0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

Al=
so thank you for the library !

=3D"ltr" class=3D"gmail_attr">On Sun, Feb 18, 2024, 1:11=E2=80=AFPM Mithun =
Bhattacharya <mith=
nb-at-gmail.com> wrote:

e=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

r=3D"auto">So is there a cleaner/saner version of libapreq2 or is the 2012 =
version better ?

=3D"gmail_attr">On Sun, Feb 18, 2024, 12:58=E2=80=AFPM Joe Schaefer <href=3D"mailto:joe-at-sunstarsys.com" rel=3D"noreferrer" target=3D"_blank">joe=
-at-sunstarsys.com> wrote:

tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> dir=3D"ltr">va,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">For th=
e past 25 years, I have been the lead developer of the libapreq2 subproject=
within the Apache HTTPd Server Parent Project. The original idea of libapr=
eq as a safe/performant HTML form and Cookie parsing library came out of a =
collaboration between Lincoln Stein and Doug MacEachern in the late 90s.pan>

f;font-size:13.3333px;background-color:rgb(246,246,239)">It was my vision b=
ack then to transform the library into a generic, non-Perl related C librar=
y that would support language bindings from other programming languages, wh=
ich is why I pushed for the project to be homes under the HTTPd umbrella in=
stead of the Apache-Perl project.

t-family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb=
(246,246,239)">While this vision was wildly successful, with language bindi=
ngs available for several languages like Perl, TCL, R, etc, ever since abou=
t 2010 its proven tragic for the existing user community consisting of all =
of them, not just Perl.

erdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,246,2=
39)">What happened? Philip Gollucci, a Perl/FreeBSD olleague of mine at the=
time, started agitating that we promote the project to be released from in=
side the HTTPd server itself. What Philip didn=E2=80=99t know very well bac=
k then was how utterly vapid and territorial that team had become, which wo=
uld have meant having to collaborate with them directly on user-facing deci=
sions about the code base.

y:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,24=
6,239)">In 2012, Philip got what he wanted and I stopped resisting, so he f=
orked the existing project and copied the C library components into HTTPd c=
ore.

serif;font-size:13.3333px;background-color:rgb(246,246,239)">In 2016 I resi=
gned from the Foundation en masse. You can guess the reasons.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">In 2020 or so, Google=E2=80=99=
s Security Team took advantage of an alpha release of httpd 2.5 by fuzzing =
its 8 year old copy of apreq. It found a few hotspots that needed repair.p>

font-size:13.3333px;background-color:rgb(246,246,239)">Instead of having th=
e courtesy of reaching out to me, or anyone else involved in development of=
apreq, a junior engineer on the HTTPd team went about the business of =E2=
=80=9Cbug fixing=E2=80=9D the vulnerabilities Google found. You can see a r=
ecord of his trial and error work in every release since then.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">But the coup de grace was the =
2022 release of 2.17, wherein the rookie developer purposely introduced a f=
atal bug into the codebase, breaking a fifteen year old regression test.>

ont-size:13.3333px;background-color:rgb(246,246,239)">If you are wondering =
how something with a broken regression test winds up on CPAN, you=E2=80=99l=
l have to look into how RELENG is done in the server project.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">Long story short, they comment=
ed out the test and shipped it anyway, and called it a Security Release tha=
t fixed a vulnerability every prior release was susceptible to.

=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:=
13.3333px;background-color:rgb(246,246,239)">Why do I care now? Because I=
=E2=80=99m the sucker users reach out to for answers as a known subject mat=
ter expert.

a,sans-serif;font-size:13.3333px;background-color:rgb(246,246,239)">This su=
cks, but I=E2=80=99m sorry to tell you that my days wearing the Superman ca=
pe at Apache ended 8 years ago.

ature_prefix">--

-smartmail=3D"gmail_signature">

Joe Schaefer, Ph.D.

iv>

noreferrer" target=3D"_blank">m/mail-sig/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb2f2Ymw0uY-9ZKx45P_KcsYtcI8RGq=
tr3HBrV6fAW1Hn4">

tures" rel=3D"noreferrer noreferrer" target=3D"_blank">Orion - The Enterpri=
se Jamstack Wiki

<tarsys.com" rel=3D"noreferrer noreferrer" target=3D"_blank">joe-at-sunstarsys.=
com>

ferrer" target=3D"_blank">954.253.3732

iv>