Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:42157
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.191 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references:x-google-sender-auth;
        b=BSRn/30jn9b9Thtk11pv6XrvYdz9oevazA6vk4BntQ5LU9vs7lsDAityVVcPL8H2pe
         cwc+9aXgUnY/NAx/Z3ZLHE5yQTYumbIlCi4vtLs0+MwwzFN0637XAtc+hCTifQ5XMVS5
         xRHMBDIxSYRZkMoYsSygdC9LppG8YikKkxo+s=
Message-ID: <7f3ed2c30812080818x6a29709bgcfc894b2a225b9b6@mail.gmail.com>
Date: Mon, 8 Dec 2008 17:18:41 +0100
Sender: hannes.magnusson@gmail.com
To: "Pierre Joye" <pierre.php@gmail.com>
Cc: "=?ISO-8859-1?Q?Johannes_Schl=FCter?=" <johannes@php.net>, 
	"PHP Internals List" <internals@lists.php.net>
In-Reply-To: <fe05d1540812080757r417038d0ib768cbd8990be228@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <1228751251.3429.18.camel@goldfinger.johannes.nop>
	 <fe05d1540812080757r417038d0ib768cbd8990be228@mail.gmail.com>
Subject: Re: [PHP-DEV] About dropping magic_quotes in 5.3 (was: Re: [PHP-DEV] Re: PHP 5.2.7 + magic_quotes_gpc broken)
From: bjori@php.net ("Hannes Magnusson")

On Mon, Dec 8, 2008 at 16:57, Pierre Joye <pierre.php@gmail.com> wrote:
> On Mon, Dec 8, 2008 at 4:47 PM, Johannes Schl=FCter <johannes@php.net> wr=
ote:
>>
>> When dropping magic_quotes the hosting company can do one of two things:
>>
>> a) not update to 5.3 so we either have to maintain 5.2 for some time or
>> let them have problems
>
> +1

We cannot simply nuke a feature that was once upon a time sold as a
security feature, and is still enabled by default, just "out of the
blue".



> I already discussed the possibility to maintain the 5.2 branch after
> 5.3-final (irc and some meetings) and I like to do it (in any case). I
> do think it is something to do but only for critical bug fixes
> (security or crash only).

Of course should we continue to do security releases for "previous
minor releases" until the "new one" is up to .2 or .3 at least.


> We may say that it is the job of the distributors, but I'd to
> disagree. It is critical for us to provide sources and binary releases
> of a stable branch officially, even after a newer branch has been
> released.

How are distributions supposed to keep up to date with security fixes
anyway? The only distro that has a chance is RHEL because they have an
"inside guy".
We really need to work on our relationship with other distros,
starting with marking security fixes as security fixes.

-Hannes