Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:64678
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain schlueters.de from 217.114.211.66 cause and error)
To: Pierre Joye <pierre.php@gmail.com>
Cc: Clint Priest <cpriest@zerocue.com>, Kris Craig <kris.craig@gmail.com>, 
 PHP internals <internals@lists.php.net>
In-Reply-To: <CAEZPtU6TN7H9MxPz6U0QMptUC98AfjV-DtEiGHCksGS=R3cCKA@mail.gmail.com>
References:
	 <CAEZPtU4gEsLVnOv-CUk5c4qqQGLf_Q-4cmHoOo81E6HG8Xsb7Q@mail.gmail.com>
	 <CAKOpQSzutTaMZm6z1Ut-x-o45Gy5bXfaqzw-5OOx1cw-Xj+6Bg@mail.gmail.com>
	 <CAEZPtU7SOdiwy5NJvjHj-yLPLerY6YXM95iKW9BSM6LYE1HhvQ@mail.gmail.com>
	 <CCCC6F2C-38D7-4FBD-953E-35DAEA9C0D5A@zerocue.com>
	 <CAEZPtU6TN7H9MxPz6U0QMptUC98AfjV-DtEiGHCksGS=R3cCKA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Date: Tue, 08 Jan 2013 14:18:27 +0100
Message-ID: <1357651107.1889.1280.camel@guybrush>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][discussion] 5.3 EOL
From: johannes@schlueters.de (Johannes =?ISO-8859-1?Q?Schl=FCter?=)

On Tue, 2013-01-08 at 12:39 +0100, Pierre Joye wrote:
> On Tue, Jan 8, 2013 at 12:25 PM, Clint Priest <cpriest@zerocue.com> wrote:
> 
> > Would this 1 or 2 year period begin from release date of 5.3 or as of around now/vote?
> 
> See "When should start the EOL period and when should it be announced?"

I don't understand why we have to go through this again, but anyways, if
we do this:


Separating the two questions is "strange" and can lead to unintended
results. They should be combined into one. Example assumption: 50%+1
vote for "One year with security fixes only" but are split between "With
the next PHP 5.3 release" and "Right after the end of this vote"

Whereas 50%-1 vote for "Two years, one normal fixes and one security
fixes only" and "With the PHP 5.5 final release"

Then the winner will be "One year with security fixes only" and "With
the PHP 5.5 final release" which probably wasn't intended by the
majority.



Aside from that: I don't think we need "the PHP Security team" to review
all things, sometimes individual developers can make the choice, too.
And in my opinion this should be more "fluent" where the bar for
"criticalness" is set higher and higher, instead of suddenly basically
stopping.



In the end we have to deal with two things: On the one side we have
users, they want a stable platform, they can rely on, without functional
changes. Many people I talk to don't care much about small bugs with
easy workarounds, but they care for simple risk-free updates for
security things (which btw. is a reason why many use distribution
packages not php.net's)

On the other side are developers, who nowadays have to test 4 branches
for each essentially trivial fix. This makes the process to verify a
patch more annoying than it should be. Given that most here are
volunteers the barrier shouldn't be set too high.

By reducing the pressure to merge everything, in my opinion, we serve
both - users have less risk updating (yes, with 5.3.18 and 5.3.19 we
changed the behavior slightly, users have to always test this) and
maintainers are a bit freer in their work.


But we've been through this and the both of us won't come to agreement.

johannes