3 ms·
At this point I don't think its smart to wait. It's time to move on and start looking at alternative ways to lock down PHP. I'm running 5.4 and had to make the
by bpatrianakos 14y ago
At this point I don't think its smart to wait. It's time to move on and start looking at alternative ways to lock down PHP. I'm running 5.4 and had to make the difficult decision to upgrade my server without it. There can be PHP security without Suhosin. And maybe I have bad information but hasn't there not been a single peep out of the Suhosin project for a seriously long time?
- ck2 14y agoHe did make it work with php 5.4.0 when the branch first came out. That was "only" six months ago so it's not forever. Unless you do not use any third party code and have your own code audited, it's foolish not to run with suhosin. I'm still trying to get over the naked feeling of running without magic quotes in 5.4 when using third-party code.
- bpatrianakos 14y agoPoint taken but I don't understand your aversion to no more magic quotes. Yeah, it's helpful when you run third party code but the benefits outweigh the costs. Anyone running third party code should be testing it first anyway and in the long run magic quotes gave people a false sense of security and promoted a very lax attitude toward security no matter how many times people screamed about not relying on magics quotes.