Hi,
Speaking with a voice of an organization using GeoServer, I consider that the
case has been handled well enough and the response time to fix the issue was
not bad at all.
If I compare with other software, some of those deliver HotFixes like this
http://www.esri.com/software/arcgis/extensions/districting/download-hotfix-build118
or this
http://www.exelisvis.com/Support/HelpArticlesDetail/TabId/219/ArtMID/900/ArticleID/13541/ENVI-5-SP3-Hotfix-for-Landsat-8-OLI.aspx
Examples also show how those companies announce their hotfixes. For me it looks
kind of similar to what GeoServer had in the 2.6.4 release announcement.
However, the release cycle of those software can be one or two years which
makes hotfixes more or less necessary. Hotfixes three weeks before new release
are rare.
This vulnerability was for sure more severe than usual, actually I do not
remember any similar case. in this case it might have been better to announce
nightly builds as a hotfix while waiting for the new releases. Perhaps that
could be the plan for the future.
Jukka Rahkonen
Lähettäjä: Andrea Aime [mailto:[email protected]]
Lähetetty: 23. kesäkuuta 2015 10:02
Vastaanottaja: Johannes Kröger
Kopio: Geoserver-devel
Aihe: Re: [Geoserver-devel] Handling of GEOS-7032: Remote File Disclosure
On Mon, Jun 22, 2015 at 11:07 PM, Johannes Kröger
<[email protected]<mailto:[email protected]>> wrote:
Hi!
Earlier I posted things on Twitter and IRC that others seem to have
taken as more or less personal attacks or at least abrasive ranting.
The amount of noise you've been making for this one on twitter, even after
the OSGeo president (no less) asked you to use a more constructive
attitude would make many think you've simply trying to discredit the project.
We haven't seen that kind of attitude in years.
Mind, I'm not saying we haven't made mistakes, but ask yourself, with thousands
of users
subscribed to the users mailing list, hundreds subscribed to the devel
list, and with so many with a twitter account, how
comes we don't have tens of people raising hell?
Many may not have noticed, but I guess those that did, do understand
the volunteer nature of the project.
I am sorry about that, please do not take my criticism personal.
Nobody took it as personal criticism, people are just defending the project
and the community.
It is
easy to forget that there are people behind "words on the internet".
However I was and still am shocked at the handling of a critical
security issue in GeoServer and the neglect to protect the users.
I guess you have the wrong impression about the community around here.
We are not Linux, nor Apache, we don't have a large and well funded organization
that would allow to get people dedicated to these issues, we simply
tried to manage it the best we can with the limited resources at hand.
I put time to fix the issue, my company sponsored the time to do the backports
from dev to stable and maintenance, Boundless people reviewed promptly,
Ben did the 2.6.4 release, someone else will put the time to do the 2.7.2
release
Not saying the above cannot be improved btw, we can certainly use some help
there.
Any attempt at improving the current situation in a more
predictable, better managed, with faster response times (which I agree would be
desirable)
will have to answer one simple question: "with what resources?".
As Jody said, people have the option of downloading a nightly build, especially
on the
stable series, the releases are really nothing more than a procedure to
tag the nightly of the right day in the month (the 18th), unless of course
the tests in the build or the nightly OGC conformance tests failed
(which is a rare occurrence).
Yet, the release procedure still eat around 4 hours of someone's time (someone
with admin rights in all the key areas), and the people routinely doing
releases are
a handful, all busy up to their eyeballs with their daily work already.
(check the release schedule, it has the release managers for each release:
https://github.com/geoserver/geoserver/wiki/Release-Schedule)
Next time you see something wrong in the project we'll be happy to hear
about it, and if you actually understood what Jeff McKenna tried to explain you,
you'll hopefully start your sentences with "I'm concerned with XYZ, how can I
help?".
If instead you're starting writing something like "I'm shocked" take a deep
breath,
think about it, and reword.... incidentally, that's what I usually do when I'm
writing about something that
bothers me: the mail gets often rewritten 2-3 times, progressively toning it
down (
and people still do complain I'm too direct after all that work :-p)
You're also welcomed to join tonight's Skype meeting, where the issue will be
discussed
and people will bring to the table whatever their can offer to improve the
management of
this kind of issues, now and in the future.
The meeting will be 9.30pm CET, send me, Jody or Ben your skype id in case you
want to join.
Cheers
Andrea
--
==
GeoServer Professional Services from the experts! Visit
http://goo.gl/it488V for more information.
==
Ing. Andrea Aime
@geowolf
Technical Lead
GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549
http://www.geo-solutions.it
http://twitter.com/geosolutions_it
AVVERTENZE AI SENSI DEL D.Lgs. 196/2003
Le informazioni contenute in questo messaggio di posta elettronica e/o nel/i
file/s allegato/i sono da considerarsi strettamente riservate. Il loro utilizzo
è consentito esclusivamente al destinatario del messaggio, per le finalità
indicate nel messaggio stesso. Qualora riceviate questo messaggio senza esserne
il destinatario, Vi preghiamo cortesemente di darcene notizia via e-mail e di
procedere alla distruzione del messaggio stesso, cancellandolo dal Vostro
sistema. Conservare il messaggio stesso, divulgarlo anche in parte,
distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità diverse,
costituisce comportamento contrario ai principi dettati dal D.Lgs. 196/2003.
The information in this message and/or attachments, is intended solely for the
attention and use of the named addressee(s) and may be confidential or
proprietary in nature or covered by the provisions of privacy act (Legislative
Decree June, 30 2003, no.196 - Italy's New Data Protection Code).Any use not in
accord with its purpose, any disclosure, reproduction, copying, distribution,
or either dissemination, either whole or partial, is strictly forbidden except
previous formal approval of the named addressee(s). If you are not the intended
recipient, please contact immediately the sender by telephone, fax or e-mail
and delete the information in this message that has been received in error. The
sender does not give any warranty or accept liability as the content, accuracy
or completeness of sent messages and accepts no responsibility for changes
made after they were sent or for other risks which arise as a result of e-mail
transmission, viruses, etc.
-------------------------------------------------------
------------------------------------------------------------------------------
Monitor 25 network devices or servers for free with OpManager!
OpManager is web-based network management software that monitors
network devices and physical & virtual servers, alerts via email & sms
for fault. Monitor 25 devices for free with no restriction. Download now
http://ad.doubleclick.net/ddm/clk/292181274;119417398;o
_______________________________________________
Geoserver-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/geoserver-devel
