Re: CVS Account Request

On Wed, 15 Nov 2000, Zeev Suraski wrote: > At 00:24 16/11/2000, Rasmus Lerdorf wrote: > >Part of the reason the PHP project has been successful is precisely > >because the barrier of entry has always been nice and low. This applies > >both to the language itself and also to the development of the language. > >I can count on one hand the number of times we have had bad commits over > >the last 5 years. > > Your hands must have changed a lot since I last saw you :) > There were dozens. Bad commits being commits that we needed to reverse because they were so wrong that they couldn't be fixed. Sure there have been commits that broken things. You and I have made dozens of such commits. Nobody writes code without bugs. That doesn't mean we shouldn't have cvs access. > So, did you find the buffer overflow bug in Onn's fribidi extension? No I didn't, the commit message is still unread in my inbox due to a heavy travel schedule, but chances are I wouldn't have caught it when I got back and started chewing through my mailbox anyway. But are you seriously suggesting that because he had an overflow in his extension he should not have had commit access? Onn works for Zend and Andi vouched for him and created his CVS account. Those a pretty good credentials and I don't care how much we tighten rules, Onn would still have gotten a CVS account and he would still have committed an extension that contained a buffer overflow so I don't see how this does anything to prove your point. > I think I made my point when I said we don't need to wait to be hacked > before we take measures to reduce the chances of this happening. Things > aren't too secure in this world as it is, I don't see a reason to make it > easier to screw us up. As long as it can be done without adding extra hurdles for legitimate contributions I am fine with it. ACL's make sense. But I am leary about any sort of review-then-commit type of approach as per Sterling's suggestion. It puts an extra workload on existing contributors and introduces delays for potential new contributors. -Rasmus