Path: csiph.com!usenet.pasdenom.info!news.albasani.net!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail
From: Arno Welzel <usenet@arnowelzel.de>
Newsgroups: comp.lang.php
Subject: Re: PHP mysql_excape but need to search for those items
Date: Sat, 16 Jun 2012 08:33:52 +0200
Organization: A noiseless patient Spider
Lines: 49
Message-ID: <4FDC28D0.6010500@arnowelzel.de>
References: <3c8fad99-d356-4d8c-acfb-a1fe06503254@v9g2000vbc.googlegroups.com> <jr56ua$fk1$1@dont-email.me> <d2f0a619-1b69-45c0-97c7-9790ed073148@cu1g2000vbb.googlegroups.com> <jr5bdj$eth$1@dont-email.me> <a3ms9vF4htU1@mid.individual.net> <jr5mlh$u0e$1@dont-email.me> <4FD70D4F.2050104@arnowelzel.de> <jr7b0k$g6a$1@dont-email.me> <4FD98900.7040306@arnowelzel.de> <jrciir$o1h$1@dont-email.me> <4FDB9CC7.7070402@arnowelzel.de> <jrgm8i$rfe$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Injection-Info: mx04.eternal-september.org; posting-host="l9c/A+zTZgD4vXu1XJ7hjg"; logging-data="13302"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX1+PxOiOq/LTj31M7rWZfL/TAXzGURBHrWg="
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1
In-Reply-To: <jrgm8i$rfe$1@dont-email.me>
Cancel-Lock: sha1:bIGEZTQHICq7SiB/anCF4VCPrhE=
Xref: csiph.com comp.lang.php:6342

Jerry Stuckle, 16.06.2012 03:07:

> On 6/15/2012 4:36 PM, Arno Welzel wrote:
>>
[...]
>> To read more about:<http://www.kb.cert.org/vuls/id/800113>
>>
>> Just because you can not imagine that his happens in reality does not
>> mean that you can ignore the problem.
>>
> 
> Quite frankly, I don't believe everything I see on the web.  Do you have
> any proof this has actually occurred?

A well documented security hole does not exist for you, as long as
nothing worse happens to you?

["Trustworthy" CAs]
>> VeriSign is also on the list of the CAs which had at least one security
>> problem:
>>
>> <http://www.reuters.com/article/2012/02/02/us-hacking-verisign-idUSTRE8110Z820120202>
[...]
>> <http://www.thetechherald.com/articles/DigiNotar-security-incident-goes-from-bad-to-worse>
[...]
> Again, I don't believe everything I see on the Internet.   But I have
> used both Thawte and Versign, and know what a company has to go through
> to get a certificate.

I know as well what it takes to get a SSL certificate signed by
VeriSign. Not much... generally just money.

On what base do you trust VeriSign or Thawte?

[...]
>> As i already said: Don't trust a CA, only trust (or don't trust) the
>> certificate. If it changes your browser will immediately tell you - even
>> if it was signed by a CA.
> 
> So, what is your solution?  Just telling someone not to trust a CA is
> not a solution.

That *is* the solution, if the CA is not trustworthy.


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de