Return-Path: <tiff-bounces@lists.maptools.org>
Delivered-To: info@awaresystems.be
Received: (qmail 7408 invoked from network); 2 Sep 2008 08:18:43 -0000
Received: from janet.telenet-ops.be ([195.130.136.6])
          (envelope-sender <tiff-bounces@lists.maptools.org>)
          by angelia.telenet-ops.be (qmail-ldap-1.03) with SMTP
          for <info@awaresystems.be>; 2 Sep 2008 08:18:43 -0000
Received: from vijay.telenet-ops.be (vijay.telenet-ops.be [195.130.136.9])
	by janet.telenet-ops.be (8.13.1/8.13.1) with ESMTP id m828IhnC018710
	for <info@awaresystems.be>; Tue, 2 Sep 2008 10:18:43 +0200
Received: from localhost (localhost.localdomain [127.0.0.1])
	by vijay.telenet-ops.be (Postfix) with SMTP id 485BD60004
	for <info@awaresystems.be>; Tue,  2 Sep 2008 10:18:43 +0200 (CEST)
Received: from apate.telenet-ops.be (apate.telenet-ops.be [195.130.132.43])
	by vijay.telenet-ops.be (Postfix) with ESMTP id 41BE460003
	for <info@awaresystems.be>; Tue,  2 Sep 2008 10:18:43 +0200 (CEST)
Received: from duke.maptools.org (r153.dmsolutions.ca [209.217.116.153])
	by apate.telenet-ops.be (Postfix) with ESMTP id F037B27EC0B
	for <info@awaresystems.be>; Tue,  2 Sep 2008 10:18:42 +0200 (CEST)
Received: from duke.maptools.org (duke.maptools.org [127.0.0.1])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m828DSqQ002931;
	Tue, 2 Sep 2008 04:15:08 -0400
Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m828DNoP002928
	for <tiff@lists.maptools.org>; Tue, 2 Sep 2008 04:13:23 -0400
Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1])
	by sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id m828DKlr008159;
	Tue, 2 Sep 2008 04:13:20 -0400 (EDT)
To: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
Subject: Re: [Tiff] Some security fixes from RHEL 
In-reply-to: <Pine.SOC.4.64.0809011014410.1110@freddy.simplesystems.org> 
References: <200808300053.35585.even.rouault@mines-paris.org>
	<48BAB60F.7040207@pobox.com>
	<Pine.SOC.4.64.0808311028060.1110@freddy.simplesystems.org>
	<48BB143F.4020301@howardsilvan.com> <4983.1220245910@sss.pgh.pa.us>
	<Pine.SOC.4.64.0809011014410.1110@freddy.simplesystems.org>
Comments: In-reply-to Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
	message dated "Mon, 01 Sep 2008 10:33:29 -0500"
Date: Tue, 02 Sep 2008 04:13:20 -0400
Message-ID: <8158.1220343200@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
Cc: tiff@lists.maptools.org
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.4
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-SpamCatcher-Score: 10 [X]

Bob Friesenhahn <bfriesen@simple.dallas.tx.us> writes:
> Testing with randomly broken files would likely take months of an 
> unpaid volunteer's time to produce the suitably broken files, diagnose 
> the problems, and produce fixes to avoid misbehavior.  Maybe it would 
> take a year.  A year without any income at all.

Actually, I don't think that the libtiff community needs to do that.
There are lots of people pushing hard on the code already; for example
the Apple security guy who found the LZW problem that started this whole
thread.  I can assure you that those folk are running random-input tests
already.

What it falls to this community to do is to fix the code when problems
are reported.  That is within your special area of expertise; whereas
finding vulnerabilities isn't particularly.  *You* know this code,
better than anyone else.

I'm encouraged by Lee's willingness to step up to the plate on getting
security-related patches committed.  But we also need some commitment
on creating those patches in the first place.

			regards, tom lane
_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
