style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">v dir=3D"auto">2.18 will never be released. They are shutting down the proj=
ect.

l_signature" data-smartmail=3D"gmail_signature">

Joe Schaef=
er, Ph.D.

target=3D"_blank" rel=3D"noreferrer">ent.com/mail-sig/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb2f2Ymw0uY-9ZKx45P_KcsYt=
cI8RGqtr3HBrV6fAW1Hn4">

on/features" target=3D"_blank" rel=3D"noreferrer">Orion - The Enterprise Ja=
mstack Wiki

<s.com" target=3D"_blank" rel=3D"noreferrer">joe-at-sunstarsys.com>>

9=
54.253.3732

=

ltr" class=3D"gmail_attr">On Sun, Feb 18, 2024 at 4:32=E2=80=AFPM Mithun Bh=
attacharya <"noreferrer">mithnb-at-gmail.com> wrote:

gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-=
left:1ex">

Could you clarify this - 2.17 has a critic=
al bug and 2.18 is about to come out which doesn't have a good enough p=
atch so how would trunk be any better?

v dir=3D"auto">Also how is this passing make test or were the test cases mo=
dified to make the bug pass ?

">

"gmail_attr">On Sun, Feb 18, 2024, 1:12=E2=80=AFPM Joe Schaefer <=3D"mailto:joe-at-sunstarsys.com" target=3D"_blank" rel=3D"noreferrer">joe-at-sun=
starsys.com> wrote:

=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

=3D"auto">Trunk is the safe bet.

iv dir=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"gmail_signature"=
>

Joe Schaefer, Ph.D.

starsys.com/orion/features" rel=3D"noreferrer noreferrer" target=3D"_blank"=
>av9cgwbIEHDJwyXb2f2Ymw0uY-9ZKx45P_KcsYtcI8RGqtr3HBrV6fAW1Hn4">

v>errer" target=3D"_blank">Orion - The Enterprise Jamstack Wiki

=

<noreferrer" target=3D"_blank">joe-at-sunstarsys.com>

=3D"tel://954.253.3732" rel=3D"noreferrer noreferrer" target=3D"_blank">954=
.253.3732

div>

r" class=3D"gmail_attr">On Sun, Feb 18, 2024 at 2:11=E2=80=AFPM Mithun Bhat=
tacharya <er" target=3D"_blank">mithnb-at-gmail.com> wrote:

class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex">

So is there a cleaner/saner version of=
libapreq2 or is the 2012 version better ?

te">

On Sun, Feb 18, 2024, 12:58=E2=80=
=AFPM Joe Schaefer <rer noreferrer" target=3D"_blank">joe-at-sunstarsys.com> wrote:
v>

1px #ccc solid;padding-left:1ex">

130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;back=
ground-color:rgb(246,246,239)">For the past 25 years, I have been the lead =
developer of the libapreq2 subproject within the Apache HTTPd Server Parent=
Project. The original idea of libapreq as a safe/performant HTML form and =
Cookie parsing library came out of a collaboration between Lincoln Stein an=
d Doug MacEachern in the late 90s.

;font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color=
:rgb(246,246,239)">It was my vision back then to transform the library into=
a generic, non-Perl related C library that would support language bindings=
from other programming languages, which is why I pushed for the project to=
be homes under the HTTPd umbrella instead of the Apache-Perl project.

<=
p style=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;fon=
t-size:13.3333px;background-color:rgb(246,246,239)">While this vision was w=
ildly successful, with language bindings available for several languages li=
ke Perl, TCL, R, etc, ever since about 2010 its proven tragic for the exist=
ing user community consisting of all of them, not just Perl.

"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.=
3333px;background-color:rgb(246,246,239)">What happened? Philip Gollucci, a=
Perl/FreeBSD olleague of mine at the time, started agitating that we promo=
te the project to be released from inside the HTTPd server itself. What Phi=
lip didn=E2=80=99t know very well back then was how utterly vapid and terri=
torial that team had become, which would have meant having to collaborate w=
ith them directly on user-facing decisions about the code base.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">In 2012, Philip got what he wa=
nted and I stopped resisting, so he forked the existing project and copied =
the C library components into HTTPd core.

130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-c=
olor:rgb(246,246,239)">In 2016 I resigned from the Foundation en masse. You=
can guess the reasons.

erdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,2=
39)">In 2020 or so, Google=E2=80=99s Security Team took advantage of an alp=
ha release of httpd 2.5 by fuzzing its 8 year old copy of apreq. It found a=
few hotspots that needed repair.

t-family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb=
(246,246,239)">Instead of having the courtesy of reaching out to me, or any=
one else involved in development of apreq, a junior engineer on the HTTPd t=
eam went about the business of =E2=80=9Cbug fixing=E2=80=9D the vulnerabili=
ties Google found. You can see a record of his trial and error work in ever=
y release since then.

dana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239=
)">But the coup de grace was the 2022 release of 2.17, wherein the rookie d=
eveloper purposely introduced a fatal bug into the codebase, breaking a fif=
teen year old regression test.

amily:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(24=
6,246,239)">If you are wondering how something with a broken regression tes=
t winds up on CPAN, you=E2=80=99ll have to look into how RELENG is done in =
the server project.

na,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)"=
>Long story short, they commented out the test and shipped it anyway, and c=
alled it a Security Release that fixed a vulnerability every prior release =
was susceptible to.

na,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)"=
>Why do I care now? Because I=E2=80=99m the sucker users reach out to for a=
nswers as a known subject matter expert.

30);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-co=
lor:rgb(246,246,239)">This sucks, but I=E2=80=99m sorry to tell you that my=
days wearing the Superman cape at Apache ended 8 years ago.

div>--

lass=3D"gmail_signature" data-smartmail=3D"gmail_signature">

">Joe Schaefer, Ph.D.

n/features" rel=3D"noreferrer noreferrer noreferrer" target=3D"_blank"> src=3D"https://ci3.googleusercontent.com/mail-sig/AIorK4znBF_TAme6pCiav9cg=
wbIEHDJwyXb2f2Ymw0uY-9ZKx45P_KcsYtcI8RGqtr3HBrV6fAW1Hn4">

href=3D"https://sunstarsys.com/orion/features" rel=3D"noreferrer noreferrer=
noreferrer" target=3D"_blank">Orion - The Enterprise Jamstack Wiki
=

<errer noreferrer noreferrer" target=3D"_blank">joe-at-sunstarsys.com>div>

rrer" target=3D"_blank">954.253.3732

>