Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96707
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain pthreads.org from 74.125.82.43 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAPwsocHrfTc-Hxn+XmfMzGaHnY9xXFGRn-LspfN693Y7+uVHKA@mail.gmail.com>
References: <3a5408bc-b71d-920c-45e4-b9be02350b6c@gmail.com> <CAPwsocHrfTc-Hxn+XmfMzGaHnY9xXFGRn-LspfN693Y7+uVHKA@mail.gmail.com>
Date: Wed, 2 Nov 2016 11:29:26 +0000
Message-ID: <CAL=_i_=os-YE+PEn4hiLHOnsbOXe+oddf4+MXTw5t3CpEos2Jw@mail.gmail.com>
To: Leigh <leight@gmail.com>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0102e3d0f42d3e05404fc046
Subject: Re: [PHP-DEV] Security issue handling
From: pthreads@pthreads.org (Joe Watkins)

--089e0102e3d0f42d3e05404fc046
Content-Type: text/plain; charset=UTF-8

Morning,

Stas, consider Leigh vouched for, please add him to sec lists and private
bugs.

Cheers
Joe

On Wed, Nov 2, 2016 at 11:14 AM, Leigh <leight@gmail.com> wrote:

> On 24 October 2016 at 06:16, Stanislav Malyshev <smalyshev@gmail.com>
> wrote:
> > Hi!
> >
> > I'd like to discuss an issue about security bugs handling.
> >
> > We have a security repo which I and others check into bugs from time to
> > time. The idea is for these to be reviewed by people having access there
> > before we merge them, and then merge after the release.
> >
> > This, however, is not happening at all. The patches, as far as I know,
> > are not reviewed at all, and merging a bunch of patches last minute with
> > no review is extremely dangerous. I am trying my best with my patches,
> > but I'm only human, and I feel increasingly uncomfortable having so many
> > unreviewed patches in the release.
> >
> > So, how we can fix it?
> >
> > a. We could merge some of the patches on RC stage, even though that
> > might expose some issues.
> > b. We could somehow improve review mechanism beyond security repo we
> > have now - ideas?
> > c. Get some specific people to volunteer to review patches in security
> > repo regularly - how? Any takers?
> >
> > Would like to hear thoughts on this one.
> > --
> > Stas Malyshev
> > smalyshev@gmail.com
>
> Hey Stas,
>
> If it's extra volunteers that you need, I would also be happy to help
> out where I can, investigating reported issues, writing and reviewing
> patches.
>
> * I have a provable interest in security
> * I've submitted security issues (to PHP and other projects) in the past
> * I have worked on security features for the PHP runtime in the past
> * I already have karma \o/
>
> Regards,
>
> Leigh.
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--089e0102e3d0f42d3e05404fc046--