Re: [PHP-DEV] CVS Account Request From: Rasmus Lerdorf (rasmus <email protected>)
Date: 11/15/00

Part of the reason the PHP project has been successful is precisely
because the barrier of entry has always been nice and low. This applies
both to the language itself and also to the development of the language.
I can count on one hand the number of times we have had bad commits over
the last 5 years. By empowering people to contribute, you encourage
contributions. I would rather have a badly written extension than no
extension. Badly written extensions spur other people to pitch in and
improve it and the feedback provided to the author helps the author
improve.

As far as a terrorist cvs committer goes. I think you are being overly
paranoid. And I would challenge the statement that an unknown can sneak a
harmful commit into PHP that is not caught by anybody. I read all commit
messages. And I bet I am not the only one. Sure, I skip over some commit
messages from known people in areas I know little about. But someone I
don't recognize comitting any sort of code automatically triggers a full
review for me.

Let's not raise the barrier of entry without cause. Show me viable cause
and we can talk about specifics.

I do agree that Pear needs to be split away at some point when it is
mature enough to split. And applying some ACL's to separate doc, web and
src code probably makes sense as well. But let's not take this further
and start changing something that has worked very well for many years.

-Rasmus

On Wed, 15 Nov 2000, Sterling Hughes wrote:

> At 10:36 PM 11/15/2000 +0200, Zeev Suraski wrote:
> >Why do you need CVS access then?
>
> Rasmus and Zeev: I'm writing this while reading your last message ;)
>
> PHP documentation, PHP Website, Closing Bugs and  <email protected> forwarding (I
> know there are one or two in their, some of these people have been in their
> half a year or more and haven't contributed a thing :-), PEAR and finally
> php-faq modifications all require cvs access to the main repository (php4).
>
> PEAR and Bug issues are currently should be abstracted, when Zak and I get
> re-write the bugs db, we'll probably abstract that to something separate
> (and still give cvs commiters access to the bugs db :). Also pear will
> probably be abstracted from the cvs repository as well (as I believe cvs
> is/was a temporary solution.)
>
> As Zeev said we should divide the cvs repositories: Websites, Documentation
> and Code.
>
> Also I think we should be a little more careful of who we give cvs access
> to on the code root. Right now I could probably get a fake e-mail and such
> from yahoo and obtain a nice ol' cvs account, from which I could then (if I
> was bad) commit some harmful code, which since it would not be a part of
> standard/ or main/ would not be given due attention (especially if it was a
> nice harmful one line bit) and then hurt users who use it. Now while one
> of the reasons many people contribute to PHP is because it is so easy to
> get involved with the development, really most of the commits are only made
> by a handful of people (PHP Group and a 10-20 others, if even). Most of
> the users could simply send patches. Patches make sure the code is qa'ed,
> and then, if the patches are approved (by a committer) then they would be
> committed, after a while if the user is someone who is constantly sending
> (good) patches he would then obtain a cvs account to commit to the code
> repository (documentation could be given less security).
>
> -Sterling
> 

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>