Hi,
Speaking with a voice of an organization using GeoServer, I consider that the case has been handled well enough and the response time to fix the issue was not bad at all.
If I compare with other software, some of those deliver HotFixes like this http://www.esri.com/software/arcgis/extensions/districting/download-hotfix-build118 or this http://www.exelisvis.com/Support/HelpArticlesDetail/TabId/219/ArtMID/900/ArticleID/13541/ENVI-5-SP3-Hotfix-for-Landsat-8-OLI.aspx
Examples also show how those companies announce their hotfixes. For me it looks kind of similar to what GeoServer had in the 2.6.4 release announcement.
However, the release cycle of those software can be one or two years which makes hotfixes more or less necessary. Hotfixes three weeks before new release are rare.
This vulnerability was for sure more severe than usual, actually I do not remember any similar case. in this case it might have been better to announce nightly builds as a hotfix while waiting for the new releases. Perhaps that could be the plan for the future.
Jukka Rahkonen
Lähettäjä: Andrea Aime [mailto:andrea.aime@…1268…]
Lähetetty: 23. kesäkuuta 2015 10:02
Vastaanottaja: Johannes Kröger
Kopio: Geoserver-devel
Aihe: Re: [Geoserver-devel] Handling of GEOS-7032: Remote File Disclosure
···
On Mon, Jun 22, 2015 at 11:07 PM, Johannes Kröger <johannes.kroeger@…4262…> wrote:
Hi!
Earlier I posted things on Twitter and IRC that others seem to have
taken as more or less personal attacks or at least abrasive ranting.
The amount of noise you’ve been making for this one on twitter, even after
the OSGeo president (no less) asked you to use a more constructive
attitude would make many think you’ve simply trying to discredit the project.
We haven’t seen that kind of attitude in years.
Mind, I’m not saying we haven’t made mistakes, but ask yourself, with thousands of users
subscribed to the users mailing list, hundreds subscribed to the devel
list, and with so many with a twitter account, how
comes we don’t have tens of people raising hell?
Many may not have noticed, but I guess those that did, do understand
the volunteer nature of the project.
I am sorry about that, please do not take my criticism personal.
Nobody took it as personal criticism, people are just defending the project
and the community.
It is
easy to forget that there are people behind “words on the internet”.
However I was and still am shocked at the handling of a critical
security issue in GeoServer and the neglect to protect the users.
I guess you have the wrong impression about the community around here.
We are not Linux, nor Apache, we don’t have a large and well funded organization
that would allow to get people dedicated to these issues, we simply
tried to manage it the best we can with the limited resources at hand.
I put time to fix the issue, my company sponsored the time to do the backports
from dev to stable and maintenance, Boundless people reviewed promptly,
Ben did the 2.6.4 release, someone else will put the time to do the 2.7.2 release
Not saying the above cannot be improved btw, we can certainly use some help there.
Any attempt at improving the current situation in a more
predictable, better managed, with faster response times (which I agree would be desirable)
will have to answer one simple question: “with what resources?”.
As Jody said, people have the option of downloading a nightly build, especially on the
stable series, the releases are really nothing more than a procedure to
tag the nightly of the right day in the month (the 18th), unless of course
the tests in the build or the nightly OGC conformance tests failed
(which is a rare occurrence).
Yet, the release procedure still eat around 4 hours of someone’s time (someone
with admin rights in all the key areas), and the people routinely doing releases are
a handful, all busy up to their eyeballs with their daily work already.
(check the release schedule, it has the release managers for each release:
https://github.com/geoserver/geoserver/wiki/Release-Schedule)
Next time you see something wrong in the project we’ll be happy to hear
about it, and if you actually understood what Jeff McKenna tried to explain you,
you’ll hopefully start your sentences with “I’m concerned with XYZ, how can I help?”.
If instead you’re starting writing something like “I’m shocked” take a deep breath,
think about it, and reword… incidentally, that’s what I usually do when I’m writing about something that
bothers me: the mail gets often rewritten 2-3 times, progressively toning it down (
and people still do complain I’m too direct after all that work :-p)
You’re also welcomed to join tonight’s Skype meeting, where the issue will be discussed
and people will bring to the table whatever their can offer to improve the management of
this kind of issues, now and in the future.
The meeting will be 9.30pm CET, send me, Jody or Ben your skype id in case you
want to join.
Cheers
Andrea
–
==
GeoServer Professional Services from the experts! Visit
http://goo.gl/it488V for more information.
==
Ing. Andrea Aime
@geowolf
Technical Lead
GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549
http://twitter.com/geosolutions_it
AVVERTENZE AI SENSI DEL D.Lgs. 196/2003
Le informazioni contenute in questo messaggio di posta elettronica e/o nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nel messaggio stesso. Qualora riceviate questo messaggio senza esserne il destinatario, Vi preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità diverse, costituisce comportamento contrario ai principi dettati dal D.Lgs. 196/2003.
The information in this message and/or attachments, is intended solely for the attention and use of the named addressee(s) and may be confidential or proprietary in nature or covered by the provisions of privacy act (Legislative Decree June, 30 2003, no.196 - Italy’s New Data Protection Code).Any use not in accord with its purpose, any disclosure, reproduction, copying, distribution, or either dissemination, either whole or partial, is strictly forbidden except previous formal approval of the named addressee(s). If you are not the intended recipient, please contact immediately the sender by telephone, fax or e-mail and delete the information in this message that has been received in error. The sender does not give any warranty or accept liability as the content, accuracy or completeness of sent messages and accepts no responsibility for changes made after they were sent or for other risks which arise as a result of e-mail transmission, viruses, etc.