0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

=
Could you clarify this - 2.17 has a critical bug and 2.18 is about to come =
out which doesn't have a good enough patch so how would trunk be any be=
tter?

Also how is this p=
assing make test or were the test cases modified to make the bug pass ?v>

te" dir=3D"auto">

On Sun, Feb 18, 2024=
, 1:12=E2=80=AFPM Joe Schaefer <rget=3D"_blank">joe-at-sunstarsys.com> wrote:

s=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pad=
ding-left:1ex">

Trunk is the safe bet.
r clear=3D"all">

ail=3D"gmail_signature">

Joe Schaefer, Ph.D.

>t=3D"_blank">nBF_TAme6pCiav9cgwbIEHDJwyXb2f2Ymw0uY-9ZKx45P_KcsYtcI8RGqtr3HBrV6fAW1Hn4"><=
/a>

ferrer" target=3D"_blank">Orion - The Enterprise Jamstack Wiki
>

<" target=3D"_blank">joe-at-sunstarsys.com>

54.253.3732" rel=3D"noreferrer" target=3D"_blank">954.253.3732

v>

iv>

">On Sun, Feb 18, 2024 at 2:11=E2=80=AFPM Mithun Bhattacharya <=3D"mailto:mithnb-at-gmail.com" rel=3D"noreferrer" target=3D"_blank">mithnb-at-gm=
ail.com> wrote:

margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

auto">So is there a cleaner/saner version of libapreq2 or is the 2012 versi=
on better ?

mail_attr">On Sun, Feb 18, 2024, 12:58=E2=80=AFPM Joe Schaefer <=3D"mailto:joe-at-sunstarsys.com" rel=3D"noreferrer" target=3D"_blank">joe-at-sun=
starsys.com> wrote:

=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

=3D"ltr">ans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">For the pa=
st 25 years, I have been the lead developer of the libapreq2 subproject wit=
hin the Apache HTTPd Server Parent Project. The original idea of libapreq a=
s a safe/performant HTML form and Cookie parsing library came out of a coll=
aboration between Lincoln Stein and Doug MacEachern in the late 90s.=

nt-size:13.3333px;background-color:rgb(246,246,239)">It was my vision back =
then to transform the library into a generic, non-Perl related C library th=
at would support language bindings from other programming languages, which =
is why I pushed for the project to be homes under the HTTPd umbrella instea=
d of the Apache-Perl project.

mily:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246=
,246,239)">While this vision was wildly successful, with language bindings =
available for several languages like Perl, TCL, R, etc, ever since about 20=
10 its proven tragic for the existing user community consisting of all of t=
hem, not just Perl.

na,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)"=
>What happened? Philip Gollucci, a Perl/FreeBSD olleague of mine at the tim=
e, started agitating that we promote the project to be released from inside=
the HTTPd server itself. What Philip didn=E2=80=99t know very well back th=
en was how utterly vapid and territorial that team had become, which would =
have meant having to collaborate with them directly on user-facing decision=
s about the code base.

rdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,23=
9)">In 2012, Philip got what he wanted and I stopped resisting, so he forke=
d the existing project and copied the C library components into HTTPd core.=

f;font-size:13.3333px;background-color:rgb(246,246,239)">In 2016 I resigned=
from the Foundation en masse. You can guess the reasons.

lor:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.333=
3px;background-color:rgb(246,246,239)">In 2020 or so, Google=E2=80=99s Secu=
rity Team took advantage of an alpha release of httpd 2.5 by fuzzing its 8 =
year old copy of apreq. It found a few hotspots that needed repair.

tyle=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-s=
ize:13.3333px;background-color:rgb(246,246,239)">Instead of having the cour=
tesy of reaching out to me, or anyone else involved in development of apreq=
, a junior engineer on the HTTPd team went about the business of =E2=80=9Cb=
ug fixing=E2=80=9D the vulnerabilities Google found. You can see a record o=
f his trial and error work in every release since then.

r:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333p=
x;background-color:rgb(246,246,239)">But the coup de grace was the 2022 rel=
ease of 2.17, wherein the rookie developer purposely introduced a fatal bug=
into the codebase, breaking a fifteen year old regression test.

e=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size=
:13.3333px;background-color:rgb(246,246,239)">If you are wondering how some=
thing with a broken regression test winds up on CPAN, you=E2=80=99ll have t=
o look into how RELENG is done in the server project.

rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;=
background-color:rgb(246,246,239)">Long story short, they commented out the=
test and shipped it anyway, and called it a Security Release that fixed a =
vulnerability every prior release was susceptible to.

rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;=
background-color:rgb(246,246,239)">Why do I care now? Because I=E2=80=99m t=
he sucker users reach out to for answers as a known subject matter expert.<=
/p>

;font-size:13.3333px;background-color:rgb(246,246,239)">This sucks, but I=
=E2=80=99m sorry to tell you that my days wearing the Superman cape at Apac=
he ended 8 years ago.

ix">--

=3D"gmail_signature">

Joe Schaefer, Ph.D.

href=3D"https://sunstarsys.com/orion/features" rel=3D"noreferrer noreferre=
r" target=3D"_blank">/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb2f2Ymw0uY-9ZKx45P_KcsYtcI8RGqtr3HBrV6fA=
W1Hn4">

=3D"noreferrer noreferrer" target=3D"_blank">Orion - The Enterprise Jamstac=
k Wiki

<" rel=3D"noreferrer noreferrer" target=3D"_blank">joe-at-sunstarsys.com>=
;

rget=3D"_blank">954.253.3732

<=
/div>