Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96572
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.182 as permitted sender)
To: PHP Internals <internals@lists.php.net>
Message-ID: <3a5408bc-b71d-920c-45e4-b9be02350b6c@gmail.com>
Date: Sun, 23 Oct 2016 22:16:02 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0)
 Gecko/20100101 Thunderbird/45.4.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Security issue handling
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

I'd like to discuss an issue about security bugs handling.

We have a security repo which I and others check into bugs from time to
time. The idea is for these to be reviewed by people having access there
before we merge them, and then merge after the release.

This, however, is not happening at all. The patches, as far as I know,
are not reviewed at all, and merging a bunch of patches last minute with
no review is extremely dangerous. I am trying my best with my patches,
but I'm only human, and I feel increasingly uncomfortable having so many
unreviewed patches in the release.

So, how we can fix it?

a. We could merge some of the patches on RC stage, even though that
might expose some issues.
b. We could somehow improve review mechanism beyond security repo we
have now - ideas?
c. Get some specific people to volunteer to review patches in security
repo regularly - how? Any takers?

Would like to hear thoughts on this one.
-- 
Stas Malyshev
smalyshev@gmail.com