On Sun, 31 Dec 2006, Kevin Waterson wrote: > This one time, at band camp, Gadi Evron <ge@xxxxxxxxxxxx> wrote: > > > > > Indeed, the most annoying thing about the PHP worms today is that these > > PHP vulnerabilities being exploited are everywhere. > > These are not PHP vulnerabilities, these are application vulnerabilities. > I agree. Unless this thread is focusing on vulnerabilities in the PHP parser itself, exploitable simply by pushing arbitrary information through any available post/get channel, then I think we can call it a PHP vulnerability. Until then, let's keep the FUD to a minimum. *ANY* language implemented for *ANY* purpose is as secure as the programmer makes it. The way the original post is written, s/PHP/(Perl|ASP|C|bash|BASIC|four little buddhist monks fighting over an abacus)/ is applicable. The vulnerabilities that we see, that Gadi refers to, aren't widespread because PHP is widespread, but because insecure applications written in PHP are. A better use of energy would be focusing on the most vulnerable platforms and educating the developers. - billn
