Re: Plan regarding fd patch...rc4

I'm kinda worried about those last-minute fastcgi (and CGI!). Last time we did that we had one of the biggest security holes in PHP's history. Especially regarding the fd patch, I think we need a bigger QA cycle, something that only comes around with a prolonged release cycle, as we'd have in v5 (where initially, people expect things to break anyway). The only thing that really doesn't add up for me is why Sascha considers this patch as a must-have for a bug-fix production release, when it has such limited implications, but such devastating potential. I just can't see the problem in putting up a patch for those who need it on php.net. Zeev At 06:54 20/05/2003, Shane Caraveo wrote:

If we're doing another RC, I'd like it to wait a couple days, I want to get another little fix in tomorrow night. I'd do it tonight, but left my osx off at work so cannot test it tonight. The patch will only effect fastcgi on non-windows, so it's relatively minor. Shane Sascha Schumann wrote:

    Well, here is a plan which is far superior than solely
    relying on one's gut feelings.
    (a) Roll RC4 immediately* due to a number of new bug
        fixes.
    (b) Release a Pre-Announcement to announce@ and various
        dedicated PHP sites for maximum exposure.  Emphasize that
        we want to hear about any new issues.
    (c) Evaluate data points within a week.
    (d) Make a decision after that.
    * I volunteer, if Jani is fed up.
    - Sascha

-- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php