Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-06 Thread Bernd Eckenfels
Hello, I tried to raise that concern in the message already, but it is probably worth repeating it explicitly: this is not a real bug in the Commons-Collection class, and it might not be worse fixing it, as there are possibly tons of other vectors. This was also addressed by the original authors i

Re: [math] Version mgt idea

2015-11-06 Thread Gilles
On Fri, 6 Nov 2015 16:53:00 -0800, Gary Gregory wrote: On Fri, Nov 6, 2015 at 4:42 PM, Gilles wrote: On Fri, 6 Nov 2015 17:02:01 -0700, Phil Steitz wrote: On 11/6/15 4:46 PM, Gary Gregory wrote: On Fri, Nov 6, 2015 at 3:01 PM, Phil Steitz wrote: On 11/6/15 2:51 PM, Gary Gregory wrote:

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-06 Thread Thomas Neidhart
On 11/07/2015 12:56 AM, Thomas Neidhart wrote: > On 11/06/2015 10:25 PM, Bernd Eckenfels wrote: >> ello, >> >> I came across this article: >> >> http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ >> >> It d

Re: [math] Version mgt idea

2015-11-06 Thread Gary Gregory
On Fri, Nov 6, 2015 at 4:42 PM, Gilles wrote: > On Fri, 6 Nov 2015 17:02:01 -0700, Phil Steitz wrote: > >> On 11/6/15 4:46 PM, Gary Gregory wrote: >> >>> On Fri, Nov 6, 2015 at 3:01 PM, Phil Steitz >>> wrote: >>> >>> On 11/6/15 2:51 PM, Gary Gregory wrote: > On Fri, 6 Nov 2015 09:17:18

Re: [math] Version mgt idea

2015-11-06 Thread Gary Gregory
On Fri, Nov 6, 2015 at 4:02 PM, Phil Steitz wrote: > On 11/6/15 4:46 PM, Gary Gregory wrote: > > On Fri, Nov 6, 2015 at 3:01 PM, Phil Steitz > wrote: > > > >> On 11/6/15 2:51 PM, Gary Gregory wrote: > On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: > > Here is an idea that mig

Re: [math] Version mgt idea

2015-11-06 Thread Gilles
On Fri, 6 Nov 2015 17:02:01 -0700, Phil Steitz wrote: On 11/6/15 4:46 PM, Gary Gregory wrote: On Fri, Nov 6, 2015 at 3:01 PM, Phil Steitz wrote: On 11/6/15 2:51 PM, Gary Gregory wrote: On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: Here is an idea that might break our deadlock re ba

Re: [math] Version mgt idea

2015-11-06 Thread Phil Steitz
On 11/6/15 4:46 PM, Gary Gregory wrote: > On Fri, Nov 6, 2015 at 3:01 PM, Phil Steitz wrote: > >> On 11/6/15 2:51 PM, Gary Gregory wrote: On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: > Here is an idea that might break our deadlock re backward > compatibility, versioni

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-06 Thread Thomas Neidhart
On 11/06/2015 10:25 PM, Bernd Eckenfels wrote: > ello, > > I came across this article: > > http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ > > It describes attacks against common Java applications wit

Re: [math] Version mgt idea

2015-11-06 Thread Gary Gregory
On Fri, Nov 6, 2015 at 3:01 PM, Phil Steitz wrote: > On 11/6/15 2:51 PM, Gary Gregory wrote: > >> On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: > >>> Here is an idea that might break our deadlock re backward > >>> compatibility, versioning and RERO: > >>> > >>> Agree that

Re: [math] Version mgt idea

2015-11-06 Thread Phil Steitz
On 11/6/15 2:51 PM, Gary Gregory wrote: >> On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: >>> Here is an idea that might break our deadlock re backward >>> compatibility, versioning and RERO: >>> >>> Agree that odd numbered versions have stable APIs - basically >>> adhere

Re: [math] Version mgt idea

2015-11-06 Thread Gary Gregory
> > On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: > >> Here is an idea that might break our deadlock re backward >> compatibility, versioning and RERO: >> >> Agree that odd numbered versions have stable APIs - basically >> adhere >> to Commons rules - no breaks w

Re: [math] Version mgt idea

2015-11-06 Thread Gilles
On Fri, 6 Nov 2015 12:21:46 -0700, Phil Steitz wrote: On 11/6/15 11:02 AM, Gilles wrote: On Fri, 6 Nov 2015 10:36:51 -0700, Phil Steitz wrote: On 11/6/15 10:31 AM, Gilles wrote: Hi. On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: Here is an idea that might break our deadlock re backwar

[collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-06 Thread Bernd Eckenfels
ello, I came across this article: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ It describes attacks against common Java applications with pre-authentication requests using malicious Java Object ser

[math] Smaller Packages / Artifacts / Dependencies

2015-11-06 Thread Ole Ersoy
If math is broken up into smaller artifacts it will make it easier for users to upgrade, even if it it breaks compatibility, as well as speed up the release frequency. So for example: commons-math-optimization (Or even more granular commons-math-optimization-lp, commons-math-optimization-ga, c

Re: [math] Version mgt idea

2015-11-06 Thread Phil Steitz
On 11/6/15 11:02 AM, Gilles wrote: > On Fri, 6 Nov 2015 10:36:51 -0700, Phil Steitz wrote: >> On 11/6/15 10:31 AM, Gilles wrote: >>> Hi. >>> >>> On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: Here is an idea that might break our deadlock re backward compatibility, versioning and RE

Re: [Math] Releasing 4.0? (Was: releasing 3.6 ?)

2015-11-06 Thread Luc Maisonobe
Le 06/11/2015 14:55, Gilles a écrit : > Hi Luc. > > On Fri, 06 Nov 2015 10:04:23 +0100, luc wrote: >> Le 2015-11-06 02:34, Gilles a écrit : >>> On Thu, 5 Nov 2015 15:41:57 -0700, Phil Steitz wrote: On 11/5/15 1:58 PM, Luc Maisonobe wrote: > Le 05/11/2015 12:25, Gilles a écrit : >> Hel

Re: [math] Version mgt idea

2015-11-06 Thread Luc Maisonobe
Le 06/11/2015 18:31, Gilles a écrit : > Hi. > > On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: >> Here is an idea that might break our deadlock re backward >> compatibility, versioning and RERO: >> >> Agree that odd numbered versions have stable APIs - basically adhere >> to Commons rules -

Re: [math] Version mgt idea

2015-11-06 Thread Luc Maisonobe
Le 06/11/2015 18:18, sebb a écrit : > On 6 November 2015 at 16:17, Phil Steitz wrote: >> Here is an idea that might break our deadlock re backward >> compatibility, versioning and RERO: >> >> Agree that odd numbered versions have stable APIs - basically adhere >> to Commons rules - no breaks withi

Re: [math] Version mgt idea

2015-11-06 Thread Gilles
On Fri, 6 Nov 2015 10:36:51 -0700, Phil Steitz wrote: On 11/6/15 10:31 AM, Gilles wrote: Hi. On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: Here is an idea that might break our deadlock re backward compatibility, versioning and RERO: Agree that odd numbered versions have stable APIs -

Re: [math] Version mgt idea

2015-11-06 Thread Phil Steitz
On 11/6/15 10:31 AM, Gilles wrote: > Hi. > > On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: >> Here is an idea that might break our deadlock re backward >> compatibility, versioning and RERO: >> >> Agree that odd numbered versions have stable APIs - basically adhere >> to Commons rules - no

Re: [math] Version mgt idea

2015-11-06 Thread Gilles
Hi. On Fri, 6 Nov 2015 09:17:18 -0700, Phil Steitz wrote: Here is an idea that might break our deadlock re backward compatibility, versioning and RERO: Agree that odd numbered versions have stable APIs - basically adhere to Commons rules - no breaks within 3.0, 3.1, ..., 3.x... or 5.0, 5.1... b

Re: [math] Version mgt idea

2015-11-06 Thread Phil Steitz
On 11/6/15 10:18 AM, sebb wrote: > On 6 November 2015 at 16:17, Phil Steitz wrote: >> Here is an idea that might break our deadlock re backward >> compatibility, versioning and RERO: >> >> Agree that odd numbered versions have stable APIs - basically adhere >> to Commons rules - no breaks within 3

Re: [math] Version mgt idea

2015-11-06 Thread sebb
On 6 November 2015 at 16:17, Phil Steitz wrote: > Here is an idea that might break our deadlock re backward > compatibility, versioning and RERO: > > Agree that odd numbered versions have stable APIs - basically adhere > to Commons rules - no breaks within 3.0, 3.1, ..., 3.x... or 5.0, > 5.1... bu

Re: [Math] Releasing 4.0? (Was: releasing 3.6 ?)

2015-11-06 Thread Gilles
On Fri, 6 Nov 2015 07:02:58 -0700, Phil Steitz wrote: On 11/6/15 2:04 AM, luc wrote: Le 2015-11-06 02:34, Gilles a écrit : On Thu, 5 Nov 2015 15:41:57 -0700, Phil Steitz wrote: On 11/5/15 1:58 PM, Luc Maisonobe wrote: Le 05/11/2015 12:25, Gilles a écrit : Hello. On Wed, 04 Nov 2015 10:13:00

[math] Version mgt idea

2015-11-06 Thread Phil Steitz
Here is an idea that might break our deadlock re backward compatibility, versioning and RERO: Agree that odd numbered versions have stable APIs - basically adhere to Commons rules - no breaks within 3.0, 3.1, ..., 3.x... or 5.0, 5.1... but even-numbered lines can include breaks - so 4.0 and 4.1 mi

Re: [Math] Releasing 4.0? (Was: releasing 3.6 ?)

2015-11-06 Thread Phil Steitz
On 11/6/15 2:04 AM, luc wrote: > Le 2015-11-06 02:34, Gilles a écrit : >> On Thu, 5 Nov 2015 15:41:57 -0700, Phil Steitz wrote: >>> On 11/5/15 1:58 PM, Luc Maisonobe wrote: Le 05/11/2015 12:25, Gilles a écrit : > Hello. > > On Wed, 04 Nov 2015 10:13:00 +0100, luc wrote: >> Hi a

Re: [Math] Releasing 4.0? (Was: releasing 3.6 ?)

2015-11-06 Thread Gilles
Hi Luc. On Fri, 06 Nov 2015 10:04:23 +0100, luc wrote: Le 2015-11-06 02:34, Gilles a écrit : On Thu, 5 Nov 2015 15:41:57 -0700, Phil Steitz wrote: On 11/5/15 1:58 PM, Luc Maisonobe wrote: Le 05/11/2015 12:25, Gilles a écrit : Hello. On Wed, 04 Nov 2015 10:13:00 +0100, luc wrote: Hi all, I w

Re: [lang] Outdated Information on Jira Summary Page

2015-11-06 Thread Benedikt Ritter
Hello Pascal, 2015-11-05 20:25 GMT+01:00 Pascal Schumacher : > Hello everybody, > > > https://issues.apache.org/jira/browse/LANG/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel > shows: > > RELEASE PLAN > Lang 2.x - There are no plans for major work on the 2.x line, but bug fix

Re: [Math] Releasing 4.0? (Was: releasing 3.6 ?)

2015-11-06 Thread luc
Le 2015-11-06 02:34, Gilles a écrit : On Thu, 5 Nov 2015 15:41:57 -0700, Phil Steitz wrote: On 11/5/15 1:58 PM, Luc Maisonobe wrote: Le 05/11/2015 12:25, Gilles a écrit : Hello. On Wed, 04 Nov 2015 10:13:00 +0100, luc wrote: Hi all, I would like to release 3.6 in the upcoming weeks. There h