Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82395
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.51 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <80E6AA15-23FA-4A77-B50E-6819120E7B58@gmail.com>
References: <bc6d032454578020cdd2cef172698534.squirrel@webmail.klapt.com>
	<80E6AA15-23FA-4A77-B50E-6819120E7B58@gmail.com>
Date: Tue, 10 Feb 2015 21:58:42 +0000
Message-ID: <CAPwsocE+7JNMf1Kx8DtUwCCoAt-uRjwn=19OO8BwkLSg-zr1hg@mail.gmail.com>
To: David Muir <davidkmuir@gmail.com>
Cc: Anatol Belski <anatol.php@belski.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][VOTE][RESULT] Removal of dead or not yet PHP7
 ported SAPIs and extensions
From: leight@gmail.com (Leigh)

On 10 February 2015 at 21:38, David Muir <davidkmuir@gmail.com> wrote:
> Does this mean PHP will be taking on the role of maintaining libmcrypt as well?

That's not what it means, no.

> If a security issue is found, what is the course of action?

Well, what happened when there was vulnerabilities in OpenSSL?

I've been thinking quite hard about what we should do with regard to
mcrypt. We definitely need a plan to sunset it, but we can't really do
that without a readily available replacement. It's understandable if
people do not want to use OpenSSL as an alternative.