RE: [PHP-DEV] CVS Account Request

At 03:33 PM 11/15/2000 -0800, Rasmus Lerdorf wrote:

At 00:19 16/11/2000, Myke Hines wrote:

-----Original Message----- From: Zeev Suraski [mailto:zeev@zend.com] Sent: Wednesday, November 15, 2000 2:13 PM To: Rasmus Lerdorf Cc: Sterling Hughes; php-dev@lists.php.net Subject: Re: [PHP-DEV] CVS Account Request

If you see patches flowing in from that guy, and they look ok, it means two things - he's unlikely to be a hacker, and he's probably in a real need for a CVS account.

I think that is totally not true.. you can't tell if a person is a hacker just because they do a couple of good patches..

You can't tell for sure. For all you know, you could argue that I (Zeev) might be an undercover Bin Laden agent, in one of the most successful undercover missions in history, trying to bring down the entire imperialistic American web. Possible, but unlikely. I dunno, I have often suspected that to be true. I gather that someone committing legitimate patches may still be a hacker, but the likelihood goes down, significantly. And if he is sending us good patches to gain trust, great. Once he sends the nasty patch, even if it takes us a little while to catch it, we can roll back the bad ones and keep the good ones and in the end we are ahead.

Also as a rule we might consider (just as a practice, nothing formal) spending the time to review patches from people who don't commit a lot, I personally review most patches that "new" committers make (albeit not thoroughly enough to catch a buffer overflow) as well as all commits to the extensions I've written. However, I rarely will pay attention to something Zeev commits (but then again, now that I know he is a terrorist...) -Sterling