News for hackers. Stuff that matters.
Re:I think tumblr has a huge security hole by brown9-2 on Saturday March 19, 2011 @09:24AM (#2343521)
This sounds like "insecure by default" to me - you have to have the opening stanza correct in order for the file contents to be treated as code.

Perhaps a more secure idea would be to require an opening stanza for the reverse - for content that should simply be printed to standard out? i.e. <?out to make content that should be outputed, not <?php for content that should be interpreted.

Re:I think tumblr has a huge security hole by russss on Saturday March 19, 2011 @09:36AM (#2343536)
Sure - I'm not defending PHP. This is all the case for backwards compatibility.

The easiest solution would be to define a new file extension/MIME type which is "PHP-by-default".

Re:I think tumblr has a huge security hole by nikcub on Saturday March 19, 2011 @11:44AM (#2343843)
that is a great idea. I check if any of the 'hardened php' projects do this, and they don't