Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:96703 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 42973 invoked from network); 1 Nov 2016 23:17:38 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 1 Nov 2016 23:17:38 -0000 Authentication-Results: pb1.pair.com smtp.mail=yohgaki@ohgaki.net; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=yohgaki@ohgaki.net; sender-id=pass Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender) X-PHP-List-Original-Sender: yohgaki@ohgaki.net X-Host-Fingerprint: 180.42.98.130 ns1.es-i.jp Received: from [180.42.98.130] ([180.42.98.130:39558] helo=es-i.jp) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id CA/F0-34238-09229185 for ; Tue, 01 Nov 2016 18:17:38 -0500 Received: (qmail 89176 invoked by uid 89); 1 Nov 2016 23:17:33 -0000 Received: from unknown (HELO mail-wm0-f41.google.com) (yohgaki@ohgaki.net@74.125.82.41) by 0 with ESMTPA; 1 Nov 2016 23:17:33 -0000 Received: by mail-wm0-f41.google.com with SMTP id t79so3138380wmt.0 for ; Tue, 01 Nov 2016 16:17:32 -0700 (PDT) X-Gm-Message-State: ABUngvfkiPM0m7jEKhGEeEbETKTWzV1/HK65A/FuHUtcPyOf/1MYLdXk8QiOWC4euOuUMygv2ChSKBtfE/opXw== X-Received: by 10.28.210.1 with SMTP id j1mr28448wmg.86.1478042246230; Tue, 01 Nov 2016 16:17:26 -0700 (PDT) MIME-Version: 1.0 Received: by 10.194.205.42 with HTTP; Tue, 1 Nov 2016 16:16:45 -0700 (PDT) In-Reply-To: References: <3a5408bc-b71d-920c-45e4-b9be02350b6c@gmail.com> <01a901d22e06$ca4e3450$5eea9cf0$@belski.net> <5b11b713-86e7-02da-c00e-d4f40ef123cc@gmail.com> Date: Wed, 2 Nov 2016 08:16:45 +0900 X-Gmail-Original-Message-ID: Message-ID: To: Jakub Zelenka Cc: Stanislav Malyshev , Rasmus Lerdorf , Anatol Belski , PHP Internals Content-Type: text/plain; charset=UTF-8 Subject: Re: [PHP-DEV] Security issue handling From: yohgaki@ohgaki.net (Yasuo Ohgaki) Hi all, On Wed, Nov 2, 2016 at 7:28 AM, Jakub Zelenka wrote: > On Sun, Oct 30, 2016 at 10:09 PM, Stanislav Malyshev > wrote: > > >> >> >> Great, thanks! So besides assigning the issues for the said extensions >> to you, what model for coordinating reviews would you prefer? >> > > I'm not sure what the current flow is but it would be great to send info > about fixed issues (e.g. patches ready for review or link on the fix in the > security repo) to sec mailing list. Then it should be easier to do the > review. > > If someone could add me to the security mailing list, security repo and > possibly access to the security bugs, that would be great - it would allow > me to do the reviews or fix some of the issues. IMHO, assuming active developers are trustworthy, the more is better. How about to add active developers? When someone became inactive, then remove karama. This task would be once a year task. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net