x;border-left:1px #ccc solid;padding-left:1ex">

So it=
will be moved to retired I assume or are they going to break their own rul=
es and purge it altogether?

class=3D"gmail_quote">

On Sun, Feb 18,=
2024, 3:33=E2=80=AFPM Joe Schaefer <m" target=3D"_blank">joe-at-sunstarsys.com> wrote:

class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc soli=
d;padding-left:1ex">

2.18 will never be released. They are=
shutting down the project.

r=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"gmail_signature"> dir=3D"ltr">Joe Schaefer, Ph.D.

ys.com/orion/features" rel=3D"noreferrer" target=3D"_blank">ps://ci3.googleusercontent.com/mail-sig/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb=
2f2Ymw0uY-9ZKx45P_KcsYtcI8RGqtr3HBrV6fAW1Hn4">

ps://sunstarsys.com/orion/features" rel=3D"noreferrer" target=3D"_blank">Or=
ion - The Enterprise Jamstack Wiki

<=3D"mailto:joe-at-sunstarsys.com" rel=3D"noreferrer" target=3D"_blank">joe-at-sun=
starsys.com>

rer" target=3D"_blank">954.253.3732

=

mail_quote">

On Sun, Feb 18, 2024 at 4=
:32=E2=80=AFPM Mithun Bhattacharya <rel=3D"noreferrer" target=3D"_blank">mithnb-at-gmail.com> wrote:
iv>

:1px #ccc solid;padding-left:1ex">

Could you clarify =
this - 2.17 has a critical bug and 2.18 is about to come out which doesn=
9;t have a good enough patch so how would trunk be any better?

r=3D"auto">

Also how is this passing make test o=
r were the test cases modified to make the bug pass ?

=3D"auto">

>

On Sun, Feb 18, 2024, 1:12=E2=80=AFP=
M Joe Schaefer < target=3D"_blank">joe-at-sunstarsys.com> wrote:

lass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;=
padding-left:1ex">

Trunk is the safe bet.
>

rtmail=3D"gmail_signature">

Joe Schaefer, Ph.D.

<=
div>eferrer" target=3D"_blank">il-sig/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb2f2Ymw0uY-9ZKx45P_KcsYtcI8RGqtr3H=
BrV6fAW1Hn4">

s" rel=3D"noreferrer noreferrer" target=3D"_blank">Orion - The Enterprise J=
amstack Wiki

<ys.com" rel=3D"noreferrer noreferrer" target=3D"_blank">joe-at-sunstarsys.com<=
/a>>

er" target=3D"_blank">954.253.3732

<=
/div>

ail_quote">

On Sun, Feb 18, 2024 at 2:=
11=E2=80=AFPM Mithun Bhattacharya <el=3D"noreferrer noreferrer" target=3D"_blank">mithnb-at-gmail.com> wro=
te:

order-left:1px #ccc solid;padding-left:1ex">

So is there a=
cleaner/saner version of libapreq2 or is the 2012 version better ?

r>

On Sun, =
Feb 18, 2024, 12:58=E2=80=AFPM Joe Schaefer <arsys.com" rel=3D"noreferrer noreferrer" target=3D"_blank">joe-at-sunstarsys.c=
om> wrote:

n:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

=
;font-size:13.3333px;background-color:rgb(246,246,239)">For the past 25 yea=
rs, I have been the lead developer of the libapreq2 subproject within the A=
pache HTTPd Server Parent Project. The original idea of libapreq as a safe/=
performant HTML form and Cookie parsing library came out of a collaboration=
between Lincoln Stein and Doug MacEachern in the late 90s.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">It was my vision back then to =
transform the library into a generic, non-Perl related C library that would=
support language bindings from other programming languages, which is why I=
pushed for the project to be homes under the HTTPd umbrella instead of the=
Apache-Perl project.

dana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239=
)">While this vision was wildly successful, with language bindings availabl=
e for several languages like Perl, TCL, R, etc, ever since about 2010 its p=
roven tragic for the existing user community consisting of all of them, not=
just Perl.

a,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">What ha=
ppened? Philip Gollucci, a Perl/FreeBSD olleague of mine at the time, start=
ed agitating that we promote the project to be released from inside the HTT=
Pd server itself. What Philip didn=E2=80=99t know very well back then was h=
ow utterly vapid and territorial that team had become, which would have mea=
nt having to collaborate with them directly on user-facing decisions about =
the code base.

neva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">In 2=
012, Philip got what he wanted and I stopped resisting, so he forked the ex=
isting project and copied the C library components into HTTPd core.

tyle=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-s=
ize:13.3333px;background-color:rgb(246,246,239)">In 2016 I resigned from th=
e Foundation en masse. You can guess the reasons.

130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;back=
ground-color:rgb(246,246,239)">In 2020 or so, Google=E2=80=99s Security Tea=
m took advantage of an alpha release of httpd 2.5 by fuzzing its 8 year old=
copy of apreq. It found a few hotspots that needed repair.

color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3=
333px;background-color:rgb(246,246,239)">Instead of having the courtesy of =
reaching out to me, or anyone else involved in development of apreq, a juni=
or engineer on the HTTPd team went about the business of =E2=80=9Cbug fixin=
g=E2=80=9D the vulnerabilities Google found. You can see a record of his tr=
ial and error work in every release since then.

0,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;backgr=
ound-color:rgb(246,246,239)">But the coup de grace was the 2022 release of =
2.17, wherein the rookie developer purposely introduced a fatal bug into th=
e codebase, breaking a fifteen year old regression test.

or:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333=
px;background-color:rgb(246,246,239)">If you are wondering how something wi=
th a broken regression test winds up on CPAN, you=E2=80=99ll have to look i=
nto how RELENG is done in the server project.

130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;backgrou=
nd-color:rgb(246,246,239)">Long story short, they commented out the test an=
d shipped it anyway, and called it a Security Release that fixed a vulnerab=
ility every prior release was susceptible to.

130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;backgrou=
nd-color:rgb(246,246,239)">Why do I care now? Because I=E2=80=99m the sucke=
r users reach out to for answers as a known subject matter expert.

yle=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-si=
ze:13.3333px;background-color:rgb(246,246,239)">This sucks, but I=E2=80=99m=
sorry to tell you that my days wearing the Superman cape at Apache ended 8=
years ago.

-- pan>

signature">

Joe Schaefer, Ph.D.

ttps://sunstarsys.com/orion/features" rel=3D"noreferrer noreferrer noreferr=
er" target=3D"_blank">g/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb2f2Ymw0uY-9ZKx45P_KcsYtcI8RGqtr3HBrV6f=
AW1Hn4">

l=3D"noreferrer noreferrer noreferrer" target=3D"_blank">Orion - The Enterp=
rise Jamstack Wiki

<nstarsys.com" rel=3D"noreferrer noreferrer noreferrer" target=3D"_blank">jo=
e-at-sunstarsys.com>

referrer noreferrer noreferrer" target=3D"_blank">954.253.3732

v>