Re: Info-ZIP maintainer

Mike wrote:

> I do have a bunch of old mail that I will go through and see if there are
> any patches in there - or other potential issues. As I recall, there were a
> couple of issues that really weren't patches, but required actual fixes -
> i.e. problems given, but no solutions. I have no idea if Christian has done
> those fixes, or if anyone has even looked at them.

> Greg might have these someplace if I don't have them in my mail.

I have the same vague recollection, but I haven't tried to keep up.
The main bugaboo is several known security holes involving directory-
traversal and going back to last May or so.  The Linux-distro fixes
presumably touch only the files in the unix/ subdir, but there were
a few messages about what other OSes were and weren't affected.  The
same kinds of fixes would be needed for each.

Two of the bugs are noted on the UnZip web page and were discussed
briefly around 9-10 Sept, I think.  A third may have been reported by
"Rafal" <[email protected]> between 5 Jan and 8 Jan.  I'm just going by old
subject lines; I haven't checked the actual messages.

> As for delaying the release until the summer, from my viewpoint, I would
> suggest that getting this release out as soon as possible would be the
> better position, because it has been quite awhile since this has been
> released.

Yes, it should have been released last June. :-(

> If, however, we can get Ed's large file support etc., into unzip that would
> be a major reason to delay the release.

I disagree.  The security fixes should go out ASAP, possibly all by
themselves, and optionally just as an official patch.  Then you can
take all the time you want for 5.52 or 5.6 or whatever.  But leaving
holes in the code for a year is ridiculous.

> Realistically, I am not willing to release another version of WiZ that has
> the capability to zip large files, deal with 64 bits and so on when zipping,
> but is not able to deal with it when unzipping. I think that Info-ZIP would
> see a rather large amount of complaints, and a fast drop-off in usage.

I agree on that.  I just want to see a quick security release first, then
synchronize Zip and UnZip in whatever way works best for those doing the
work.

Greg