Why isn't Suhosin part of the PHP core?

Question

It seems Suhosin patches and extends the PHP core as a means to protect users from flaws in the core. It also seems some smart people are using this system. Since it appears to be a good thing, I'm curious as to why its not part of the PHP core to begin with. Anybody know?

Update: Apparently some distributions of Linux also package PHP with Suhosin by default. This seems to be true for Debian (Lenny at least) and Arch Linux. Any other distributions package PHP with Suhosin by default?

Answer 1

One of the main guys behind Suhosin is Stefan Esser. Stefan seems to have had on ongoing disagreement with the PHP core developers with regard to security over the last few years. He was also one of the guys behind the month of PHP bugs which was intended to draw attention to the (in Stefan's opinion) sad state of PHP core security.

Given that the Suhosin guys have decided to go their own way and work outside the PHP project, I can imagine that:

• It's possible that Suhosin hasn't been contributed back for inclusion.
• The Suhosin guys haven't been able to convince the PHP team of it's usefulness, or haven't tried.
• The core PHP team isn't open to contributions from the guys behind Suhosin.

Some Linux distributions such as Debian (Etch and Lenny), Ubuntu and Arch include the Suhosin patch in their PHP package, so on those systems you'll often find it's turned on by default. Red Hat derived distributions (Red Hat Enterprise, CentOS, Fedora, etc) don't include Suhosin in their PHP packages.

Note: I have no association with Core PHP devs, or Suhosin, but a reasonable guess based on some of the personalities involved.

Answer 2

I would guess the main reasons for the php team not to include Suhosin are:

• It may break existing (badly written) php code
• It may break (badly written) php extensions (I remember Zend Optimizer being problematic)