Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130351
Precedence: list
MIME-Version: 1.0
References: <839153A0-004D-4562-BD6E-65923201EDAA@gmail.com>
 <CAEKnhAFH52dvOoJzW5OwfEy1fKnpTAQd9fjMZAsjML7voC3EbA@mail.gmail.com>
 <CAKXKfQsvF33tfuAF1t+GYAGcJA8H8QChQVp2YNODCLTmioHbkA@mail.gmail.com> <CAEKnhAGaO_6GSZ1+-6bwQs8XafWDxxnxZ48Am1D5Ad8XDWsroQ@mail.gmail.com>
In-Reply-To: <CAEKnhAGaO_6GSZ1+-6bwQs8XafWDxxnxZ48Am1D5Ad8XDWsroQ@mail.gmail.com>
Date: Sun, 15 Mar 2026 16:45:57 +0100
Message-ID: <CAKXKfQsEQvJSzmHxAAkuW33FcMcQPaaF_ri-O3EDNbYtcZr7zQ@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] php-community: a faster-moving, community-driven PHP.
To: Jakub Zelenka <bukka@php.net>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000003872f1064d1200c3"
From: daniil.gentili@gmail.com (Daniil Gentili)

--0000000000003872f1064d1200c3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Il dom 15 mar 2026, 16:36 Jakub Zelenka <bukka@php.net> ha scritto:

> On Sun, Mar 15, 2026 at 3:51=E2=80=AFPM Daniil Gentili <daniil.gentili@gm=
ail.com>
> wrote:
>
>>
>>
>> I don't understand the security part. Do you mean that people could
>>> report security issues for those community branches? If so, then it's
>>> completely unrealistic as we are already struggling with handling secur=
ity
>>> issues for the current branches.
>>>
>>
>>
>> I honestly do not consider seriously any argument based on "it's too muc=
h
>> load for maintainers", including around security (which is still a
>> responsibility of feature owners).
>>
>>
> Except feature owners won't be able do any triaging, security impact
> analysis (deciding whether it's a security issue - this is done by the
> security team), allocating CVE's, test the patches in our security repo, =
do
> the security release and publishing / updating all advisories. And I'm no=
t
> even considering extra reporting will be required by CRA. So I think you
> might be underestimating the amount of work for handling security issues.
>

I do not underestimate it, I simply do not consider it to be a problem,
given the context of PHP needing a LOT of new features in order to compete
with modern languages.

Userland has been pollyfilling them left and right (static analysis,
amphp), but this is not the way forward.

A serious discussion needs to be done around a simple question.

Does internals want to keep PHP mostly as-is, in de facto maintainance mode
(just security fixes, no expensive major features) to reduce the workload
on maintainers, and slowly creep into irrelevance?

Because this is, put bluntly, what is being proposed.



>

--0000000000003872f1064d1200c3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><br><br><div class=3D"gmail_quote" dir=3D"auto"><div dir=
=3D"ltr" class=3D"gmail_attr">Il dom 15 mar 2026, 16:36 Jakub Zelenka &lt;<=
a href=3D"mailto:bukka@php.net" target=3D"_blank" rel=3D"noreferrer">bukka@=
php.net</a>&gt; ha scritto:<br></div><blockquote class=3D"gmail_quote" styl=
e=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div di=
r=3D"ltr"><div dir=3D"ltr">On Sun, Mar 15, 2026 at 3:51=E2=80=AFPM Daniil G=
entili &lt;<a href=3D"mailto:daniil.gentili@gmail.com" rel=3D"noreferrer no=
referrer" target=3D"_blank">daniil.gentili@gmail.com</a>&gt; wrote:</div><d=
iv class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"margin:=
0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">=
<div dir=3D"auto"><br><div class=3D"gmail_quote" dir=3D"auto"><div dir=3D"l=
tr" class=3D"gmail_attr"><br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex"><div dir=3D"ltr"><div class=3D"gmail_quote"><div>I don&#39;t und=
erstand the security part. Do you mean that people could report security is=
sues for those community branches? If so, then it&#39;s completely unrealis=
tic as we are already struggling with handling security issues for the curr=
ent branches. </div></div></div></blockquote></div><div dir=3D"auto"><br></=
div><div dir=3D"auto"><br></div><div dir=3D"auto">I honestly do not conside=
r seriously any argument based on &quot;it&#39;s too much load for maintain=
ers&quot;, including around security (which is still a responsibility of fe=
ature owners).</div><div dir=3D"auto"><br></div></div></blockquote><div><br=
></div><div>Except feature owners won&#39;t be able do any triaging, securi=
ty impact analysis (deciding whether it&#39;s a security issue - this is do=
ne by the security team), allocating CVE&#39;s, test the patches in our sec=
urity repo, do the security release and publishing / updating all advisorie=
s. And I&#39;m not even considering extra reporting will be required by CRA=
. So I think you might be underestimating the amount of work for handling s=
ecurity issues.</div><div></div></div></div></blockquote></div><div dir=3D"=
auto"><br></div><div dir=3D"auto">I do not underestimate it, I simply do no=
t consider it to be a problem, given the context of PHP needing a LOT of ne=
w features in order to compete with modern languages.</div><div dir=3D"auto=
"><br></div><div dir=3D"auto">Userland has been pollyfilling them left and =
right (static analysis, amphp), but this is not the way forward.</div><div =
dir=3D"auto"><br></div><div dir=3D"auto">A serious discussion needs to be d=
one around a simple question.</div><div dir=3D"auto"><br></div><div dir=3D"=
auto">Does internals want to keep PHP mostly as-is, in de facto maintainanc=
e mode (just security fixes, no expensive major features) to reduce the wor=
kload on maintainers, and slowly creep into irrelevance?</div><div dir=3D"a=
uto"><br></div><div dir=3D"auto">Because this is, put bluntly, what is bein=
g proposed.</div><div dir=3D"auto"><br></div><div dir=3D"auto"><br></div><d=
iv class=3D"gmail_quote" dir=3D"auto"><blockquote class=3D"gmail_quote" sty=
le=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div d=
ir=3D"ltr"><div class=3D"gmail_quote"><div><br></div></div></div>
</blockquote></div></div>

--0000000000003872f1064d1200c3--