11–20 of 107 posts
wow From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
wow From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
wow From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
wow From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
> binding exception Two words -- honor code. Rock the boat and you will find yourself in an unpleasant situation, so instead everybody does good work and nobody asks too many questions.
The takeway: You should never use user input on unserialize. Assuming that using an up-to-date PHP version is enough to protect unserialize in such scenarios is a bad idea. Avoid it or use less complex serialization methods like JSON.
https://paragonie.com/blog/2016/04/securely-implementing-de-...
The takeway: You should never use user input on unserialize. Assuming that using an up-to-date PHP version is enough to protect unserialize in such scenarios is a bad idea. Avoid it or use less complex serialization methods like JSON.
[1] https://www.reddit.com/r/PHP/comments/3j88v4/something_about...
Earlier quoted context omitted.
Must be a funny comparison group you have there.
I'm certainly positive it's faster than Ruby, Python and Java.
In my experience php is fast enough until you start generating lots of garbage. It seems it wasn't really designed to garbage collect at all, but to rely on the per-request cleanup.