Return-Path: <tiff-bounces@lists.maptools.org>
Delivered-To: info@awaresystems.be
Received: (qmail 7105 invoked from network); 1 Sep 2008 15:54:54 -0000
Received: from janet.telenet-ops.be ([195.130.136.6])
          (envelope-sender <tiff-bounces@lists.maptools.org>)
          by angelia.telenet-ops.be (qmail-ldap-1.03) with SMTP
          for <info@awaresystems.be>; 1 Sep 2008 15:54:54 -0000
Received: from vijay.telenet-ops.be (vijay.telenet-ops.be [195.130.136.9])
	by janet.telenet-ops.be (8.13.1/8.13.1) with ESMTP id m81FssWi006911
	for <info@awaresystems.be>; Mon, 1 Sep 2008 17:54:54 +0200
Received: from localhost (localhost.localdomain [127.0.0.1])
	by vijay.telenet-ops.be (Postfix) with SMTP id 0E48760004
	for <info@awaresystems.be>; Mon,  1 Sep 2008 17:54:54 +0200 (CEST)
Received: from apate.telenet-ops.be (apate.telenet-ops.be [195.130.132.43])
	by vijay.telenet-ops.be (Postfix) with ESMTP id 05B4660003
	for <info@awaresystems.be>; Mon,  1 Sep 2008 17:54:54 +0200 (CEST)
Received: from duke.maptools.org (r153.dmsolutions.ca [209.217.116.153])
	by apate.telenet-ops.be (Postfix) with ESMTP id 8D7F627EC0B
	for <info@awaresystems.be>; Mon,  1 Sep 2008 17:54:53 +0200 (CEST)
Received: from duke.maptools.org (duke.maptools.org [127.0.0.1])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m81FqWsY012609;
	Mon, 1 Sep 2008 11:54:04 -0400
Received: from mail.howardsilvan.com (frodo.howardsilvan.com [66.119.206.113])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m81FqT9M012606
	for <tiff@lists.maptools.org>; Mon, 1 Sep 2008 11:52:29 -0400
Received: by mail.howardsilvan.com (Postfix, from userid 502)
	id 67018C0121; Mon,  1 Sep 2008 08:52:28 -0700 (PDT)
Received: from bilbo.x101.com (localhost.localdomain [127.0.0.1])
	by mail.howardsilvan.com (Postfix) with ESMTP id 21BB2C007C;
	Mon,  1 Sep 2008 08:52:28 -0700 (PDT)
Received: from bilbo.x101.com ([64.146.212.27] helo=bilbo.x101.com) by
	frodo.howardsilvan.com; 1 Sep 2008 08:52:27 -0700
Message-ID: <48BC0FBB.6060407@howardsilvan.com>
Date: Mon, 01 Sep 2008 08:52:27 -0700
From: Lee Howard <faxguy@howardsilvan.com>
User-Agent: Thunderbird 2.0.0.16 (X11/20080723)
MIME-Version: 1.0
To: Frank Warmerdam <warmerdam@pobox.com>
Subject: Re: [Tiff] Some security fixes from RHEL
References: <200808300053.35585.even.rouault@mines-paris.org>
	<48BAB60F.7040207@pobox.com>
	<Pine.SOC.4.64.0808311028060.1110@freddy.simplesystems.org>
	<48BB143F.4020301@howardsilvan.com> <48BB5DBB.4010108@pobox.com>
In-Reply-To: <48BB5DBB.4010108@pobox.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: tiff@lists.maptools.org
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.4
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-SpamCatcher-Score: 50 [XX]

Frank Warmerdam wrote:
> Lee Howard wrote:
>> While the above statements are undoubtedly accurate, the sentiments 
>> that they express are unhealthy for the large community that uses 
>> libtiff.  So, while the statements may be true, they really should 
>> not so be.
>>
>> Maintainers and developers of any software should be committed to the 
>> software development and to the health of the community that uses 
>> that software.  Some degree of responsibility is expected.  When 
>> flaws in the software are discovered, be they rather benign or 
>> security-related, the community looks to developers and maintainers 
>> to take action.  Failure to take action leads the community into an 
>> atmosphere of uncertainty and mistrust... all of which further 
>> inhibits the software development cycle.
>>
>> Understand that while the software development process may be slow, 
>> stagnant, or distracted, distribution maintainers and application 
>> maintainers are under pressure from their own customers to be 
>> responsive and to indemnify any inaction by the upstream.  Thus you 
>> will find RedHat, Fedora, SuSE, Debian, Gentoo, etc. maintainers who 
>> will have to patch and patch and continue to patch to satisfy those 
>> expectations.
>>
>> It seems to me that the least that could be done in such situations 
>> would be to accept the patches developed downstream and to 
>> acknowledge and be at least verbally responsive to credible reports 
>> of such issues.
>
> Lee,
>
> It would be helpful to have additional libtiff maintainers interested in
> taking on such problems. I will say that I expect to apply the provided
> patch, though it would be better if this could be handled without
> depending on me. 

I am willing to volunteer to:

* Commit applicable downstream patches (i.e. security patches in 
RedHat's build).

* Commit applicable patches that appear on this mailing list, on 
bugzilla, or come to me in a more private manner.

* Monitor bug reports (esp. bugzilla) in an effort to encourage the 
reporter to provide enough information such that the problematic code 
can be pinpointed or such that a patch is provided.

* Perform test builds and run the test suite (I assume that libtiff has 
one now?) after every commit to make sure that the commit did not break 
anything - and if it did then to either fix the problem myself, return 
to the patch developer for a fix, or to back out the patch.

What I cannot do is:

* Maintain same-day responsiveness all of the time.

* Perform a security audit.

* Spend vast amounts of time developing features, redesigning code, or 
fixing bugs that would either require too much time to fix or that are 
beyond my ability to fix.

What I would require in return is:

* Regular and frequent releases.  (And what I mean by that is 
approximately once per month whenever there has been any non-trivial 
amount of code changes committed.)  If this cannot be done due to other 
maintainer time constraints, then I am willing to assist in the releases 
to whatever degree is necessary.

Thanks,

Lee.
_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
