<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 07/21/2013 08:53 PM, JD wrote:<br>
</div>
<blockquote cite="mid:51EC82A1.5000504@algoloma.com" type="cite">
<pre wrap="">Regardless, we all learn to rely on outside expert opinions in areas where we
cannot become an expert. The security experts to which I listen will not put
php code on the internet and only allow it internally when accessed directly
from the corporate network or over a VPN. While I have a slight interest in
software security, none of it includes trying to make php programs better. I'd
prefer to make multithreaded C code safe for direct internet use - it would be
much less painful. <span class="moz-smiley-s3" title=";)"><span>;)</span></span></pre>
</blockquote>
<br>
Agreed; having written several systems in both PHP and C, I prefer C
if the choice is available. There's too much auto-fsck-you in PHP
for me.<br>
<br>
However, one place where I can say that PHP apps are "secure enough"
is when they're behind a Kerberos-aware Apache that is properly
configured (e.g., disallows basic auth for Kerberos and uses only
negotiate).<br>
<br>
— Mike<br>
<br>
<div class="moz-signature">-- <br>
<table border="0">
<tbody>
<tr>
<td> <img src="cid:part1.07060201.04020905@naunetcorp.com"
alt="Naunet Corporation Logo"> </td>
<td> Michael B. Trausch<br>
<br>
President, <strong>Naunet Corporation</strong><br>
☎ (678) 287-0693 x130 or (888) 494-5810 x130<br>
<br>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>