assistance of an "expert" that does.
RGDS
GARY
-
------------------------------------------------------------------------
--- Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701 gem@rellim.com Tel:+1(541)382-8588 Fax: +1(541)382-8676 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQFBhoju8KZibdeR3qURAmzpAJ928ofMk+NqtWLPHNg/FwWQ7HE/UwCfVwpW eANLHG73S0GOZcgi5zyIVW0= =VsB9 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html !DSPAM:4186a5b6167422090414872! _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
- Previous message: Eric Paynter: "Re: [Full-Disclosure] OT-POLITICAL: (Was: www.georgewbush.com)"
- In reply to: Gary E. Miller: "Re: [Full-Disclosure] How secure is PHP ?"
- Next in thread: Morgan Reed: "Re: [Full-Disclosure] How secure is PHP ?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
