er-left:1px #ccc solid;padding-left:1ex">

lor:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.333=
3px;background-color:rgb(246,246,239)">For the past 25 years, I have been t=
he lead developer of the libapreq2 subproject within the Apache HTTPd Serve=
r Parent Project. The original idea of libapreq as a safe/performant HTML f=
orm and Cookie parsing library came out of a collaboration between Lincoln =
Stein and Doug MacEachern in the late 90s.

130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;backgrou=
nd-color:rgb(246,246,239)">It was my vision back then to transform the libr=
ary into a generic, non-Perl related C library that would support language =
bindings from other programming languages, which is why I pushed for the pr=
oject to be homes under the HTTPd umbrella instead of the Apache-Perl proje=
ct.

erif;font-size:13.3333px;background-color:rgb(246,246,239)">While this visi=
on was wildly successful, with language bindings available for several lang=
uages like Perl, TCL, R, etc, ever since about 2010 its proven tragic for t=
he existing user community consisting of all of them, not just Perl.

style=3D"color:rgb(130,130,130);font-family:Verdana,Geneva,sans-serif;font-=
size:13.3333px;background-color:rgb(246,246,239)">What happened? Philip Gol=
lucci, a Perl/FreeBSD olleague of mine at the time, started agitating that =
we promote the project to be released from inside the HTTPd server itself. =
What Philip didn=E2=80=99t know very well back then was how utterly vapid a=
nd territorial that team had become, which would have meant having to colla=
borate with them directly on user-facing decisions about the code base.

=

nt-size:13.3333px;background-color:rgb(246,246,239)">In 2012, Philip got wh=
at he wanted and I stopped resisting, so he forked the existing project and=
copied the C library components into HTTPd core.

130,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;back=
ground-color:rgb(246,246,239)">In 2016 I resigned from the Foundation en ma=
sse. You can guess the reasons.

family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(2=
46,246,239)">In 2020 or so, Google=E2=80=99s Security Team took advantage o=
f an alpha release of httpd 2.5 by fuzzing its 8 year old copy of apreq. It=
found a few hotspots that needed repair.

130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-c=
olor:rgb(246,246,239)">Instead of having the courtesy of reaching out to me=
, or anyone else involved in development of apreq, a junior engineer on the=
HTTPd team went about the business of =E2=80=9Cbug fixing=E2=80=9D the vul=
nerabilities Google found. You can see a record of his trial and error work=
in every release since then.

mily:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246=
,246,239)">But the coup de grace was the 2022 release of 2.17, wherein the =
rookie developer purposely introduced a fatal bug into the codebase, breaki=
ng a fifteen year old regression test.

);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;background-colo=
r:rgb(246,246,239)">If you are wondering how something with a broken regres=
sion test winds up on CPAN, you=E2=80=99ll have to look into how RELENG is =
done in the server project.

ly:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,2=
46,239)">Long story short, they commented out the test and shipped it anywa=
y, and called it a Security Release that fixed a vulnerability every prior =
release was susceptible to.

ly:Verdana,Geneva,sans-serif;font-size:13.3333px;background-color:rgb(246,2=
46,239)">Why do I care now? Because I=E2=80=99m the sucker users reach out =
to for answers as a known subject matter expert.

30,130,130);font-family:Verdana,Geneva,sans-serif;font-size:13.3333px;backg=
round-color:rgb(246,246,239)">This sucks, but I=E2=80=99m sorry to tell you=
that my days wearing the Superman cape at Apache ended 8 years ago.

v>

--

=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"gmail_signature">

dir=3D"ltr">Joe Schaefer, Ph.D.

s.com/orion/features" target=3D"_blank" rel=3D"noreferrer">s://ci3.googleusercontent.com/mail-sig/AIorK4znBF_TAme6pCiav9cgwbIEHDJwyXb2=
f2Ymw0uY-9ZKx45P_KcsYtcI8RGqtr3HBrV6fAW1Hn4">

s://sunstarsys.com/orion/features" target=3D"_blank" rel=3D"noreferrer">Ori=
on - The Enterprise Jamstack Wiki

<=3D"mailto:joe-at-sunstarsys.com" target=3D"_blank" rel=3D"noreferrer">joe-at-sun=
starsys.com>

nk" rel=3D"noreferrer">954.253.3732

=