Return-Path: <SRS0=f1nC=JN=lists.osgeo.org=tiff-bounces@osgeo.org>
Delivered-To: filtered@awaresystems.be
Received: from mx3.pub.mailpod8-cph3.one.com ([10.27.38.13])
	by mailstorage22.cst.mailpod8-cph3.one.com with LMTP
	id oBByKCuYv2WpPQAAwT5NuQ
	(envelope-from <SRS0=f1nC=JN=lists.osgeo.org=tiff-bounces@osgeo.org>)
	for <filtered@awaresystems.be>; Sun, 04 Feb 2024 13:59:07 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=custmx.one.com; s=20201015;
	h=sender:content-type:content-transfer-encoding:reply-to:from:list-subscribe:
	 list-help:list-post:list-unsubscribe:list-id:subject:mime-version:references:
	 message-id:in-reply-to:to:date:x-halone-refid:x-halone-sa:from:x-halone-sa:
	 x-halone-refid;
	bh=d7cNvATejTTIg5Fkk6A8o85hNJvY6W5AGlMAb7LUXsU=;
	b=MrbKsSKhhaZ5BhWTr+zOmBIUJGbsXTxMNr/Hx4C6VFOSyBVZs+qrCJ+lkZZIxehmcZghkULv6xwMN
	 EKy5U39hvvbQEysTSR6RJGIWFQa4D7MKSA5C+HCU5RikiN5u63JN6CEZQbYczGkloOttUDDMFzHhv4
	 gyms1Rg+KP00oHydmrieYO1V+BXeu1ORc1T1STBjGEozujNvk5q/EGHsIW2cOY3bjo16owVtHLB6rc
	 sLgG7DtVD4tl+2UY1J2ik2OA1ClpX901DhMALmp8Hhg0CBgPga0Q6cVGCgycZqLBFX0VUc4DBAEJ7t
	 Q4yKvLb1utQ9tPX1DDCdGGSbOKKZ7ng==
X-HalOne-SA: -1
X-HalOne-RefID: 155866::1707055147-827682CA-660528C5/0/0
Authentication-Results: mx3.pub.mailpod8-cph3.one.com;
	spf=pass smtp.mailfrom=osgeo.org smtp.remote-ip=140.211.15.3;
	dmarc=pass header.from=lists.osgeo.org;
X-HalOne-ID: 8f9c8e25-c365-11ee-aada-98039b062cb2
Received: from lists.osgeo.org (osgeo6.osgeo.osuosl.org [140.211.15.3])
	by mx3.pub.mailpod8-cph3.one.com (Halon) with ESMTP
	id 8f9c8e25-c365-11ee-aada-98039b062cb2;
	Sun, 04 Feb 2024 13:59:06 +0000 (UTC)
Received: from osgeo6.osgeo.osuosl.org (localhost [127.0.0.1])
	by lists.osgeo.org (Postfix) with ESMTP id 2994C6144EB6;
	Sun,  4 Feb 2024 05:59:04 -0800 (PST)
Received: from smtp.simplesystems.org (smtp.simplesystems.org [65.66.246.90])
 by lists.osgeo.org (Postfix) with ESMTPS id 6C28D6146800
 for <tiff@lists.osgeo.org>; Sun,  4 Feb 2024 05:59:03 -0800 (PST)
Received: from scrappy.simplesystems.org (scrappy.simplesystems.org
 [65.66.246.73])
 by smtp.simplesystems.org (8.14.4+Sun/8.14.4) with ESMTP id 414Dx2a0029963
 for <tiff@lists.osgeo.org>; Sun, 4 Feb 2024 07:59:02 -0600 (CST)
Date: Sun, 4 Feb 2024 07:59:02 -0600 (CST)
X-X-Sender: bfriesen@scrappy.simplesystems.org
To: Patrice Fournier via Tiff <tiff@lists.osgeo.org>
In-Reply-To: <d6bb4be0-8e65-497a-9cd2-7364401b85e4@ifax.com>
Message-ID: <alpine.GSO.2.20.2402040743190.18702@scrappy.simplesystems.org>
References: <alpine.GSO.2.20.2402030845480.18702@scrappy.simplesystems.org>
 <bc24ea0d-8709-4a68-8575-3e517eed85ed@spatialys.com>
 <alpine.GSO.2.20.2402031001500.18702@scrappy.simplesystems.org>
 <d6bb4be0-8e65-497a-9cd2-7364401b85e4@ifax.com>
User-Agent: Alpine 2.20 (GSO 67 2015-01-07)
MIME-Version: 1.0
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16
 (smtp.simplesystems.org [65.66.246.90]); Sun, 04 Feb 2024 07:59:02 -0600 (CST)
Subject: Re: [Tiff] www.libtiff.org is restored
X-BeenThere: tiff@lists.osgeo.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.osgeo.org>
List-Unsubscribe: <https://lists.osgeo.org/mailman/options/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=unsubscribe>
List-Post: <mailto:tiff@lists.osgeo.org>
List-Help: <mailto:tiff-request@lists.osgeo.org?subject=help>
List-Subscribe: <https://lists.osgeo.org/mailman/listinfo/tiff>,
 <mailto:tiff-request@lists.osgeo.org?subject=subscribe>
From: Bob Friesenhahn via Tiff <tiff@lists.osgeo.org>
Reply-To: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: tiff-bounces@lists.osgeo.org
Sender: "Tiff" <tiff-bounces@lists.osgeo.org>

On Sat, 3 Feb 2024, Patrice Fournier via Tiff wrote:
>
> This would be really helpful indeed! I was already looking at my teams (iFAX 
> Solutions (HylaFAX Enterprise and HylaFAX), but also T38Fax which uses these 
> tools internally) to spare some time to work on this, but first, we'll need 
> to know where to work on this and where to handle the issues. We'd personally 
> prefer it be in the libtiff project, either in the main project, master 
> branch or at minimum a separate branch from which (security issues) fixed 
> tools are merged back into master. This would require all tools bugs to be 
> restored and `wontfix-unmaintained` tags changed to `tools` or something like 
> that, from which we could identify/label security issues and know which ones 
> to concentrate on for this task (and the main libtiff team could exclude in 
> their buglist if they so prefer, until we made enough progress).

It is useful to be aware of the underlying reasons why utilities were 
removed from libtiff.  Whenever a security issue is identified related 
to software produced by the libtiff project, a CVE was created against 
libtiff, since the utility was released as part of libtiff. 
Proprietary and free operating system and application distributions 
which include libtiff then had a huge red flag assigned to them, which 
demands action.  The utilities were continually having CVEs at the 
most severe levels written against them.

It is also a fact that several people maintaining core libtiff 
primarily care about the library and not these old utilities.

If the utilities are again maintained by the libtiff project, they 
need to be in a separate repository, with its own build process, and 
released distinctly from libtiff.  If this approach is not acceptable 
to libtiff maintainers, then the tools would need to be hosted 
elsewhere.

Bob
-- 
Bob Friesenhahn
bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt
_______________________________________________
Tiff mailing list
Tiff@lists.osgeo.org
https://lists.osgeo.org/mailman/listinfo/tiff
