Return-Path: <tiff-bounces@lists.maptools.org>
Delivered-To: info@awaresystems.be
Received: (qmail 16280 invoked from network); 1 Sep 2008 03:16:33 -0000
Received: from janet.telenet-ops.be ([195.130.136.6])
          (envelope-sender <tiff-bounces@lists.maptools.org>)
          by angelia.telenet-ops.be (qmail-ldap-1.03) with SMTP
          for <info@awaresystems.be>; 1 Sep 2008 03:16:33 -0000
Received: from mindy.telenet-ops.be (mindy.telenet-ops.be [195.130.136.8])
	by janet.telenet-ops.be (8.13.1/8.13.1) with ESMTP id m813GX9e009676
	for <info@awaresystems.be>; Mon, 1 Sep 2008 05:16:33 +0200
Received: from localhost (localhost.localdomain [127.0.0.1])
	by mindy.telenet-ops.be (Postfix) with SMTP id 0EDAA60004
	for <info@awaresystems.be>; Mon,  1 Sep 2008 05:16:33 +0200 (CEST)
Received: from circe.telenet-ops.be (circe.telenet-ops.be [195.130.132.51])
	by mindy.telenet-ops.be (Postfix) with ESMTP id 082BB60003
	for <info@awaresystems.be>; Mon,  1 Sep 2008 05:16:33 +0200 (CEST)
Received: from duke.maptools.org (r153.dmsolutions.ca [209.217.116.153])
	by circe.telenet-ops.be (Postfix) with ESMTP id 888A233E6A
	for <info@awaresystems.be>; Mon,  1 Sep 2008 05:16:32 +0200 (CEST)
Received: from duke.maptools.org (duke.maptools.org [127.0.0.1])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m813DI9h018420;
	Sun, 31 Aug 2008 23:15:02 -0400
Received: from sasl.smtp.pobox.com (a-sasl-fastnet.sasl.smtp.pobox.com
	[207.106.133.19])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m813DFt8018417
	for <tiff@lists.maptools.org>; Sun, 31 Aug 2008 23:13:15 -0400
Received: from localhost.localdomain (localhost [127.0.0.1])
	by a-sasl-fastnet.sasl.smtp.pobox.com (Postfix) with ESMTP id
	B36FA5AE14; Sun, 31 Aug 2008 23:13:13 -0400 (EDT)
Received: from [192.168.2.4] (dpc674728121.direcpc.com [67.47.28.121]) (using
	TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client
	certificate
	requested) by a-sasl-fastnet.sasl.smtp.pobox.com (Postfix) with ESMTPSA
	id 75CC25AE13; Sun, 31 Aug 2008 23:13:07 -0400 (EDT)
Message-ID: <48BB5DBB.4010108@pobox.com>
Date: Sun, 31 Aug 2008 23:12:59 -0400
From: Frank Warmerdam <warmerdam@pobox.com>
User-Agent: Thunderbird 2.0.0.6 (X11/20071022)
MIME-Version: 1.0
To: Lee Howard <faxguy@howardsilvan.com>
Subject: Re: [Tiff] Some security fixes from RHEL
References: <200808300053.35585.even.rouault@mines-paris.org>
	<48BAB60F.7040207@pobox.com>
	<Pine.SOC.4.64.0808311028060.1110@freddy.simplesystems.org>
	<48BB143F.4020301@howardsilvan.com>
In-Reply-To: <48BB143F.4020301@howardsilvan.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Pobox-Relay-ID: E9EA1DDE-77D3-11DD-AEF2-9EE598D589B0-06493634!a-sasl-fastnet.pobox.com
Cc: tiff@lists.maptools.org
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.4
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-SpamCatcher-Score: 50 [XX]

Lee Howard wrote:
> While the above statements are undoubtedly accurate, the sentiments that 
> they express are unhealthy for the large community that uses libtiff.  
> So, while the statements may be true, they really should not so be.
> 
> Maintainers and developers of any software should be committed to the 
> software development and to the health of the community that uses that 
> software.  Some degree of responsibility is expected.  When flaws in the 
> software are discovered, be they rather benign or security-related, the 
> community looks to developers and maintainers to take action.  Failure 
> to take action leads the community into an atmosphere of uncertainty and 
> mistrust... all of which further inhibits the software development cycle.
> 
> Understand that while the software development process may be slow, 
> stagnant, or distracted, distribution maintainers and application 
> maintainers are under pressure from their own customers to be responsive 
> and to indemnify any inaction by the upstream.  Thus you will find 
> RedHat, Fedora, SuSE, Debian, Gentoo, etc. maintainers who will have to 
> patch and patch and continue to patch to satisfy those expectations.
> 
> It seems to me that the least that could be done in such situations 
> would be to accept the patches developed downstream and to acknowledge 
> and be at least verbally responsive to credible reports of such issues.

Lee,

It would be helpful to have additional libtiff maintainers interested in
taking on such problems. I will say that I expect to apply the provided
patch, though it would be better if this could be handled without
depending on me.

Best regards,
-- 
---------------------------------------+--------------------------------------
I set the clouds in motion - turn up   | Frank Warmerdam, warmerdam@pobox.com
light and sound - activate the windows | http://pobox.com/~warmerdam
and watch the world go round - Rush    | Geospatial Programmer for Rent

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
