xkcd 2347 again, what a surprise. Oh, wait, there's at least one paid person, that should be something /s

The solution is obvious: pour trillions of dollars into Anthropic and OpenAI, and security will trickle down.

The actual work expenses of the PHP foundation can be viewed here:

https://opencollective.com/phpfoundation/transactions?search... and https://opencollective.com/php-foundation-eur/transactions?s...

(seems like "work" selects most of that)

And it's not cheap to pay that many people, especially not full time (which is partly why they don't have more full-time contractors). According to https://opencollective.com/phpfoundation#category-BUDGET they only have a balance $350k currently, sinking.

It'd be really awesome, if more companies would sponsor the PHP foundation (especially with thousands or tens of thousands of dollars per year. A lot of small contributions is nice, but not enough.). The work of a few core maintainers is really crucial to the continued development of PHP.

She says the full-time member is herself, and looking at her Linkedin (in/elizabethn) she isn't exactly the person who would patch PHP for the two CVEs.

Presumably it makes sense to sunset PHP especially with how cheap code migrations are nowadays.

Just hold a public yes/no vote on changing licensing to something paid, and charge $10 to vote no.

Come on Facebook/Zuckerberg, set them up with a structured fund that is invested in s&p500 or something equivalent/better and allows them to pay a handful of devs and a person to admin them (all surplus can be earmarked to go to charity to avoid the sinkhole of bureaucracy from a larger org). Would set the PHP Foundation up for life and the whole world would be better off as a result, smallish directed investment with huge payout from a value perspective.

And then people complain about "bait and switch " or "pulling the rug" when an OSS project becomes successful and tries to fund itself in some way. "But that should be free" shouts everyone. I'm increasingly under coming around to the idea that OSS was the biggest swindle the corporations managed to pull off.