RE: [PHP-DEV] CVS Account Request From: Zeev Suraski (zeev <email protected>)
Date: 11/15/00

At 23:17 15/11/2000, Mike Robinson wrote:
>Rasmus wrote:
>
> > We have yet to have a problem and it feels to me like you
> > are trying to fix something that isn't broken.
>
>IMHO, bingo.

I was actually meaning to try and test this system, by applying from a fake
Email, obtaining access, and injecting a security hole into the source
tree, just to show how easy it is. I finally decided against it, mainly
due to lack of time.

Do you guys remember the people who hacked apache.org? They did it just to
show how easy it is, and if they weren't 'white hats', they could have
easily injected bogus code into the most popular Web server in the
world. PHP is the most popular opensource Web language in the world, and
we shouldn't make it easier for hackers to get in.

In my opinion, waiting for such a thing to happen instead of fixing it
beforehand is, well, not-smart.

CVS ACL's may be the best solution, I'm not too familiar with what you can
and cannot do with them yet.

Zeev 

--
Zeev Suraski   <zeev <email protected>>
CTO, Zend Technologies Ltd.  http://www.zend.com/

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>