Re: [tlug] Prevent access shared server using PHP

["Stephen J. Turnbull" <stephen@example.com>]

Darren Cook writes:

 > P.S. The existence of suhosin is a better argument for PHP being
 > insecure (while also nicely quantifying the degree of the insecurity)
 > than any of the others I saw. ;-)

Then you missed the most important one: a lot of people who have
thought carefully about security don't trust systems incorporating
PHP.  *This is not an argument from authority.*

One, (not insecure) => secure is *false*.  The "law of the excluded
middle" doesn't hold here.

Two, security is about *systems*.  A secure system is supported.

In other words, if you want security, you want some *assurance* of
security.  The people whose opinions I trust here, *and would go to
for advice*, recommend something else.  Based on assurance and
support, I would certainly look elsewhere first, if security were
important to me.

It's possible that PHP is indeed secure, as normally deployed.  But
the burden of proof is on PHP advocates, given the software's history.