yle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

dir=3D"auto">So is there a cleaner/saner version of libapreq2 or is the 201=
2 version better ?

ss=3D"gmail_attr">On Sun, Feb 18, 2024, 12:58=E2=80=AFPM Joe Schaefer <<=
a href=3D"mailto:joe-at-sunstarsys.com" target=3D"_blank" rel=3D"noreferrer">j=
oe-at-sunstarsys.com> wrote:

style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">iv dir=3D"ltr">neva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">For =
the past 25 years, I have been the lead developer of the libapreq2 subproje=
ct within the Apache HTTPd Server Parent Project. The original idea of liba=
preq as a safe/performant HTML form and Cookie parsing library came out of =
a collaboration between Lincoln Stein and Doug MacEachern in the late 90s.<=
/span>

rif;font-size:13.3333px;background-color:rgb(246,246,239)">It was my vision=
back then to transform the library into a generic, non-Perl related C libr=
ary that would support language bindings from other programming languages, =
which is why I pushed for the project to be homes under the HTTPd umbrella =
instead of the Apache-Perl project.

ont-family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:r=
gb(246,246,239)">While this vision was wildly successful, with language bin=
dings available for several languages like Perl, TCL, R, etc, ever since ab=
out 2010 its proven tragic for the existing user community consisting of al=
l of them, not just Perl.

:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246=
,239)">What happened? Philip Gollucci, a Perl/FreeBSD olleague of mine at t=
he time, started agitating that we promote the project to be released from =
inside the HTTPd server itself. What Philip didn=E2=80=99t know very well b=
ack then was how utterly vapid and territorial that team had become, which =
would have meant having to collaborate with them directly on user-facing de=
cisions about the code base.

ily:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,=
246,239)">In 2012, Philip got what he wanted and I stopped resisting, so he=
forked the existing project and copied the C library components into HTTPd=
core.

s-serif;font-size:13.3333px;background-color:rgb(246,246,239)">In 2016 I re=
signed from the Foundation en masse. You can guess the reasons.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">In 2020 or so, Google=E2=80=99=
s Security Team took advantage of an alpha release of httpd 2.5 by fuzzing =
its 8 year old copy of apreq. It found a few hotspots that needed repair.p>

font-size:13.3333px;background-color:rgb(246,246,239)">Instead of having th=
e courtesy of reaching out to me, or anyone else involved in development of=
apreq, a junior engineer on the HTTPd team went about the business of =E2=
=80=9Cbug fixing=E2=80=9D the vulnerabilities Google found. You can see a r=
ecord of his trial and error work in every release since then.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">But the coup de grace was the =
2022 release of 2.17, wherein the rookie developer purposely introduced a f=
atal bug into the codebase, breaking a fifteen year old regression test.>

ont-size:13.3333px;background-color:rgb(246,246,239)">If you are wondering =
how something with a broken regression test winds up on CPAN, you=E2=80=99l=
l have to look into how RELENG is done in the server project.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">Long story short, they comment=
ed out the test and shipped it anyway, and called it a Security Release tha=
t fixed a vulnerability every prior release was susceptible to.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">Why do I care now? Because I=
=E2=80=99m the sucker users reach out to for answers as a known subject mat=
ter expert.

a,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">This su=
cks, but I=E2=80=99m sorry to tell you that my days wearing the Superman ca=
pe at Apache ended 8 years ago.

ature_prefix">--

-smartmail=3D"gmail_signature">

Joe Schaefer, Ph.D.

iv>

noreferrer" target=3D"_blank">m/mail-sig/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb2f2Ymw0uY-9ZKx45P_KcsYtcI8RGq=
tr3HBrV6fAW1Hn4">

tures" rel=3D"noreferrer noreferrer" target=3D"_blank">Orion - The Enterpri=
se Jamstack Wiki

<tarsys.com" rel=3D"noreferrer noreferrer" target=3D"_blank">joe-at-sunstarsys.=
com>

ferrer" target=3D"_blank">954.253.3732

iv>