Subject: Re: Wu-ftpd Support

From: [email-masked] (Stan Barber)
Date: Sat, 9 May 1998 13:53:35 CDT

> So what is the story?
> 
> Is wu-ftpd in the hands of 2 dissident or still with Stan?
> 
> I HATE Hijackings!!!

I am still doing wu-ftpd work. In fact, a beta-17 is coming out in the next
couple of days that addresses a few critical problems in beta-16. The
reason I am doing that is because Andy asked me to consider doing it and
sent me some of the patches I will be releasing in beta-17. He didn't say
anything in his mail to me about taking over wu-ftpd. The announcement in
the mailing list is the first I saw about it.

To be clear, I don't care if Andy and Bernard want to do wu-ftpd development.
However, their assertion that I have apparently abandoned the work is just
flat wrong.

-- 
Stan   | Academ Consulting Services        |internet: [email-masked]
Olan   | For more info on academ, see this |uucp: mcsun!academ!sob
Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.

---

From: [email-masked] (Stan Barber)
Date: Sun, 10 May 1998 00:56:25 CDT

> Sheesh, Stan, get a life!  You're quibbling over less than two weeks out
> of, what, a 16 week period?  

No, I am not quibbling. I am trying to point out that time is relative.
Someone says that it's been 5 months, when it hasn't. Another points out
that I said I'd release after a few days and then are upset when I take
"a week and a half" to get a beta out. 

> > By the way, security bugs have always triggered a new bug release. Those
> > are critical bugs. Bugs like the ones you list are not security bugs and are 
> > therefore not critical. 
> 
> No, they just confuse users making them wonder what kind of programmer
> would make such a STUPID mistake.  Didn't you even RUN the code before you
> rolled the release?  Oh of course you did.  Didn't blow up so you shipped.
> Good QA plan there, real good.

At least you admit they are not critical. And yes, I do run the code. I even 
run it for many days. I have been known to do pre-beta releases to a limited 
set of folks to check things out. However, just like Andy and Bernhard, I do 
make mistakes. Beta-16 had more than usual for me. Unfortunately, I didn't
have the time available at the beginning of 1998 to work on getting another
release out, so I documented the bugs on the web page. I expected that folks
would be able to patch their code from that information. I was wrong. I have
admitted that and am now working on a release that will fix that.

> So, he didn't mention the fact that hidden amonst all your other mistakes
> and typos in Beta 16 was the accidental removal of all security for the
> upload directive.  But I can see your point, Stan.  File system integrity
> has nothing to do with security after all, so any problems in it can wait
> months until you get arround to looking into it.  No need to panic, Warez
> traders are so afraid of the security features of wu-ftpd they'll _never_
> notice they were accidentially removed, will they?

Have you reported this? I have a ticket 535 from you that concerns the 
interpretation of "cd ~", but that does not seem to relate to the upload
directive in the ftpaccess file. If you are going to accuse me of doing
something, at least have the courtesy of filing a bug report so that problems
can be corrected.