Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96598
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.180 as permitted sender)
MIME-Version: 1.0
Sender: jakub.php@gmail.com
In-Reply-To: <CACXBjugu7LWDVHPB6Eow+kWA7z6L_dKjfJUx2ojxkr=gi2kf3w@mail.gmail.com>
References: <3a5408bc-b71d-920c-45e4-b9be02350b6c@gmail.com>
 <01a901d22e06$ca4e3450$5eea9cf0$@belski.net> <CACXBjugu7LWDVHPB6Eow+kWA7z6L_dKjfJUx2ojxkr=gi2kf3w@mail.gmail.com>
Date: Mon, 24 Oct 2016 16:37:28 +0100
Message-ID: <CAEKnhAG00ZKqZ0_091WZcMf73cdycmuoc5ytOWZf5=NOiT00tw@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: Anatol Belski <anatol.php@belski.net>, Stanislav Malyshev <smalyshev@gmail.com>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114eb9de5edf98053f9e2b27
Subject: Re: [PHP-DEV] Security issue handling
From: bukka@php.net (Jakub Zelenka)

--001a114eb9de5edf98053f9e2b27
Content-Type: text/plain; charset=UTF-8

On Mon, Oct 24, 2016 at 4:19 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:

> >
> > > c. Get some specific people to volunteer to review patches in security
> > > repo regularly - how? Any takers?
> > >
> > OFC it'd be ideal to have some karma holders to participate. And another
> > option, which is IMHO eligible - we could invite several reporters. There
> > is already a couple of people, who regularly report security issues and
> > keep them confident until they're publicly disclosed. IMHO it is a good
> > base for trust.
> >
>
> Yes, in the end this is about getting Stas some help here. He has been
> doing an incredible job for years now handling all these annoying
> off-by-one and >2gb string bugs. I occasionally read through the patches,
> but I haven't been doing it consistently and even though there are a few
> other people on security@ who occasionally look through the patches, it
> obviously isn't enough.
>
> As a first step perhaps we just need to expand security@ a bit with the
> specific call for volunteers to help review security patches?
>

I would be happy to help with review / fixes especially for json that I
maintain and openssl that I sort of try to maintain too. But I could also
help with review of some other exts if time allows.

Cheers

Jakub

--001a114eb9de5edf98053f9e2b27--