News for hackers. Stuff that matters.
Re:PHPMailer Exploit – Remote Code Execution by jpalomaki on Wednesday December 28, 2016 @04:46AM (#13269540)
Using command line is the standard way in Linux and de-facto standard in *nix world.

"To deliver electronic mail (email), applications shall support the interface provided by sendmail (described here). This interface shall be the default delivery method for applications."

http://refspecs.linux-foundation.org/LSB_3.0.0/LSB-PDA/LSB-P...

Re:PHPMailer Exploit – Remote Code Execution by kogepathic on Wednesday December 28, 2016 @05:59AM (#13269771)
Yes but PHP runs on non-*NIX platforms[0]. So why not use an interface which is (a) more secure, and (b) platform independent?

[0] http://windows.php.net/

Re:PHPMailer Exploit – Remote Code Execution by throwanem on Wednesday December 28, 2016 @06:35AM (#13269885)
Why do anything that makes sense? All I can say about the PHP maintainers' decision process without swearing is that it bewilders me.

Last time I tried configuring a Linux-hosted PHP to do SMTP on localhost:25 instead of shelling out to call sendmail, I found that only Windows builds even have that functionality compiled in. You can apply the same configuration options on a stock Linux build, and they won't cause errors, but they won't do anything, either. Maybe that's changed recently, but it would have to have been very recently, because I ran into this (for the umpteenth time) just a few months ago, while reworking my team's dev environment to allow for examining sent mail without requiring heroism.

I'm not a PHP hater, exactly. I don't like the language at all, but I understand it well and have made a very good living based partly on that knowledge. But the mail story in PHP has never not been a dumpster fire.

Re:PHPMailer Exploit – Remote Code Execution by arasx on Wednesday December 28, 2016 @11:35AM (#13271608)
There are hundreds of ready made libraries which help you easily talk to SMTP without invoking a shell cmd. You also have the option to use sock functions (fsockopen) and write your connection wrapper. These are not windows-only features.
Re:PHPMailer Exploit – Remote Code Execution by throwanem on Wednesday December 28, 2016 @11:44AM (#13271680)
Of course. The part I still can't get my head around is where the language feature that'd relieve me of the need to vet a library, or worse write socket code by hand like some kind of barbarian, isn't compiled in for non-Windows platforms, because reasons.
Re:PHPMailer Exploit – Remote Code Execution by Piskvorrr on Thursday December 29, 2016 @05:43AM (#13276662)
¯\_(ツ)_/¯ PHP. This is one of the insane decisions made in PHP4 that stays there because it's always been there.