Re: Release date for Privoxy 3.0.19 stable

Lee <[email protected]> wrote:

> On 12/26/11, Fabian Keil <[email protected]> wrote:
> > Lee <[email protected]> wrote:
> >
> >> On 12/24/11, Fabian Keil <[email protected]> wrote:
> >> > While reviewing some Privoxy code, I discovered a bug that allows
> >> > a malicious server to crash Privoxy on some platforms.
> >> >
> >> > Therefore, and because of the socks4/socks4a regression reported at:
> >> > https://sourceforge.net/tracker/index.php?func=detail&aid=3464439&group_id=11118&atid=111118
> >> > I think 3.0.19 should fix those issues, contain no new features
> >> > and be released soon.
> >> >
> >> > My preferred release dates would be either Monday or next
> >> > weekend. Given the low amount of changes, I consider both
> >> > dates doable.
> >> >
> >> > Any opinions?
> >>
> >> Monday, since It sounds like a new release is merited
> >
> > I think we should wait for a response from David, though.
> 
> OK
> 
> > It also looks like next to nobody is using socks4/4a
> > with Privoxy anymore, or those that do didn't update
> > yet, so there's no need to hurry.
> 
> If the crash bug you found is in the socks4/4a code, agreed.  It would
> seem that code path is hardly ever used.

The bug was in the chunk-decoding and existed for ages
without being noticed. It can only be triggered with
intentionally malformed responses.
 
> Drat!  I went to SF to check the download numbers and it's got
>   Looking for the latest version? Download privoxy_setup_3.0.17.exe
> under the home / win32 / 3.0.18 files section.  I'll try to fix that.

I think this is controlled by the "prefer this release for platform X"
option (or whatever its called).

> >> I really miss the SF emails for changes made to the source code.  Oh
> >> well.. off to see how you fixed the socks4 problem
> >
> > Unfortunately I don't think we'll get the commit mails
> > back until we switch to another version control system
> > or leave SF.
> 
> I'll ask.  The SF admins turned a lot of stuff off when they were
> under attack.  maybe they'll turn the commit emails back on now..

I'd be surprised if you even get a meaningful answer,
but asking anyway certainly can't hurt.

Fabian

------------------------------------------------------------------------------
Write once. Port to many.
Get the SDK and tools to simplify cross-platform app development. Create 
new or port existing apps to sell to consumers worldwide. Explore the 
Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
http://p.sf.net/sfu/intel-appdev

_______________________________________________
Ijbswa-developers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ijbswa-developers

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk74q9UACgkQSMVSH78upWPMTwCffdbAIToGvucL1jaAv5khndsj
y0YAn3hSbJJlY9bY0A4ix90MQckEtme3
=DnQu
-----END PGP SIGNATURE-----