为什么 Suhosin 不是 PHP 核心的一部分？
Suhosin 似乎修补并扩展了 PHP 核心，作为保护用户免受核心缺陷影响的一种手段。 似乎也有一些聪明人正在使用这个系统。 既然它看起来是一件好事，我很好奇为什么它不是 PHP 核心的一部分。 有人知道吗？
更新： 显然，某些 Linux 发行版也默认将 PHP 与 Suhosin 一起打包。 对于 Debian（至少是 Lenny）和 Arch Linux 来说似乎是这样。 有其他发行版默认将 PHP 与 Suhosin 一起打包吗？
It seems Suhosin patches and extends the PHP core as a means to protect users from flaws in the core. It also seems some smart people are using this system. Since it appears to be a good thing, I'm curious as to why its not part of the PHP core to begin with. Anybody know?
Update: Apparently some distributions of Linux also package PHP with Suhosin by default. This seems to be true for Debian (Lenny at least) and Arch Linux. Any other distributions package PHP with Suhosin by default?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Suhosin 背后的主要人物之一是 Stefan Esser。 过去，Stefan 似乎与 PHP 核心开发人员在安全性方面存在持续分歧几年。 他也是 PHP 错误月背后的人之一，该活动旨在引起人们对（Stefan 认为）PHP 核心安全状况令人悲哀。
鉴于 Suhosin 的人决定走自己的路，在 PHP 项目之外工作，我可以想象：
一些 Linux 发行版，例如 Debian（Etch 和 Lenny）、Ubuntu 和 Arch 在其 PHP 包中包含 Suhosin 补丁，因此在这些系统上，您经常会发现它默认处于打开状态。 Red Hat 派生发行版（Red Hat Enterprise、CentOS、Fedora 等）的 PHP 软件包中不包含 Suhosin。
注意：我与核心 PHP 开发人员或 Suhosin 没有任何关系，但根据一些涉及的人物做出了合理的猜测。
One of the main guys behind Suhosin is Stefan Esser. Stefan seems to have had on ongoing disagreement with the PHP core developers with regard to security over the last few years. He was also one of the guys behind the month of PHP bugs which was intended to draw attention to the (in Stefan's opinion) sad state of PHP core security.
Given that the Suhosin guys have decided to go their own way and work outside the PHP project, I can imagine that:
Some Linux distributions such as Debian (Etch and Lenny), Ubuntu and Arch include the Suhosin patch in their PHP package, so on those systems you'll often find it's turned on by default. Red Hat derived distributions (Red Hat Enterprise, CentOS, Fedora, etc) don't include Suhosin in their PHP packages.
Note: I have no association with Core PHP devs, or Suhosin, but a reasonable guess based on some of the personalities involved.
我猜想 php 团队不包括 Suhosin 的主要原因是：
I would guess the main reasons for the php team not to include Suhosin are:
我想知道他们是否将代码贡献回主 php 项目中？
这通常是新代码集成到开源项目中的方式。
I wonder have they contributed their code back into the main php project?
This is usually how new code gets integrated into open-source projects.