On Sat, Oct 27, 2018 at 10:29 PM, Tim Starling <tstarl...@wikimedia.org> wrote: > > Is it just inertia?
It is mostly inertia at this point, yes. The hosting scene was very different back when the mirror program started. It served two purposes. It gave us bandwidth close to end users all over the world, and secondly, it was a nod to the shared hosting providers who helped the spread of PHP. It is true that today it wouldn't cost me very much to set up a VPS instance in every region that one or perhaps two providers support, or like you said, just front it from a single origin with Cloudflare, Fastly or some other CDN. On the security part, I am not actually sure how many people rely on the tarballs from php.net. Most people rely on the pre-built package from their distro or perhaps Ondrej's repo. And even the people build their own, most packaging scripts I have seen pull from https://github.com/php/php-src/releases For the few people left who do download the php.net tarball and verify the sigs, hopefully they grab those sigs from https://secure.php.net. But yes, perhaps it is time to end the mirror program and just CDN *.php.net. What do others think? -Rasmus
