Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130349
Precedence: list
MIME-Version: 1.0
References: <839153A0-004D-4562-BD6E-65923201EDAA@gmail.com>
 <CAEKnhAFH52dvOoJzW5OwfEy1fKnpTAQd9fjMZAsjML7voC3EbA@mail.gmail.com> <CAKXKfQsvF33tfuAF1t+GYAGcJA8H8QChQVp2YNODCLTmioHbkA@mail.gmail.com>
In-Reply-To: <CAKXKfQsvF33tfuAF1t+GYAGcJA8H8QChQVp2YNODCLTmioHbkA@mail.gmail.com>
Date: Sun, 15 Mar 2026 16:36:35 +0100
Message-ID: <CAEKnhAGaO_6GSZ1+-6bwQs8XafWDxxnxZ48Am1D5Ad8XDWsroQ@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] php-community: a faster-moving, community-driven PHP.
To: Daniil Gentili <daniil.gentili@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000bd1f83064d11de85"
From: bukka@php.net (Jakub Zelenka)

--000000000000bd1f83064d11de85
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Mar 15, 2026 at 3:51=E2=80=AFPM Daniil Gentili <daniil.gentili@gmai=
l.com>
wrote:

>
>
> I don't understand the security part. Do you mean that people could repor=
t
>> security issues for those community branches? If so, then it's completel=
y
>> unrealistic as we are already struggling with handling security issues f=
or
>> the current branches.
>>
>
>
> I honestly do not consider seriously any argument based on "it's too much
> load for maintainers", including around security (which is still a
> responsibility of feature owners).
>
>
Except feature owners won't be able do any triaging, security impact
analysis (deciding whether it's a security issue - this is done by the
security team), allocating CVE's, test the patches in our security repo, do
the security release and publishing / updating all advisories. And I'm not
even considering extra reporting will be required by CRA. So I think you
might be underestimating the amount of work for handling security issues.

Kind regards,

Jakub

--000000000000bd1f83064d11de85
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Sun, Mar 15, 2026 at 3:51=E2=80=AFPM D=
aniil Gentili &lt;<a href=3D"mailto:daniil.gentili@gmail.com">daniil.gentil=
i@gmail.com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_conta=
iner"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=
order-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"auto"><=
br><div class=3D"gmail_quote" dir=3D"auto"><div dir=3D"ltr" class=3D"gmail_=
attr"><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=
=3D"ltr"><div class=3D"gmail_quote"><div>I don&#39;t understand the securit=
y part. Do you mean that people could report security issues for those comm=
unity branches? If so, then it&#39;s completely unrealistic as we are alrea=
dy struggling with handling security issues for the current branches. </div=
></div></div></blockquote></div><div dir=3D"auto"><br></div><div dir=3D"aut=
o"><br></div><div dir=3D"auto">I honestly do not consider seriously any arg=
ument based on &quot;it&#39;s too much load for maintainers&quot;, includin=
g around security (which is still a responsibility of feature owners).</div=
><div dir=3D"auto"><br></div></div></blockquote><div><br></div><div>Except =
feature owners won&#39;t be able do any triaging, security impact analysis =
(deciding whether it&#39;s a security issue - this is done by the security =
team), allocating CVE&#39;s, test the patches in our security repo, do the =
security release and publishing / updating all advisories. And I&#39;m not =
even considering extra reporting will be required by CRA. So I think you mi=
ght be underestimating the amount of work for handling security issues.</di=
v><div><br></div><div>Kind regards,</div><div><br></div><div>Jakub</div></d=
iv></div>

--000000000000bd1f83064d11de85--