Subject: wu-ftpd lastest version

From: Guiming Ye <[email-masked]>
Date: Tue, 23 Mar 1999 11:00:12 -0800

Hi:
 I 'm living in CA, I'm trying download lastest version, I tried many
time to download it from ftp.academ.com. but their ftp server was down
for many days. Anybody know which site I can go? thank you!
-- 
----------------WorldRes, Inc---------------
Guiming Ye
Unix System Administrator
Tel:650-372-1700(176)      Fax:650-372-1701
E-mail:[email-masked] or [email-masked]
--------------------------------------------

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 23 Mar 1999 14:26:42 -0500 (EST)

> for many days. Anybody know which site I can go? thank you!

The location of the latest version of wu-ftpd can be found in the 
directory
 
      ftp://ftp.vr.net/pub/wu-ftpd/
 
wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd FAQ:              http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

-- 

there are three 'current verions' of wu-ftpd.

2.4.2 (final) is the newest release, but the oldest and buggiest; I mean
there's been no changes to is for nearly a year and the only real change
was to fix the bug reported by CERT.  other than that, it's old, crufty
and should only be used for historical research.

2.4.2-VR16 is the most-current classic wu-ftpd version.  there are a lot
of new featrures and bug fixes.

BeroFTPD 1.3.4 is the most-current NEWVIRT wu-ftpd version.  it includes
many of the VR updates (ISTM more are coming as Bernard gets time) as well
as the NEWVIRT hosting changes.  Technilogically BeroFTPD is the most
up-to-date; supporting FTP-SEC and mlst-06-draft (to some extent).  It
also builds using GNU autoconf instead of the old 'build' command.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Dave Wreski <[email-masked]>
Date: Tue, 23 Mar 1999 19:26:51 -0500 (EST)

> of new featrures and bug fixes.

Are the academ people no longer maintaining the 'classic' version?

Thanks,
Dave

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 23 Mar 1999 22:05:10 -0500 (EST)

On Tue, 23 Mar 1999, Dave Wreski wrote:

> > 2.4.2-VR16 is the most-current classic wu-ftpd version.  there are a
> > lot of new featrures and bug fixes.
> 

They have not said they are not.

-- 

#pragma rant

They also have not been doing much, if any work.

IMHO the only reason Stan put out 2.4.2 (final) was because of the CERT
advisory.  If you look through the mailing list archives, you'll find his
last posting was a promise to release 2.4.2 (final) at the end of
September, 1998.  Judging from the change dates, it looks like he intended
to make that date then just never did anything until a couple weeks after
the CERT advisory.  (By comparison, I release a VR update on the 1st of
each month with whatever's been fixed/update/rolled in at the time; and
occassionally do a mid-month release if there's a critical need for it.)

Research in the mailing list archives will also reveal a few things.
First, that Stan doesn't post very much.  As I recall he was on the
mailing list before the arvhives were started and posted a bit back then.
Looking through the archives, you will see he's only posted 161 messages
over the 5 1/2 years the archives cover.  (Heck, I post that much almost
every month.)

Carefull research will show the problem had been known, discussed (albeit
quietly), and fixes announced for BeroFTPD and VR versions several months
earlier but Stan didn't update because of that discussion.

You will also find there was a posting on the mailing list of a prerelease
of the Netect advisory (from which Cert issued its Advisory) well over a
month before public annoncement.  As I understand it, Netect posted its
prerelease announcement to the mailing list because they had received _no_
response from Stan.  If he'd been watching at all, Stan certainly had
plenty of time to get a fix out, but instead waited until _after_ the CERT
advisory to make his updates.  All I can say to that is at least he got a
fix out before someone publicly posted a working exploit.  (If you read
the CERT/Netect advisories you'll see I provided the information for major
flavors of wu-ftpd .. including BeroFTPD, although they didn't mention
that.)

You will also note, when looking through the archives, that Stan never
_announced_ 2.4.2 (final).  Someone showed me he'd put 2.4.2 (final) on
the academ ftp site, so _I_ announced it with my VR16 update for it (which
came out the evening I learned about the released version).

Finally, when it's working (it seems to be up and down a bit), connect to
ftp.academ.com and note the version number Stan's running (beta-18).  I
believe the reason _he's_ not running 2.4.2 (final) is it has a subtle
runtime error causing his version to roll over and die; but more likely he
simply doesn't care enough even to update his own production server.  
(You will note ftp.vr.net has been running VR17 and that won't even be
released until April 1.)

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Dave Wreski <[email-masked]>
Date: Tue, 23 Mar 1999 20:24:35 -0500 (EST)

[...]

> occassionally do a mid-month release if there's a critical need for it.)

Thanks for the info, and I really appreciate your staying on top of this.

Regards,
Dave Wreski

---

From: Russ Allbery <[email-masked]>
Date: 23 Mar 1999 20:39:27 -0800

[...]

Have you asked Stan if he'd be willing to just have you take over as the
official maintainer?

(Oh, BTW, there have been some Kerberos patches for wu-ftpd floating
around for a long time that let one do GSSAPI Kerberos 5.  As near as I
can tell, they haven't been integrated; is there a possibility that they
could be eventually?  I can try to dig up the location if there's
interest.)

-- 
Russ Allbery ([email-masked])         <URL:http://www.eyrie.org/~eagle/>

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Mar 1999 07:15:44 -0500 (EST)

On 23 Mar 1999, Russ Allbery wrote:

> Have you asked Stan if he'd be willing to just have you take over as
> the official maintainer?

My position is that neither Stan, Bernard nor I have *ANY* say in the
matter.  The ones who determine who is the 'maintainer' are _you_; you
vote with your (virtual) feet.

> around for a long time that let one do GSSAPI Kerberos 5.  As near as
> I can tell, they haven't been integrated; is there a possibility that
> they could be eventually?  I can try to dig up the location if there's
> interest.)

The location is easy: BeroFTPD 1.3.4

--

---

From: Russ Allbery <[email-masked]>
Date: 24 Mar 1999 19:40:28 -0800

> vote with your (virtual) feet.

While I think that's a great stance to take, the point I was driving at is
a bit different.  There's this software package called "wu-ftpd" which has
now had what appears to be a "final" release.  There's a separate patch
set to it that you maintain, but the patched ftp daemon is still called
"wu-ftpd"; it just has VR patches.

Given that the previous maintainers of wu-ftpd don't appear to be
interested in continuing to maintain it, and given that you're maintaining
what is essentially the wu-ftpd source base, wouldn't it be a good idea to
just get wustl and Academ to decide that you're the maintainer and then
release your current patch set as wu-ftpd 2.5?  It would make for shorter
version numbers, and it would reduce general confusion and the amount of
understanding that's required to figure out what the "current" version of
wu-ftpd is.

We had, at one point, version numbers for wu-ftpd that involved *three*
layers of beta patches, patches from a different institution, and then
patches from a third institution on top of those.  While with the final
release this has gotten a lot simpler, it strikes me as a fairly difficult
version numbering system to navigate, and given that the VR patches appear
to be the current active development of the wu-ftpd source base (as
opposed to the various other forked development paths), it would eliminate
a lot of bother to just call your source base wu-ftpd.

> The location is easy: BeroFTPD 1.3.4

Ah, okay.  Thanks.  I didn't realize they'd been integrated into that
version.

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Mar 1999 23:29:57 -0500 (EST)

> a lot of bother to just call your source base wu-ftpd.

Are you asking my opinion, or suggesting a course of action?

I've run my project on suggestions from users.  Mainly from open postings
on this mailing list.  Very occassionally from private conversations.
(Yes, there's a mailing list for VR-only purposes, but it's main use is so
I can tell the testers when it's time to test and the builders when it's
time to build.  What changes are discussed there are usually from builders
suggesting changes so the daemon will compile cleanly on their targets.)

I have had private suggestions along the lines of what you're suggesting.
I have also been doing quite a bit of work beyond simply working on the
code.  The results of that work await only one thing: the desire of the
user community for a change.  While some are aware of what else I've been
working on, I expect most will be pleasently surprised.

Until it is clear to me a desire for a change of maintainers exists, I
plan to continue to work as I have been and offer support to as many
versions of the daemon as I can.  Quite frankly, the VR updates are simply
my score-card of where things have needed expansion or correction.

My opinion is that no maintainer is such because he claims it.  The
maintainer is who the users say he is.  If the general consensus (or, at
least, concensus by lack of objection) is that someone else is the
maintainer; then that person is the maintainer.

The original author was 'maintainer' because he wrote the software.  A few
months after he'd left Stan volunteered to gather together the Hobbit and
other patches and put together a release.  Hearing no objections, he
became the de-facto 'maintainer'.  Some time later, wu-stl 'made it
official' by updating the README file on their original 2.4 tarball at
their site.

Now, it seems, Stan's all but gone.  Fine.  We've been here before.  The
last time Stan was seemingly gone someone (namely Bernard and Andy)
stepped forward to volunteer to be 'maintainers'.  That raised several
loud objections from the user community, and caused Stan to put in one of
his rare appearances to defend his position.  While I disagreed with their
approach, I agreed totally with their goals; Stan's lack of interest in
the package is manifest.  Last year, the appearent consensus was that Stan
should remain maintainer.  In both public and private conversations,
Bernard (Andy gave up in disgust and disappeared) was prevailed upon to
change the name/version of his daemon from wu-ftpd-2.6.<something> to
BeroFTPD; effectively splitting off to become a completely new daemon.

If the consensus is that the VR updates are causing confusion, as much as
I dislike it (just as Bernard did), I will change the name to something
else as well.

In closing: it's your ftp site, your daemon.  The problem is in your lap.
If you decide I'm the maintainer, then I'm the maintainer and nothing Stan
or wu-stl say will change that.

--

---

From: Russ Allbery <[email-masked]>
Date: 24 Mar 1999 20:51:57 -0800

> Are you asking my opinion, or suggesting a course of action?

Good question.  Reading over your current stance on this and the way
you're handling it, I'm content.  I think you're dealing with it quite
well, and agree with your approach.

So I suppose what I'm doing is registering my opinion that you're the
current maintainer as far as I'm concerned.  I'm content to wait and see
how that develops and let you judge the consensus, as you're in a much
better place to do so than I am.

> If the consensus is that the VR updates are causing confusion, as much
> as I dislike it (just as Bernard did), I will change the name to
> something else as well.

No, I wasn't meaning to imply that.  If anything, the presence of a static
and unchanging 2.4.2 base version is causing confusion.  Please don't feel
like you need to rename your maintenance of the wu-ftpd source base to
something else.

---

From: Chad Price <[email-masked]>
Date: Thu, 25 Mar 1999 08:40:45 -0600

>Gregory A Lundberg <[email-masked]> wrote:
>or wu-stl say will change that.

My vote is to ignore Stan and release your VR series as wu-ftpd-2.5 and the
monthlies as 2.5.1, 2.5.2... until a "significant" change occurs and then
2.6,...

You might want to consider merging lines with Bero, but only if you can do
it in a way which does not break existing configurations.

My $0.02

Chad

Chad Price
Systems Manager
University of Nebraska Medical Center
600 S 42nd St
Omaha, NE 68506-6495
[email-masked]
(402) 559-9527 
(402) 559-4077 (FAX)

---

From: "Michael Bryan" <[email-masked]>
Date: Thu, 25 Mar 1999 08:41:08 -0800

>working on, I expect most will be pleasently surprised.

Well, you can't expect to offer a lead-in like that and not generate
interest!  What exactly is it that you have in mind?  Let us know, and
then we'll tell you how we feel about it!  (Given your track record, I
suspect the reaction will be quite positive.)

>or wu-stl say will change that.

Add me to the list of voices that say you are (and have been) the de-facto
maintainer.  Bundle up the VR patches at either VR17 or VR18, and call
it wu-ftpd 2.5, and we'll go on from there.  I wish Stan well, he was a good
driving force for quite some time, but it's time the baton was passed on
to somebody who's been active for the last year.  Optimally, this should
also get Stan's blessing, and a link from the Academ site to your site, and
I hope that this can happen, but even if it doesn't, I'm fairly certain nearly
everyone will accept you as the official maintainer anyway.

Michael Bryan
[email-masked]