Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:89675
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain paragonie.com from 209.85.217.169 cause and error)
MIME-Version: 1.0
In-Reply-To: <5664C221.9040403@gmail.com>
References: <d7986bddhrs5d7o2c6r42g6h9to3au5kq0@4ax.com>
	<90c8ecbc29f8a40a2430306b807a169e@mail.gmail.com>
	<5664AC01.1020602@gmail.com>
	<CAKws9z3dcZexuY548KFM3i7jBWivvqtVfgFFNrq7cqSmN5b=Gw@mail.gmail.com>
	<5664C221.9040403@gmail.com>
Date: Sun, 6 Dec 2015 18:51:35 -0500
Message-ID: <CAKws9z1H9kOrbX7jfZrbnuike=nProjfszkTTos8Bn7StNAzLg@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Zeev Suraski <zeev@zend.com>, Jan Ehrhardt <phpdev@ehrhardt.nl>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c25a8eb6361e0526436b75
Subject: Re: [PHP-DEV] PHP 5.6 life cycle
From: scott@paragonie.com (Scott Arciszewski)

--001a11c25a8eb6361e0526436b75
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Sun, Dec 6, 2015 at 6:17 PM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> Hi!
>
> > Giving everyone until the end of 2017 to update their servers is more
> > than sufficient.
>
> Sufficient for what? It is a hard fact that people still run 5.3
> version. In fact, 2/3 of sites run EOLed versions. You can always say
> they have only themselves to blame, but then I'm not sure what
> "sufficient" means. Unless adoption patterns change drastically, by the
> end of 2017 most people will not be running PHP 7. That's not something
> we can realistically change (unless you have some way of changing those
> patterns we didn't try yet or they change by themselves somehow). Thus,
> our choice lies only in whether we support this majority of users in
> some way
> =E2=80=8B=E2=80=8B
> or say "you are on your own now, we don't care about you anymore".
> --
> Stas Malyshev
> smalyshev@gmail.com
>


=E2=80=8BWe should do everything we can to instill a culture of keeping stu=
ff up to
date. Just because people are going to shoot themselves in the foot doesn't
mean we should supply them with additional ammo.

If 2/3 of sites still run EOLed versions of PHP, all adding a long-term
support version is going to do is encourage habits of inertia. "Well, 5.6
was supported until 2020, why can't 7.0.0 be supported until past 2019?
This isn't fair."

>
=E2=80=8B
 or say "you are on your own now, we don't care about you anymore".

Yes, given the lack of a sensible alternative, I think we need to do this.
And then the community needs to, collectively, invest serious effort in
finding a remotely exploitable vulnerability in any/all EOL'd versions of
PHP to give a strong incentive to stop running 5.2.x and 5.3.x in 2016.

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com/>
=E2=80=8B

--001a11c25a8eb6361e0526436b75--