Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:23367
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <4468848D.5020602@php.net>
Date: Mon, 15 May 2006 15:39:25 +0200
User-Agent: Thunderbird 1.5.0.2 (Windows/20060308)
MIME-Version: 1.0
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit
Subject: PHP Release Process Sucks
From: sesser@php.net (Stefan Esser)

Hello,

okay, mistakes happen everyday but it really sucks that PHP.net
continues trying to hide mistakes.

1) PHP 5.1.4 was released with a nonsense announcement claiming that
there was only a problem with POST arrays or POST fileuploads.
    -> In reality a paid Zend developer had destroyed the handling of
arrays in any kind of user input in PHP 5.1.3 completely. Ironically
after that incident another Zend man came forward and dares to say "I
don't trust our core testers anymore"
2) PHP 5.1.4 was lacking the PEAR installer which resulted in make
install downloading the file from the web.
    a) this part should be removed from the make file completlely
because 'make install' is usually executed as root and under no
circumstances should download a file from an insecure HTTP source.
    b) this fact was again hidden by silently replacing the PHP 5.1.4
tarball with a new one, after the other one was out for more than a week.

PHP.net is more and more turning into Microsoft (more than 3 months to
resolve critical security problems). I guess that comes with the
involvement of Enterprise companies.

Yours,
Stefan Esser