Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96597
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain lerdorf.com designates 209.85.161.175 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <01a901d22e06$ca4e3450$5eea9cf0$@belski.net>
References: <3a5408bc-b71d-920c-45e4-b9be02350b6c@gmail.com> <01a901d22e06$ca4e3450$5eea9cf0$@belski.net>
Date: Mon, 24 Oct 2016 08:19:13 -0700
Message-ID: <CACXBjugu7LWDVHPB6Eow+kWA7z6L_dKjfJUx2ojxkr=gi2kf3w@mail.gmail.com>
To: Anatol Belski <anatol.php@belski.net>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11426684855531053f9decc8
Subject: Re: [PHP-DEV] Security issue handling
From: rasmus@lerdorf.com (Rasmus Lerdorf)

--001a11426684855531053f9decc8
Content-Type: text/plain; charset=UTF-8

>
> > c. Get some specific people to volunteer to review patches in security
> > repo regularly - how? Any takers?
> >
> OFC it'd be ideal to have some karma holders to participate. And another
> option, which is IMHO eligible - we could invite several reporters. There
> is already a couple of people, who regularly report security issues and
> keep them confident until they're publicly disclosed. IMHO it is a good
> base for trust.
>

Yes, in the end this is about getting Stas some help here. He has been
doing an incredible job for years now handling all these annoying
off-by-one and >2gb string bugs. I occasionally read through the patches,
but I haven't been doing it consistently and even though there are a few
other people on security@ who occasionally look through the patches, it
obviously isn't enough.

As a first step perhaps we just need to expand security@ a bit with the
specific call for volunteers to help review security patches?

-Rasmus

--001a11426684855531053f9decc8--