Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 28 Jun 2012 14:58:20 -0700
From: Rasmus Lerdorf <>
To: Kurt Seifried <>
 Stuart Henderson <>,
 "" <>
Subject: Re: Re: PHP information disclosure via easter egg

Hash: SHA1

On 06/28/2012 11:29 AM, Kurt Seifried wrote:
> Yeah my bad, I just skimmed the list (it was late). Just for
> future reference as well the other magic values are:
> ext/standard/info.h:#define PHP_LOGO_GUID 
> "PHPE9568F34-D428-11d2-A769-00AA001ACF42"
> ext/standard/info.h:#define PHP_EGG_LOGO_GUID 
> "PHPE9568F36-D428-11d2-A769-00AA001ACF42"
> ext/standard/info.h:#define ZEND_LOGO_GUID 
> "PHPE9568F35-D428-11d2-A769-00AA001ACF42"
> ext/standard/info.h:#define PHP_CREDITS_GUID 
> "PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000"
> I guess I'm just not a huge fan of surprises in my software =).
> The expose_php variable appears to control them all no problem.

Just for some history on this somewhat odd feature. It was added in
order to be able to put the PHP logo on the phpinfo() page. We had
originally just used an img link to, but got a lot of
phone-home privacy complaints about that. So we needed a way to
display an image locally and didn't want to have to try to figure out
where to copy that image during installation, plus it would be hard to
manage access to it and the overall idea of copying anything to
someone's docroot just sucks. So, we could either have given up on it,
or, bake it into PHP this way along with an ini switch to disable it.
The motivation wasn't to add an easter egg. The April 1
PHP_EGG_LOGO_GUID came later.

- -Rasmus
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla -


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.