Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:130314 X-Original-To: internals@lists.php.net Delivered-To: internals@lists.php.net Received: from php-smtp4.php.net (php-smtp4.php.net [45.112.84.5]) by lists.php.net (Postfix) with ESMTPS id 20CF11A00BC for ; Sat, 14 Mar 2026 22:59:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=php.net; s=mail; t=1773529195; bh=mtPGJdRx+ZGRykwuqJ9BgKuL8q8XynqgxelKbl5L/yg=; h=From:Subject:Date:References:To:In-Reply-To:From; b=iNizh0aw+Bmij2+Nkkv2an6vq7zkVqzsrhxaYFTKdBfSdnTUTa4Uv0rWmT+DN0XHO fFltyBhI5t2e8PL6y526pHzK9BWT6omghl52ep+ndPy3mMFygbIQQmg6jlWCJOp44c yCbkGISCR3e1qDeFYwYQnUY+3hj99gME3078dDE1tl1AjowhrKZntWjQZ5dlWJrpFL XSC/OavJqC2e0bdoAdnqGZwQ2nOyuvdm1X5EvbgspNDL7ylUV+A1vFL/daZwYzLzlT k+BmhkjH9B9hgwItpfy+Nqm+cmfSdoV6zJC0IsIJq3Ej7kRz0oNpYAoGo4UknugV52 fh7J+/FsD2cBg== Received: from php-smtp4.php.net (localhost [127.0.0.1]) by php-smtp4.php.net (Postfix) with ESMTP id D2C14180059 for ; Sat, 14 Mar 2026 22:59:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on php-smtp4.php.net X-Spam-Level: X-Spam-Status: No, score=0.6 required=5.0 tests=BAYES_50,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,DMARC_PASS,SPF_PASS, T_SPF_HELO_TEMPERROR autolearn=no autolearn_force=no version=4.0.1 X-Spam-Virus: No X-Envelope-From: Received: from mail.gna.ch (darkcity.gna.ch [84.234.28.114]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by php-smtp4.php.net (Postfix) with ESMTPS for ; Sat, 14 Mar 2026 22:59:48 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.gna.ch (Postfix) with ESMTP id C1F192380A54 for ; Sat, 14 Mar 2026 23:59:41 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=cschneid.com; s=default; t=1773529181; bh=mtPGJdRx+ZGRykwuqJ9BgKuL8q8XynqgxelKbl5L/yg=; h=From:Subject:Date:References:To:In-Reply-To; b=DfOxYtV5AEXzLPseg6L0dI+nU+vd2muqmKZptfh/9XI1zugIsVrdt1KxLZferwoaP A4zS6Q/v7eqRvg1CpzfmG31wfLbMoE2vdC4LjIbe8YesNOZzQ1hU0yjta8w1d90zMA LOFrCCbJoH0f0PQQhWWKABoIIWmoKtZzdnWv/zYk= X-Virus-Scanned: amavisd-new at gna.ch Received: from mail.gna.ch ([127.0.0.1]) by localhost (mail.gna.ch [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bOB2MjT7zQFn for ; Sat, 14 Mar 2026 23:59:39 +0100 (CET) Received: from smtpclient.apple (unknown [IPv6:2a02:1210:2e2d:4d00:15e0:3e54:f642:7833]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail.gna.ch (Postfix) with ESMTPSA id 3A9E723800E3 for ; Sat, 14 Mar 2026 23:59:39 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=cschneid.com; s=default; t=1773529179; bh=mtPGJdRx+ZGRykwuqJ9BgKuL8q8XynqgxelKbl5L/yg=; h=From:Subject:Date:References:To:In-Reply-To; b=NNxWMiqtMxMpuHyx2YtcL15Xy469SZ+03r+ecjnc6hrraGPTMK/fHTR6hklI0Akvq Ko73Y5DzNxZXg+PMqtxOCGSLVKr0VSHpIW8hynNrRlZpkfjjS3/HBys+EkgPctI5YL mZOs7td9iBfDyt80swZgPsSRxzW4Iao+isIZ/CaY= Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Precedence: list list-help: list-unsubscribe: list-post: List-Id: x-ms-reactions: disallow Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.400.21\)) Subject: Re: [PHP-DEV] [RFC] php-community: a faster-moving, community-driven PHP. Date: Sat, 14 Mar 2026 23:59:38 +0100 References: <839153A0-004D-4562-BD6E-65923201EDAA@gmail.com> To: internals@lists.php.net In-Reply-To: <839153A0-004D-4562-BD6E-65923201EDAA@gmail.com> Message-ID: <166C02DA-50BC-4283-86F9-18AD7A49E2C1@cschneid.com> X-Mailer: Apple Mail (2.3864.400.21) From: cschneid@cschneid.com (Christian Schneider) Am 14.03.2026 um 19:32 schrieb Daniil Gentili = : > Submitting for discussion the php-community RFC, for a faster-moving, = community-driven PHP: https://wiki.php.net/rfc/php-community >=20 > With this proposal, the entire PHP community gets immediate access to = experimental features through an official php-community version of PHP, = versioned in a rolling manner (i.e. php-community 2026.03.01), and = available on php.net along normal PHP releases.=20 My understanding is that a) this creates a fork of PHP in the sense that a separate version has = to be maintained b) you assume the same core developers will be in charge of the what I = call "stable" and the "community" version of PHP Is that correct? This makes me worried about the additional burden on the core = maintainers as well as compatibility issues for package maintainers = ("this library is only guaranteed to work with = php-community-yyyy1-mm1-dd1 to php-community-yyyy2-mm2-dd2 but not the = base php" or vice versa). Another thing I am a bit confused about is the inclusion of sandboxing = as part of this RFC: Is this really an integral part of the community = version? And while we're at it: As long as the community version allows = for PECL/PIE/whatever extensions then the sandboxing could be broken by = those extensions, so this can lead to a false sense of security / needs = auditing of all extensions included in a version. That's why I'm wary of = including it as a secondary feature, it feels a bit tacked on to me for = a security topic. Regards, - Chris