> While I agree that it is certainly easier to keep the packages as > UPSTREAM bundles them, I'm not convinced that this is always a good > idea. If the effort is small, I'd rather patch the package to use the > standard libraries and send the patch upstream. Not only because it's > simply bad programming style but also because it's easier to handle > security this way.
Best of luck with that ... but don't be surprised if UPSTREAM do not adopt these patches. It's not always bad programming style - it's often the only pragmatic thing to do. UPSTREAM bundle libraries because bitter experience (with poor ISP and shared hosting solutions) has taught the PHP community that if you need a third-party library and you don't bundle it, chances are that the third-party library won't be available. (The PHP and PEAR community also have to accept a lot of the blame for this state of affairs, by failing to provide an equivalent to CPAN from day one). Best regards, Stu -- [email protected] mailing list
