So anybody can just push out a new release of PHP?

swiftcoder 4 hours ago | parent | next [-]

Sort of by definition of open-source, yes. It's just that nobody downstream is likely to accept Joe Public's random fork of PHP.

	▲	LordDragonfang an hour ago \| parent \| next [-]
		You're confusing PHP the product with PHP the codebase. The former is what is the only relevant part in the security world, where a product is synonymous with its vendor (even FOSS).
	▲	0x457 3 hours ago \| parent \| prev [-]
		Did start writing software this week?

▲

charcircuit 2 hours ago | parent | prev [-]

Yes, someone could have published a safe version for people to use for the 2 months to get the actual fix done.

▲

john_strinlai 2 hours ago | parent [-]

>Yes, someone could have published a safe version

this is basically the same as releasing a working exploit.

▲

charcircuit an hour ago | parent [-]

And that's not a bad thing. If it was, the the logical conclusion would be to never publish the fix and don't preemptively patch before active exploitation.

	▲	solyin 22 minutes ago \| parent [-]
		Yes it is. Say I release a fix. I'm some rando but I go out to the world and say I fixed an issue with php. Use my version instead! Not telling you what I fixed, it's a secret, just trust me. It will take, with LLM help, attackers a couple hours, tops, to reverse engineer my fix into active exploitation. Meanwhile, I'm some rando so no one's even heard of me, people who do hear don't automatically trust me to install my fix, so very few people have my fix. Meanwhile, the exploit is out there thanks to me and people are getting their sites hacked thanks to me. That seems like a problem, no?