Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: scylldb and php? anyone building a site with them on archlinux? Date: Sat, 9 Nov 2019 20:58:03 +0100 Lines: 17 Message-ID: References: <4e081378-85fa-4ff5-88a5-b6580c9330b1@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net 3KNKWiXNI5xRigbMREThuQYFTnaN1hH4mehw2G499lp6iO/+4O Cancel-Lock: sha1:bcuYfa9Iv6HCRfc8giQpWcxUgbk= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.2.0 In-Reply-To: Content-Language: en-US-large Xref: csiph.com comp.lang.php:18106 On 09/11/2019 17.03, Arno Welzel wrote: > If a vulnerability allows code execution it does not matter, if PHP is > used as an init system or not. The attacker does not need to gain full > access over a system to compromise a website and abuse it for his own > purposes. Sure, a code execution vulnerability is a serious problem no matter which application has the vulnerability, but when it's process number 1 which has this vulnerability the problem is a lot worse than a process that is run as a none privileged user. A none privileged user can do less damage to the system than the one root user which has power over them all (even worse than run a vulnerable php as root user). -- //Aho