Subject: RE: remote root overflow ?

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 10 Feb 1999 17:23:54 -0500 (EST)

Guy, I hope you don't mind that I cc the list on this.

On Wed, 10 Feb 1999, Speier, Guy J - CNF wrote:

> Could you tell me a little more about VR##?

I'm going to answer with history rather than a list of features.  You can
get the features by reading the FIXES*VR* files at my ftp site; it's a
VERY long list .. print it and read it on the john tonight.

I've been on the list since before Kent started archiving it, before Stan
became maintainer, and before Koos started keeping the FAQ.  For years I
just monitored. A few years ago it seemed too few people were answering
questions, or taking too long to, so I started.  Sorta like you've been
doing recently, Guy.

One thing I noticed was people kept asking for features and Stan kept
putting them off.  Personally, I doubt he'll ever make an end to these
interminable 'beta' releases and open the daemon to development again.

Back when beta-17 came out I'd had enough.  I decided to start collecting
the patches, rolling them together, and offering them up to anyone
interested.  I started with a 100% review of the ENTIRE archive of the
mailing list.  From that I gleaned every feature request, bug report or
patch EVER offered.  To that list I added Stan's TODO list.  Ever since
I've been plowing through that list (it's a LONG list), and working to fix
bugs injected or otherwise noted along the way.

The first who VR sets were against Beta-17.  They're in my attic if you're
interested in them (don't bother though).  When Stan released beta-18, I
rolled every change he didn't already have into VR3, the first set for
beta-18.

Originally, I was only releasing patch files.  By the time it got to VR5 I
realized that it was asking too much of people to download all those files
and apply them all, so I started offering a pre-patched tarball.

At about the same time Bernard started picking up my patches and including
what he could in BeroFTPD.  Since then, he and I have corresponded
regularly about features and bugfixes so our patches don't cause too many
CVS conflicts for the other's tree.  Mainly it's a one-way pipe, though,
he takes my patches and works on the new features which I see no reason
for the base release to support (at least until the RFC comes out).  The
fix for realpath, however, is an example my my taking work Bernard had
done and back-porting it into the base daemon.

Over time, a number of people started sending reports and fixes directly
to me.  Shortly after VR9 came out, Ayamura Kikuchi <[email-masked]>
set up a majordomo list at one of his sites in Japan where those of us
working on the VR series, or building binaries for my releases, may
correspond.  It's a closed list; if I think someone should be on it, I let
them know.

Originally, I was pushing out a release twice a month.  With VR10 I
switched to a once-a-month schedule.  This is because, with others
involved, I need to give them some time to get real work done and, well
frankly, I'm approaching the end of my TODO list and what's left is the
hard stuff for which I don't have any submitted patches so I need more
time to work on it.

Right now, I'm working on VR14.  Mainly this will be a security release
fixing the PASV port race as best it can be fixed and still be speaking
FTP.  There's a few other fixes I'll be adding, all having to do with
buffer overruns or other security matters.

> How do I install these?

If you trust pre-compile binaries (personally, I don't) and there's one
for your platform available, use it.  How?  Dunno.  I never trust 'em
myself.  If I did, I'd probably hand-copy the files into place.

I prepatch a source kit, and you can download that if you want.  That's
what I'd recommend you doing.  Installing this way is just like you've
always done it.

Otherwise, all the context-diff patch files are available.  You can
download beta-18 from Academ, then apply each patch file.  If you do that,
be sure to do them in order!  I make these patch files available so the
ultra-paranoid can see exactly what I've changed and pick-and-choose.  
This isn't for the faint-of-heart, though.  We're talking thousands of
lines of context-diffs.

> If I download the latest version of wu, is this included?

I presume you mean from Academ.  No, Stan does not include the VR patches.

A pre-patched tarball is available at my ftp site, along with the original
academ tarball and all the diffs.

> why not (if not)?

Stan's avowed policy is that he will accept no new features.  Rather then
hassle with Stan, and since I rather doubt he's doing much (if anything)
with the daemon anyway, I don't bother sending him my work.  Most of it is
new features which I know he doesn't want and I really am not inclined to
try to determine _where_ a bug crept in so I don't bother sending him bug
reports.  In a word, though: I don't think Stan cares any more.

> Do I need a recompile?

Unless you download a precompiled binary, yes.  If I were you, I'd
download the source kit and recompile.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195