Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70725
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.177 as permitted sender)
MIME-Version: 1.0
Date: Tue, 17 Dec 2013 22:14:59 -0500
Message-ID: <CAH8Mpnktptu7NTfGGw8oM3me9KDvfWO8XY5L1wnE3rwwKnjcUw@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c357c839b84e04edc6735a
Subject: [UPDATE] [VOTE] TLS Peer Verification
From: rdlowrey@gmail.com (Daniel Lowrey)

--001a11c357c839b84e04edc6735a
Content-Type: text/plain; charset=ISO-8859-1

After some discussion in #php.pecl, the efforts of php.net's crack research
team (a.k.a. Joe Watkins) and a suggestion by Rasmus it was determined that
the original peer verification vote should be discarded in favor of
clarification.

The patch has been improved to obviate any need for manual CA management by
PHP itself. The new implementation takes advantage of OS and distro-managed
CA stores. As a result, users with a distro-packaged PHP version will see
most existing code work without any modifications while retaining control
of the implementation on a case-by-case basis.

This is an ideal solution as it preserves BC for many (likely most)
scenarios while simultaneously improving security. The changes are clearly
marked and summarized in the updated RFC. The original vote has been closed
and the new vote consists of only two options: Yes or No.

Thanks for your time and apologies to those tasked with duplicating their
original voting efforts.

--001a11c357c839b84e04edc6735a--