Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96599
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.17.20 as permitted sender)
To: Rasmus Lerdorf <rasmus@lerdorf.com>, Anatol Belski <anatol.php@belski.net>
References: <3a5408bc-b71d-920c-45e4-b9be02350b6c@gmail.com>
 <01a901d22e06$ca4e3450$5eea9cf0$@belski.net>
 <CACXBjugu7LWDVHPB6Eow+kWA7z6L_dKjfJUx2ojxkr=gi2kf3w@mail.gmail.com>
Cc: Stanislav Malyshev <smalyshev@gmail.com>,
 PHP Internals <internals@lists.php.net>
Message-ID: <b8e3be3e-3b9d-798d-16cb-acd76c7d5598@gmx.de>
Date: Mon, 24 Oct 2016 18:11:53 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.4.0
MIME-Version: 1.0
In-Reply-To: <CACXBjugu7LWDVHPB6Eow+kWA7z6L_dKjfJUx2ojxkr=gi2kf3w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Security issue handling
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 24.10.2016 at 17:19, Rasmus Lerdorf wrote:

>>> c. Get some specific people to volunteer to review patches in security
>>> repo regularly - how? Any takers?
>>>
>> OFC it'd be ideal to have some karma holders to participate. And another
>> option, which is IMHO eligible - we could invite several reporters. There
>> is already a couple of people, who regularly report security issues and
>> keep them confident until they're publicly disclosed. IMHO it is a good
>> base for trust.
> 
> Yes, in the end this is about getting Stas some help here. He has been
> doing an incredible job for years now handling all these annoying
> off-by-one and >2gb string bugs. I occasionally read through the patches,
> but I haven't been doing it consistently and even though there are a few
> other people on security@ who occasionally look through the patches, it
> obviously isn't enough.
> 
> As a first step perhaps we just need to expand security@ a bit with the
> specific call for volunteers to help review security patches?

I'm gladly willing to help with GD related security issues (at least).
It's also okay for me to get assigned to these, when Pierre is busy. :-)

-- 
Christoph M. Becker