x;border-left:1px #ccc solid;padding-left:1ex">

Trunk is t=
he safe bet.

=3D"gmail_signature" data-smartmail=3D"gmail_signature">

Jo=
e Schaefer, Ph.D.

atures" target=3D"_blank" rel=3D"noreferrer">usercontent.com/mail-sig/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb2f2Ymw0uY-9ZKx4=
5P_KcsYtcI8RGqtr3HBrV6fAW1Hn4">

.com/orion/features" target=3D"_blank" rel=3D"noreferrer">Orion - The Enter=
prise Jamstack Wiki

<unstarsys.com" target=3D"_blank" rel=3D"noreferrer">joe-at-sunstarsys.com&=
gt;

errer">954.253.3732

v>

dir=3D"ltr" class=3D"gmail_attr">On Sun, Feb 18, 2024 at 2:11=E2=80=AFPM M=
ithun Bhattacharya <" rel=3D"noreferrer">mithnb-at-gmail.com> wrote:

lass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;=
padding-left:1ex">

So is there a cleaner/saner version of =
libapreq2 or is the 2012 version better ?

e">

On Sun, Feb 18, 2024, 12:58=E2=80=
=AFPM Joe Schaefer <nk" rel=3D"noreferrer">joe-at-sunstarsys.com> wrote:

te class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc so=
lid;padding-left:1ex">

);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-colo=
r:rgb(246,246,239)">For the past 25 years, I have been the lead developer o=
f the libapreq2 subproject within the Apache HTTPd Server Parent Project. T=
he original idea of libapreq as a safe/performant HTML form and Cookie pars=
ing library came out of a collaboration between Lincoln Stein and Doug MacE=
achern in the late 90s.

y:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,24=
6,239)">It was my vision back then to transform the library into a generic,=
non-Perl related C library that would support language bindings from other=
programming languages, which is why I pushed for the project to be homes u=
nder the HTTPd umbrella instead of the Apache-Perl project.

color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3=
333px;background-color:rgb(246,246,239)">While this vision was wildly succe=
ssful, with language bindings available for several languages like Perl, TC=
L, R, etc, ever since about 2010 its proven tragic for the existing user co=
mmunity consisting of all of them, not just Perl.

130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;back=
ground-color:rgb(246,246,239)">What happened? Philip Gollucci, a Perl/FreeB=
SD olleague of mine at the time, started agitating that we promote the proj=
ect to be released from inside the HTTPd server itself. What Philip didn=E2=
=80=99t know very well back then was how utterly vapid and territorial that=
team had become, which would have meant having to collaborate with them di=
rectly on user-facing decisions about the code base.

gb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;b=
ackground-color:rgb(246,246,239)">In 2012, Philip got what he wanted and I =
stopped resisting, so he forked the existing project and copied the C libra=
ry components into HTTPd core.

amily:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(24=
6,246,239)">In 2016 I resigned from the Foundation en masse. You can guess =
the reasons.

va,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">In 202=
0 or so, Google=E2=80=99s Security Team took advantage of an alpha release =
of httpd 2.5 by fuzzing its 8 year old copy of apreq. It found a few hotspo=
ts that needed repair.

rdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,23=
9)">Instead of having the courtesy of reaching out to me, or anyone else in=
volved in development of apreq, a junior engineer on the HTTPd team went ab=
out the business of =E2=80=9Cbug fixing=E2=80=9D the vulnerabilities Google=
found. You can see a record of his trial and error work in every release s=
ince then.

,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">But the =
coup de grace was the 2022 release of 2.17, wherein the rookie developer pu=
rposely introduced a fatal bug into the codebase, breaking a fifteen year o=
ld regression test.

na,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)"=
>If you are wondering how something with a broken regression test winds up =
on CPAN, you=E2=80=99ll have to look into how RELENG is done in the server =
project.

ans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">Long story=
short, they commented out the test and shipped it anyway, and called it a =
Security Release that fixed a vulnerability every prior release was suscept=
ible to.

ans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">Why do I c=
are now? Because I=E2=80=99m the sucker users reach out to for answers as a=
known subject matter expert.

mily:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246=
,246,239)">This sucks, but I=E2=80=99m sorry to tell you that my days weari=
ng the Superman cape at Apache ended 8 years ago.

lass=3D"gmail_signature_prefix">--

il_signature" data-smartmail=3D"gmail_signature">

Joe Schae=
fer, Ph.D.

rel=3D"noreferrer noreferrer" target=3D"_blank">ogleusercontent.com/mail-sig/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb2f2Ymw0uY-9=
ZKx45P_KcsYtcI8RGqtr3HBrV6fAW1Hn4">

rsys.com/orion/features" rel=3D"noreferrer noreferrer" target=3D"_blank">Or=
ion - The Enterprise Jamstack Wiki

<=3D"mailto:joe-at-sunstarsys.com" rel=3D"noreferrer noreferrer" target=3D"_bla=
nk">joe-at-sunstarsys.com>

=3D"noreferrer noreferrer" target=3D"_blank">954.253.3732

>