Re: [PHP-DEV] CVS Account Request From: Zeev Suraski (zeev <email protected>)
Date: 11/15/00

At 23:56 15/11/2000, Andrei Zmievski wrote:
>On Wed, 15 Nov 2000, Zeev Suraski wrote:
> > So, did you find the buffer overflow bug in Onn's fribidi extension?
>
>This is getting ridiculous now. You know that buffer overflows can be
>extremely difficult to spot, even by the author himself. If you are
>equating that with a malicious attack, then I don't really understand
>what it is you are proposing. Having people mail in patches to people
>with CVS access all the time has its own problems - CVS committers may
>just start applying patches without looking them over or not really
>finding these buffer overflow bugs, so what's the difference who commits
>the code?

About buffer overflows, that's true, but I doubt anybody looked at his code
at all. I think an obvious exploit would have gone in just fine, as they
did in the past. They can be malicious one day as well.

We don't have 50 new CVS people joining the tree every day. We usually
don't even have one. Having them send in patches in the beginning (2-3
weeks) will not kill us.

Zeev 

--
Zeev Suraski   <zeev <email protected>>
CTO, Zend Technologies Ltd.  http://www.zend.com/

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>