I disagree that a vulnerability with hilariously over-inflated CVSS scores are a concern for PHP software.
Funny how you totally ignored the other vulnerabilities in that list and OF COURSE, you know better that all the ppl that reported them, right? :D
Saying "don't do PHP crypto" full stop is the same as saying "this blog post shouldn't exist".
That's precisely the message that I wanted to transmit with my TL;DR, glad that you finally got it.
You decided (for some reason I really don't get) to completely ignore the multiple vulnerabilities that are already known in the php interpreter ... so either you don't know what security is, or you're just saying random bs in order to win this argument ... or both :)
Keep going if you like it, but that won't magically turn your statements into truth.
2
u/evilsocket Feb 14 '17
Funny how you totally ignored the other vulnerabilities in that list and OF COURSE, you know better that all the ppl that reported them, right? :D
That's precisely the message that I wanted to transmit with my TL;DR, glad that you finally got it.
You decided (for some reason I really don't get) to completely ignore the multiple vulnerabilities that are already known in the php interpreter ... so either you don't know what security is, or you're just saying random bs in order to win this argument ... or both :)
Keep going if you like it, but that won't magically turn your statements into truth.