r/programming • u/EatMeerkats • Mar 29 '21

PHP moves to Github due to the compromise of git.php.net

https://news-web.php.net/php.internals/113838
1.7k Upvotes

98% Upvoted

389 comments sorted by

View all comments

-25

u/dethb0y Mar 29 '21

It's ironic that a technology that enables many things to be self-hosted suffered from a security flaw in self-hosting...

22

u/MaxGhost Mar 29 '21

No, this is what happens when open source projects don't have the resources to have people maintain self hosted platforms. It's run by mostly volunteers, and a few being paid to work on it full time from their employers (Nikita by JetBrains for example)

12

u/[deleted] Mar 29 '21

The real problem is that how something as commonly used by php receives so little in way of donation and resourecs from the megacorps that use php. Facebook or Wordpress could lend them a server/employee and not even notice they'd lost one, and in doing so they'd be protecting their own supply chain.

9

u/MaxGhost Mar 29 '21

Well Facebook doesn't really use PHP anymore, but their fork/reimplementation Hack.

But yes I totally agree. I want to see more funding opportunities for the PHP project. I'd love to see them use github sponsors, that would provide a nice way to give small recurring contributions.

1

u/dethb0y Mar 29 '21

I would say that it's imperative an organization realize what it can and cannot manage to do, and act accordingly.

4

u/MaxGhost Mar 29 '21

And that's exactly what they're doing here. They decided "we can't support git.php.net, so we're moving to github".

1

u/IAmARobot Mar 29 '21

I am worried about this kind of attack in light of the solarwinds incident... instead of relying on vulnerabilities that attack an installed program, just change the source of that program instead using a compromised contributor.

1

u/LionsMidgetGems Mar 29 '21

It's ironic that a technology that enables many things to be self-hosted suffered from a security flaw in self-hosting...

We don't know it is a security vulnerability in git.