Re: Document the bug fix policy regarding PHP Safe Mode
* MJ Ray:
> Florian Weimer <fw@deneb.enyo.de> wrote:
>> <p>This decision is based on the on two observations: Most PHP users
>> are small-scale users, not service providers. As a result, they do
>> not have to deal with the challenge of multiple users who need to
>> write PHP scripts which run on the web server, but do not trust each
>> other. [...]
>
> Where does this observation come from and do we know whether it's
> true for debian? I certainly know a higher proportion of multi-user
> servers with PHP installed than the proportion of desktop systems
> I know with PHP.
Multi-user servers where most users have shell access are a non-issue
as far as PHP Safe Mode is concerned. The desire behind Safe Mode is
that your users can upload arbitrary PHP scripts, and still don't get
shell access to the box.
> [...]
>> <p>Of course, it is possible to enable Safe Mode as an additional
>> layer of defense. However, as the only layer, it is far too weak.</p>
>
> It is possible to use this layer, but not very convenient if
> debian-packaged PHP apps won't run safely in Safe Mode.
Do you mean "reliably"? Yes, that's a further point for not wasting
time supporting Safe Mode.
I've been told that Safe Mode is indeed very annoying for users, so it
wouldn't be that useful in an ISP environment, even if it were
actually secure.
Reply to: