Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72741
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain schlueters.de from 217.114.215.10 cause and error)
To: Lester Caine <lester@lsces.co.uk>
Cc: internals@lists.php.net
In-Reply-To: <53074D8F.5020806@lsces.co.uk>
References:
	 <CAEZPtU6ePFu-evVYyknBJa+0M7QZ3f9QvTeu5vvKpnNp_bkbZg@mail.gmail.com>
	 <CANgS8h9-KR=7FCZHc2W6XGN0y5HAg1fkjx2_wTvOgEm3ta4=_Q@mail.gmail.com>
	 <CAFp73XuNchZm2MOMDVSHTaLMRSVe+gR7u=d=oWJcsWbW0z3mrw@mail.gmail.com>
	 <1392661082.3990.265.camel@guybrush> <530278EE.3000008@ralphschindler.com>
	 <1392671871.3990.303.camel@guybrush> <53028096.9040603@ralphschindler.com>
	 <1392675539.3990.345.camel@guybrush> <530384A3.7040209@ralphschindler.com>
	 <53074D8F.5020806@lsces.co.uk>
Content-Type: text/plain; charset="UTF-8"
Date: Fri, 21 Feb 2014 14:13:44 +0100
Message-ID: <1392988424.3990.916.camel@guybrush>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP 6 - Extensions ...
From: johannes@schlueters.de (Johannes =?ISO-8859-1?Q?Schl=FCter?=)

On Fri, 2014-02-21 at 12:58 +0000, Lester Caine wrote:

> Extensions are the only way to handle the diverse range of external code that 
> PHP uses, it is purely how those individual packages are combined that is the 
> area for debate? Personally I prefer a smaller core than PHP provides by 
> default, and my own small set of extensions added dynamically.

Making the core smaller isn't easy for users - they suddenly don't have
to are about a single version number anymore but check which version of
which extension makes a feature available, and how that relates to the
core version as core provides infrastructure and extension feature might
use conditionally. It's a question of balance and I think right now we
are in a quite good area.

> One area that would make a lot more sense to me though is the ability to apply 
> security updates to a specific extension and only roll out that one package 
> rather than having to wait for the whole PHP distribution to be updated? Linux 
> distributions sort of do this providing incremental updates, but actually that 
> is more of a hindrance at times! What is being distributed is not necessarily 
> the same as the current master code base :(

Yes and no. In practice most security issues (not that there are
many ..) are in core areas not an extension, so the core part has to be
updated. Splitting things up again gives more components to handle and
makes update processes more complicated. And in practical terms:
Distributions split up all non-forced extensions ... but they, contrary
to us, have a package dependency system which mostly works and on which
they can build upon.

johannes