[uom][math][numbers] Request for feedback on Units of Measurement library

2020-04-02 Thread Thomas Neidhart
Hi all, recently I had more time to work on open source and I always wanted to work on a fully typed Units of Measurements library. My initial results can be found here: https://github.com/netomi/uom Its already fully functional, I am working on more unit tests, documentation and as many units

Re: [collections] An order statistic tree

2016-03-22 Thread Thomas Neidhart
On Fri, Mar 18, 2016 at 2:23 PM, Rodion Efremov < rodio...@cs.helsinki.fi.invalid> wrote: > Hello, all. > I would like to announce that I have a java.util.Set implementation that > is an order statistic tree (all non-bulk operations + select + rank in > O(log n) time) [1]. However, it seems like

Re: [math] Staging site

2016-03-21 Thread Thomas Neidhart
On 03/21/2016 07:32 PM, Evan Ward wrote: > Hi, > > I'm on step 19 in Release.howto.txt, I've committed the updated site > using svn, but I get a 404 when I try to view it at > http://commons.staging.apache.org/proper/commons-math > > Any ideas what I'm doing wrong? I've noticed that the staging

Re: [math] questions on GA

2016-03-18 Thread Thomas Neidhart
On 03/18/2016 02:12 PM, Семенов Кирилл wrote: >> >> In effect, some time ago we evoked the possibility to drop GA support >> altogether since the code seemed little used and a lot of work was >> anticipated for making it useful beyond demo applications. > > > It is rather surprising, that ASF

Re: [all] apologies

2016-02-09 Thread Thomas Neidhart
On Mon, Feb 8, 2016 at 9:13 PM, Phil Steitz wrote: > I am sorry for the bad tone of my recent posts here. Not the nicest > way to leave and I am sorry for that. > Hi Phil, nothing that you have written is worth an apology, although I can understand your disappointment

Re: [math] [POLL] new TLP name

2016-02-04 Thread Thomas Neidhart
On Thu, Feb 4, 2016 at 2:24 PM, Phil Steitz <phil.ste...@gmail.com> wrote: > On 2/2/16 11:44 AM, Thomas Neidhart wrote: > > On 02/01/2016 06:06 PM, Phil Steitz wrote: > >> Please select your top choice among the following suggested names > >> for the new [

Fwd: Re: svn commit: r12178 - in /release/commons/collections: binaries/ source/

2016-02-02 Thread Thomas Neidhart
Forwarded Message Subject: Re: svn commit: r12178 - in /release/commons/collections: binaries/ source/ Date: Tue, 2 Feb 2016 19:07:08 +0100 From: Thomas Neidhart <thomas.neidh...@gmail.com> To: comm...@commons.apache.org On 02/02/2016 07:03 PM, s...@apache.org wrote: &g

Re: [math] [POLL] new TLP name

2016-02-02 Thread Thomas Neidhart
On 02/01/2016 06:06 PM, Phil Steitz wrote: > Please select your top choice among the following suggested names > for the new [math]-based TLP. All are welcome and encouraged to > respond. This POLL will be open for 72 hours, at which time two > tallies will be presented: one among those who

Re: [math] Name of the new TLP

2016-01-25 Thread Thomas Neidhart
On 01/25/2016 09:27 PM, Gary Gregory wrote: > On Jan 25, 2016 10:11 AM, "Emmanuel Bourg" wrote: >> >> Le 25/01/2016 18:52, Gilles a écrit : >> >>> AFAICT, the real issue is one of policy: Commons is supposed to be > stable, >>> stable, stable and stable (IIUC). >>> >>> And CM

Re: [math] Volunteer for the new TLP PMC

2016-01-25 Thread Thomas Neidhart
On Sun, Jan 24, 2016 at 9:54 PM, Phil Steitz wrote: > Please respond to this thread if you are a Commons Committer > interested in joining the PMC for the new TLP based on [math]. > Hi Phil, thanks for pushing this whole issue! I am happy to volunteer for the new PMC to

Re: [VOTE] Form a separate TLP based on [math]

2016-01-17 Thread Thomas Neidhart
On 01/16/2016 04:18 PM, Phil Steitz wrote: > The discussion has thus far been generally favorable. I would like > therefore to put the proposal to split [math] out into a separate > TLP to a VOTE. Assuming a favorable vote, we can discuss how to go > about doing it. Votes, please. All are

Re: [Math] Revamping the "random" package or ...

2016-01-17 Thread Thomas Neidhart
On 01/17/2016 02:34 PM, Gilles wrote: > On Sun, 17 Jan 2016 10:56:38 +0100, Luc Maisonobe wrote: >> Le 16/01/2016 16:51, Gilles a écrit : >>> Hi. >>> >>> Context: nobody gave an opinion on the arguments which I put >>> forward in these posts: >>> http://markmail.org/message/uiljlf63uucnfyy2 >>>

Re: [math] TLP

2016-01-15 Thread Thomas Neidhart
On Thu, Jan 14, 2016 at 1:50 AM, Phil Steitz wrote: > I would like to propose that we split [math] out into a top level > project at the ASF. This has been proposed before, and I have > always come down on the side of staying in Commons, but I am now > convinced that it

Re: [Math] Add 64-bits based RNG (Was: [Math] New base class for all RNGs)

2016-01-11 Thread Thomas Neidhart
On Mon, Jan 11, 2016 at 1:10 PM, Gilles <gil...@harfang.homelinux.org> wrote: > On Mon, 11 Jan 2016 07:47:40 +0100, Thomas Neidhart wrote: > >> On 01/10/2016 05:09 AM, Gilles wrote: >> >>> Hi. >>> >>> Relevant excerpt of previous

Re: [Math] Add 64-bits based RNG (Was: [Math] New base class for all RNGs)

2016-01-10 Thread Thomas Neidhart
On 01/10/2016 05:09 AM, Gilles wrote: > Hi. > > Relevant excerpt of previous posts: > >>> [...] >>> >>> Something implicit in "BitStreamGenerator": the maximum number of >>> bits is 32 (cf. return type of "next(int)" and the ubiquitous use >>> of hard-coded "32". >>> >>> What about the

Re: [VOTE][RC2] Release Commons Math 3.6

2016-01-05 Thread Thomas Neidhart
On 01/02/2016 09:15 PM, Luc Maisonobe wrote: > This is a [VOTE] for releasing Apache Commons Math 3.6 from release > candidate 2. > > Tag name: > MATH_3_6_RC2 (signature can be checked from git using 'git tag -v') > > Tag URL: > >

Re: [Math] About the refactoring of RNGs

2015-12-29 Thread Thomas Neidhart
On 12/29/2015 05:10 PM, Gilles wrote: > On Tue, 29 Dec 2015 10:33:15 +0100, Luc Maisonobe wrote: >> Hi all, >> >> Le 29/12/2015 09:21, Thomas Neidhart a écrit : >>> On 12/29/2015 04:33 AM, Phil Steitz wrote: >>>> On 12/28/15 8:08 PM, Gilles wrote: >

Re: [math] releasing 3.6

2015-12-29 Thread Thomas Neidhart
On 12/29/2015 07:39 PM, Luc Maisonobe wrote: > Hi all, > > A few weeks ago, I proposed to release 3.6. There were two > points I wanted to address before that, both related to > ODE. These points are now completed: the Adams methods > stability issues have been fixed, and a bunch a field-based >

Re: [Math] About the refactoring of RNGs (Was: [01/18] [math] MATH-1307)

2015-12-29 Thread Thomas Neidhart
On 12/29/2015 04:33 AM, Phil Steitz wrote: > On 12/28/15 8:08 PM, Gilles wrote: >> On Mon, 28 Dec 2015 11:08:56 -0700, Phil Steitz wrote: >>> The significant refactoring to eliminate the (standard) next(int) >>> included in these changes has the possibility of introducing subtle >>> bugs or

Re: [Math] Exceptions from "JDKRandomGenerator"

2015-12-23 Thread Thomas Neidhart
On 12/21/2015 04:41 AM, Gilles wrote: > On Sat, 19 Dec 2015 11:35:26 -0700, Phil Steitz wrote: >> On 12/19/15 9:02 AM, Gilles wrote: >>> Hi. >>> >>> While experimenting on >>> https://issues.apache.org/jira/browse/MATH-1300 >>> I created a new >>> JDKRandomGeneratorTest >>> that inherits from

Re: [Math] Exceptions from "JDKRandomGenerator"

2015-12-23 Thread Thomas Neidhart
On 12/23/2015 05:39 PM, Gilles wrote: > On Wed, 23 Dec 2015 16:26:52 +0100, Thomas Neidhart wrote: >> On 12/21/2015 04:41 AM, Gilles wrote: >>> On Sat, 19 Dec 2015 11:35:26 -0700, Phil Steitz wrote: >>>> On 12/19/15 9:02 AM, Gilles wrote: >>>>> Hi. >

Re: [math] Refactored Precision

2015-12-14 Thread Thomas Neidhart
On Mon, Dec 14, 2015 at 9:17 AM, Ole Ersoy wrote: > Hi, > > Just a heads up for those of you interested or have nothing better to do > at 2 am :). I refactored the Precision class into classes PrecisionAssert > and RoundDouble. > >

Re: [collections][site] publish security-report? (was: svn commit: r1719350 - /commons/proper/collections/trunk/src/site/xdoc/security-reports.xml)

2015-12-11 Thread Thomas Neidhart
On 12/11/2015 01:16 PM, Bernd Eckenfels wrote: > Hello, > > I added a second CVE to the de-serialisation security-report for > ACC, I dont have the infrastrcuture handy to push the site, can > somebody do that, please? fixed the respective html directly on the site repository. Thomas

Re: [math] MATH 4 requires at least java 7, build also the MATH_3_X branch.

2015-12-03 Thread Thomas Neidhart
e9b78 > > Diff: http://git-wip-us.apache.org/repos/asf/commons-math/diff/25de9b78 > > > > Branch: refs/heads/master > > Commit: 25de9b7800887c12365f6a19b13cf32baf5bfe2f > > Parents: 7afc1c3 > > Author: Thomas Neidhart <thomas.neidh...@gmail.com&g

Re: [math] Adding badges

2015-12-02 Thread Thomas Neidhart
On 12/02/2015 08:29 PM, Luc Maisonobe wrote: > Le 02/12/2015 09:57, Thomas Neidhart a écrit : >> Hi, >> >> recently I added some badges (building on travis, code coverage with >> coveralls, license tag, latest available version from maven) to >> collections,

[math] Adding badges

2015-12-02 Thread Thomas Neidhart
Hi, recently I added some badges (building on travis, code coverage with coveralls, license tag, latest available version from maven) to collections, which can be seen here: https://github.com/apache/commons-collections Any objection to add the same for math? The travis integration can be quite

Re: [VOTE] Release Configuration 2.0-beta2 based on RC1

2015-12-02 Thread Thomas Neidhart
On 12/01/2015 10:25 PM, Oliver Heger wrote: > Hi all, > > to continue the current series of releases, this is a vote for the > second beta version of [configuration] 2.0 based on the first release > candidate. After beta1 was released in June there has been some feedback > which lead to some

[collections] Next Steps after 4.1 release

2015-12-01 Thread Thomas Neidhart
Hi all, we have just released a new version of the collections component and I wanted to start a discussion about the future of this component. In the past years I spent some time to clean up the component and also add a few things that I found worth the effort (which I tend to use in my day

[ANNOUNCEMENT] Apache Commons Collections 4.1 Released

2015-11-27 Thread Thomas Neidhart
The Apache Commons team is pleased to announce the release of Apache Commons Collections 4.1. The release is available for download at http://commons.apache.org/proper/commons-collections/download_collections.cgi Apache Commons Collections is a project to develop and maintain collection classes

[VOTE][RESULT] Release Commons Collections 4.1 Based on RC2 (24h vote)

2015-11-26 Thread Thomas Neidhart
Voting was as follows: +1 (binding) Luc Maisonobe Joerg Schaible Oliver Heger Phil Steitz Gary Gregory Thomas Neidhart There were no other votes. The vote therefore passes. Thanks to all who voted. Thomas - To unsubscribe

Re: [VOTE] Release Commons Collections 4.1 Based on RC1

2015-11-25 Thread Thomas Neidhart
On 11/25/2015 11:30 AM, Jörg Schaible wrote: > Hi Thomas, > > Thomas Neidhart wrote: > >> On 11/24/2015 11:30 PM, Jörg Schaible wrote: >>> Hi Thomas, >>> >>> Thomas Neidhart wrote: > > [snip] > >> These test failures exist since th

[CANCEL][VOTE] Release Commons Collections 4.1 Based on RC1

2015-11-25 Thread Thomas Neidhart
On 11/22/2015 11:26 PM, Thomas Neidhart wrote: > Hi all, > > we have accumulated enough changes since the last 4.0 release as well as > we need to provide a fix for the known remote code exploit via java > de-serialization. Therefore, I would like to start a vote to release > C

[VOTE] Release Commons Collections 4.1 Based on RC2 (24h vote)

2015-11-25 Thread Thomas Neidhart
Hi all, we have accumulated enough changes since the last 4.0 release as well as we need to provide a fix for the known remote code exploit via java de-serialization. Therefore, I would like to start a vote to release Commons Collections 4.1 based on RC2. Note: * The fix for the security

Re: [CANCEL][VOTE] Release Commons Collections 4.1 Based on RC1

2015-11-25 Thread Thomas Neidhart
On 11/25/2015 09:04 PM, Gary Gregory wrote: > On Wed, Nov 25, 2015 at 11:40 AM, Thomas Neidhart <thomas.neidh...@gmail.com >> wrote: > >> On 11/22/2015 11:26 PM, Thomas Neidhart wrote: >>> Hi all, >>> >>> we have accumulated enough changes s

Re: [VOTE] Release Commons Collections 4.1 Based on RC1

2015-11-24 Thread Thomas Neidhart
On 11/22/2015 11:26 PM, Thomas Neidhart wrote: > Hi all, > > we have accumulated enough changes since the last 4.0 release as well as > we need to provide a fix for the known remote code exploit via java > de-serialization. Therefore, I would like to start a vote to release > C

Re: [JXPATH] Java Version

2015-11-24 Thread Thomas Neidhart
On 11/24/2015 09:55 PM, Uwe Barthel wrote: >> I've updated JXPATH to Java 7. There is a lot of work to update the code >> base to use Java 7 languages features and APIs. I invite everybody to join >> me here… > > Do you like to start these changes before or after the release 1.4? > I prefer to

Re: [VOTE] Release Commons Collections 4.1 Based on RC1

2015-11-24 Thread Thomas Neidhart
On 11/24/2015 11:30 PM, Jörg Schaible wrote: > Hi Thomas, > > Thomas Neidhart wrote: > >> Hi all, >> >> we have accumulated enough changes since the last 4.0 release as well as >> we need to provide a fix for the known remote code exploit via java >>

Re: svn commit: r1716090 - in /commons/proper/collections/trunk: .travis.yml README.md pom.xml

2015-11-24 Thread Thomas Neidhart
Actually, it does not work yet, as I can not enable commons-collections on travis. I already sent an email to them, but did not get an answer yet. How did you manage to do it for commons-lang? Thomas On Tue, Nov 24, 2015 at 5:36 PM, Benedikt Ritter wrote: > Nice! > >

Re: [VOTE] Release Commons Collections 4.1 Based on RC1

2015-11-23 Thread Thomas Neidhart
On 11/23/2015 09:53 PM, Oliver Heger wrote: > The Maven build worked fine with Java 1.6 and 1.7 on Windows 10. With > Java 1.8 I get the following compilation error in test classes: > > [ERROR] COMPILATION ERROR : > [INFO] - > [ERROR] >

[VOTE] Release Commons Collections 4.1 Based on RC1

2015-11-22 Thread Thomas Neidhart
Hi all, we have accumulated enough changes since the last 4.0 release as well as we need to provide a fix for the known remote code exploit via java de-serialization. Therefore, I would like to start a vote to release Commons Collections 4.1 based on RC1. Note: The fix for the security related

Re: [VOTE] Release Validator 1.5.0 based on RC1

2015-11-22 Thread Thomas Neidhart
On 11/19/2015 10:48 AM, sebb wrote: > It's probably about time to release VALIDATOR. > There have been quite a few improvements and fixes since the last version. > > == > > Validator 1.5.0 RC1 is available for review here: > https://dist.apache.org/repos/dist/dev/commons/validator/ (svn >

Re: [VOTE] Release NET 3.4 based on RC2 - resend with corrected tag

2015-11-22 Thread Thomas Neidhart
On 11/22/2015 04:58 PM, sebb wrote: > It's probably about time to release NET. > There have been quite a few improvements and fixes since the last version. > > [This is a repeat of the original mail, but using a tag that actually > exists this time] > > == > > Net 3.4 RC2 is available for

Re: [COLLECTIONS] Release road map for 4.1

2015-11-21 Thread Thomas Neidhart
On 11/21/2015 11:45 AM, Uwe Barthel wrote: > Hi, > > How is the road map for the 4.1 release or is there a plan to provide 4.0.1? the plan is to start the release process tomorrow. There is only one issue open that needs to be resolved for a 4.1 release, and I am working on it. Thomas

[collections] Review of MultiValuedMap interface & implementations

2015-11-19 Thread Thomas Neidhart
Hi, we had to remove the use of reflection in the MultiValuedMap implementations (due to COLLECTIONS-580), which required a huge effort to refactor the various implementations. Now, there are only strongly typed implementations: * ArrayListValuedHashMap * HashSetValuedHashMap that do not

Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

2015-11-16 Thread Thomas Neidhart
The problem is that the resulting manifest will be different for the ant and maven builds (as for most other components). Thomas On Mon, Nov 16, 2015 at 12:18 PM, Emmanuel Bourg <ebo...@apache.org> wrote: > Le 16/11/2015 12:07, Thomas Neidhart a écrit : > > Would it be much e

Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

2015-11-16 Thread Thomas Neidhart
plugins configured). Thomas On Mon, Nov 16, 2015 at 11:46 AM, Thomas Neidhart <thomas.neidh...@gmail.com > wrote: > Hi, > > I did not test the ant build, but I explicitly removed the MANIFEST.MF as > this has to be created by the relevant plugins as setup in the > commons-p

Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

2015-11-16 Thread Thomas Neidhart
Hi, I did not test the ant build, but I explicitly removed the MANIFEST.MF as this has to be created by the relevant plugins as setup in the commons-parent.pom (especially for proper OSGI metadata). I will take a look this evening how to mitigate this. Thomas On Mon, Nov 16, 2015 at 11:19 AM,

[ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

2015-11-15 Thread Thomas Neidhart
The Apache Commons team is pleased to announce the release of Apache Commons Collections 3.2.2. The release is available for download at http://commons.apache.org/proper/commons-collections/download_collections.cgi Apache Commons Collections is a project to develop and maintain collection

Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

2015-11-15 Thread Thomas Neidhart
On 11/15/2015 11:23 PM, Thomas Neidhart wrote: should have been an ANNOUNCEMENT, but it's late, sorry. Thomas - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h

[RESULT][VOTE] Release Commons Collections 3.2.2 Based on RC3

2015-11-14 Thread Thomas Neidhart
On 11/13/2015 12:31 AM, Thomas Neidhart wrote: > Hi all, [snip] > Considering that this is a security related release and that RC2 did not > show any functional problems with the release, I plan to close this vote > in 24h from now, i.e. after 0100 GMT 14-November 2015 Her

Re: [RESULT][VOTE] Release Commons Collections 3.2.2 Based on RC3

2015-11-14 Thread Thomas Neidhart
On 11/14/2015 04:20 PM, Uwe Barthel wrote: > Thx Thomas. > > The fix for the Java serialization vulnerability is on the way. > Now should we add some information on > http://commons.apache.org/security.html like Commons Compress did? yes, we will do something similar. Thomas

Re: [VOTE] Release Commons Collections 3.2.2 Based on RC3

2015-11-13 Thread Thomas Neidhart
;, version: "6.1", arch: "amd64", family: "windows" > > and: > > Apache Ant(TM) version 1.9.6 compiled on June 29 2015 > > Gary > > On Thu, Nov 12, 2015 at 3:31 PM, Thomas Neidhart <thomas.neidh...@gmail.com> > wrote: > >>

Re: [VOTE] Release Commons Collections 3.2.2 Based on RC2

2015-11-12 Thread Thomas Neidhart
On 11/12/2015 07:14 PM, Jörg Schaible wrote: > Hi Thomas, > > Thomas Neidhart wrote: > >> Hi all, >> >> in order to provide a work-around for the known remote code exploit via >> java de-serialization of malicious InvokerTransformer instances, I would >&g

[CANCEL][VOTE] Release Commons Collections 3.2.2 Based on RC2

2015-11-12 Thread Thomas Neidhart
On 11/11/2015 05:27 PM, Thomas Neidhart wrote: > Hi all, > > in order to provide a work-around for the known remote code exploit via > java de-serialization of malicious InvokerTransformer instances, I would > like to start a vote to release Commons Collections 3.2.2 based on

[VOTE] Release Commons Collections 3.2.2 Based on RC3

2015-11-12 Thread Thomas Neidhart
Hi all, in order to provide a work-around for the known remote code exploit via java de-serialization of malicious InvokerTransformer instances, I would like to start a vote to release Commons Collections 3.2.2 based on RC3. Notes: * the site will not be published, it just serves as a

[VOTE] Release Commons Collections 3.2.2 Based on RC2

2015-11-11 Thread Thomas Neidhart
Hi all, in order to provide a work-around for the known remote code exploit via java de-serialization of malicious InvokerTransformer instances, I would like to start a vote to release Commons Collections 3.2.2 based on RC2. Notes: * the site will not be published, it just serves as a

[CANCEL][VOTE] Release Commons Collections 3.2.2 Based on RC1

2015-11-11 Thread Thomas Neidhart
On 11/09/2015 11:37 PM, Thomas Neidhart wrote: > Hi all, > > in order to provide a work-around for the known remote code exploit via > java de-serialization of malicious InvokerTransformer instances, I would > like to start a vote to release Commons Collections 3.2.2 based on RC

Re: [VOTE] Release Commons Collections 3.2.2 Based on RC1

2015-11-10 Thread Thomas Neidhart
On 11/10/2015 09:59 PM, Luc Maisonobe wrote: > Le 09/11/2015 23:37, Thomas Neidhart a écrit : >> Hi all, >> >> in order to provide a work-around for the known remote code exploit via >> java de-serialization of malicious InvokerTransformer instances, I would >>

Re: [VOTE] Release Commons Collections 3.2.2 Based on RC1

2015-11-10 Thread Thomas Neidhart
homas > > There is also the issue of the possibly wrong revision being tagged or > being used in the VOTE email thread. That can be fixed for RC2 as well. > > Gary > > On Mon, Nov 9, 2015 at 2:37 PM, Thomas Neidhart <thomas.neidh...@gmail.com> > wrote: > >>

Re: invoker-defender Java agent

2015-11-09 Thread Thomas Neidhart
On 11/09/2015 12:34 PM, Eirik Bjørsnøs wrote: > Hi, > > Following the "recent" "news" about Java deserialization security issues, I > decided to create: > > https://github.com/kantega/invoker-defender/ > > This is a Java Agent which removes java.io.Serializable from classes known > to be

[VOTE] Release Commons Collections 3.2.2 Based on RC1

2015-11-09 Thread Thomas Neidhart
Hi all, in order to provide a work-around for the known remote code exploit via java de-serialization of malicious InvokerTransformer instances, I would like to start a vote to release Commons Collections 3.2.2 based on RC1. I would kindly ask people to review the RC especially wrt the following

Re: [collections] Review of proposed fix for InvokerTransformer exploit

2015-11-09 Thread Thomas Neidhart
On Mon, Nov 9, 2015 at 10:37 AM, Emmanuel Bourg <ebo...@apache.org> wrote: > Le 08/11/2015 23:21, Thomas Neidhart a écrit : > > > please review the proposed fix for this issue here: > > The exception message ends with a comma, is this a typo? I suggest > men

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-08 Thread Thomas Neidhart
On 11/07/2015 11:19 AM, Mark Thomas wrote: > On 07/11/2015 10:13, Thomas Neidhart wrote: >> On 11/07/2015 04:25 AM, Bernd Eckenfels wrote: >>> Hello, >>> >>> I tried to raise that concern in the message already, but it is probably >>> worth re

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-08 Thread Thomas Neidhart
On 11/08/2015 01:32 PM, Mark Thomas wrote: > On 08/11/2015 10:18, Thomas Neidhart wrote: >> On 11/07/2015 11:19 AM, Mark Thomas wrote: >>> On 07/11/2015 10:13, Thomas Neidhart wrote: >>>> On 11/07/2015 04:25 AM, Bernd Eckenfels wrote: >>>>> Hel

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-08 Thread Thomas Neidhart
On 11/08/2015 09:11 PM, James Carman wrote: > How did we get to the point where someone could invoke arbitrary bytecode? Take a look at class TemplatesImpl in com.sun.org.apache.xalan.internal.xsltc.trax which is part of the oracle and openjdk jre. It is serializable and can load so called

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-08 Thread Thomas Neidhart
On 11/08/2015 07:51 PM, James Carman wrote: > Couldn't they use the same attack vector to set a system property also? I > do believe that would be possible for this you need a way to execute code via a de-serialized class. Right now, the simplest way to do so is via the InvokerTransformer. There

[collections] Review of proposed fix for InvokerTransformer exploit

2015-11-08 Thread Thomas Neidhart
Hi all, please review the proposed fix for this issue here: http://svn.apache.org/viewvc?view=revision=1713307 Thanks, Thomas - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail:

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-08 Thread Thomas Neidhart
On 11/08/2015 08:20 PM, James Carman wrote: > I think this entire thing can be prevented with a security manager and a > proper policy in place. Nobody does that, though You cannot prevent the use of reflection for public methods via a SecurityManager. If you then look at the different provided

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-08 Thread Thomas Neidhart
On 11/08/2015 09:36 PM, James Carman wrote: > Oh nasty! I must've met, this is quite a fascinating exploit. I'm going to > do some digging later today when I am at my computer. I just figured that the xalan code already does have a system property to prevent translets from being de-serialized:

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-07 Thread Thomas Neidhart
On 11/07/2015 04:25 AM, Bernd Eckenfels wrote: > Hello, > > I tried to raise that concern in the message already, but it is probably > worth repeating it explicitly: this is not a real bug > in the Commons-Collection class, and it might not be worse fixing it, as > there are possibly tons of

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-06 Thread Thomas Neidhart
On 11/06/2015 10:25 PM, Bernd Eckenfels wrote: > ello, > > I came across this article: > > http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ > > It describes attacks against common Java applications

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

2015-11-06 Thread Thomas Neidhart
On 11/07/2015 12:56 AM, Thomas Neidhart wrote: > On 11/06/2015 10:25 PM, Bernd Eckenfels wrote: >> ello, >> >> I came across this article: >> >> http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-

Re: [math] releasing 3.6 ?

2015-11-04 Thread Thomas Neidhart
On 11/04/2015 10:13 AM, luc wrote: > Hi all, > > I would like to release 3.6 in the upcoming weeks. > There have been a bunch of bug fixes and a few evolutions that are > important to me. > > I am still working on two things both related to ode: first trying > to stabilize the Adams-BAshforth

Re: [RESULT] [VOTE] Accept Naomi

2015-11-04 Thread Thomas Neidhart
On 11/04/2015 03:37 AM, Phil Steitz wrote: > Here is a tally of the VOTE > > Commons PMC: > +1 from Dave Brosius, Luc Maisonobe, Phil Steitz, Joerg Schaibl, > Oliver Heger, Gary Gregory, Niall Pemberton > +0 from BenediKt Ritter > -0 from > -1 from Emmanuel Bourg, Mark Thomas, James Carman > >

Re: [Math] Utilization of Lombok

2015-09-28 Thread Thomas Neidhart
On 09/28/2015 06:14 AM, venkatesha murthy wrote: > Do we know if lombok is supported on all flavours of java for instance IBM > JDK, Open JDK , java 8 etc... > > Was just thinking of the future proof readiness. > > Iam absolutely interested in lombok and even today use it for most demo >

Re: [Math] Utilitzation of SLF4J?

2015-09-26 Thread Thomas Neidhart
On 09/26/2015 02:33 AM, Gilles wrote: > On Fri, 25 Sep 2015 16:52:26 -0700, Hasan Diwan wrote: >> On 25 September 2015 at 16:47, Gilles <gil...@harfang.homelinux.org> >> wrote: >> >>> On Fri, 25 Sep 2015 17:30:33 +0200, Thomas Neidhart wrote: >>> >

Re: [Math] Utilitzation of SLF4J?

2015-09-26 Thread Thomas Neidhart
On 09/26/2015 01:11 PM, Gilles wrote: > On Sat, 26 Sep 2015 09:53:30 +0200, Thomas Neidhart wrote: >> On 09/26/2015 02:33 AM, Gilles wrote: >>> On Fri, 25 Sep 2015 16:52:26 -0700, Hasan Diwan wrote: >>>> On 25 September 2015 at 16:47, Gilles <gil...@

Re: [Math] Utilitzation of SLF4J?

2015-09-25 Thread Thomas Neidhart
On Fri, Sep 25, 2015 at 5:09 PM, Gilles <gil...@harfang.homelinux.org> wrote: > On Fri, 25 Sep 2015 07:28:48 -0700, Phil Steitz wrote: > >> On 9/25/15 7:03 AM, Gilles wrote: >> >>> On Fri, 25 Sep 2015 15:54:14 +0200, Thomas Neidhart wrote: >>> >&

Re: [Math] Utilization of Lombok

2015-09-25 Thread Thomas Neidhart
On 09/25/2015 05:04 PM, Ole Ersoy wrote: > Hi Thomas, > > On 09/25/2015 08:45 AM, Thomas Neidhart wrote: >> Hi Ole, >> >> can you explain why you think that the addition of lombok brings any >> benefit to our users? > Sure - I'm looking at the Levenbe

Re: [Math] Utilization of Lombok

2015-09-25 Thread Thomas Neidhart
Hi Ole, can you explain why you think that the addition of lombok brings any benefit to our users? >From my point of view, lombok can help developers by taking over some tedious tasks, but this is quite irrelevant in the case of CM as the majority of work goes into algorithm design and

Re: [Math] Utilitzation of SLF4J?

2015-09-25 Thread Thomas Neidhart
Hi Ole, for a start, I think you are asking the wrong question. First of all we need to agree that we want to add some kind of logging facility to CM. If the outcome is positive, there are a handful of alternatives, some of them more viable than slf4j in the context of CM (e.g. JUL or

Re: [Math] Compile only top-level package and below

2015-09-04 Thread Thomas Neidhart
On 09/04/2015 03:08 PM, Gilles wrote: > Hello. > > There are two branches for Commons Math. > > For one, the top-level Java package is > org.apache.commons.math4 > For the other, it is > org.apache.commons.math3 > > Unless I'm mistaken, this should imply that maven tries to compile > only

Re: [math] random boolean arrays

2015-07-12 Thread Thomas Neidhart
On 07/11/2015 09:43 PM, Phil Steitz wrote: On 7/11/15 12:29 PM, Thomas Neidhart wrote: On 07/11/2015 09:08 PM, Phil Steitz wrote: The code implemented in MATH-1242 to improve performance of KS monteCarloP in-lines efficient generation of random boolean arrays. Unfortunately, I think

Re: [math] random boolean arrays

2015-07-12 Thread Thomas Neidhart
On 07/12/2015 04:58 PM, Phil Steitz wrote: On 7/12/15 2:50 AM, Thomas Neidhart wrote: On 07/11/2015 09:43 PM, Phil Steitz wrote: On 7/11/15 12:29 PM, Thomas Neidhart wrote: On 07/11/2015 09:08 PM, Phil Steitz wrote: The code implemented in MATH-1242 to improve performance of KS monteCarloP

Re: [math] random boolean arrays

2015-07-11 Thread Thomas Neidhart
On 07/11/2015 09:08 PM, Phil Steitz wrote: The code implemented in MATH-1242 to improve performance of KS monteCarloP in-lines efficient generation of random boolean arrays. Unfortunately, I think the implementation is not quite random (see comments on the ticket). To verify it, we need to

Re: svn commit: r1688303 - /commons/proper/collections/trunk/src/changes/changes.xml

2015-06-30 Thread Thomas Neidhart
On 07/01/2015 01:08 AM, sebb wrote: On 29 June 2015 at 21:41, t...@apache.org wrote: Author: tn Date: Mon Jun 29 20:41:17 2015 New Revision: 1688303 URL: http://svn.apache.org/r1688303 Log: Add reference to parent ticket. Modified:

Re: [DISCUSS] Karma necessary for Release Manager roles

2015-06-23 Thread Thomas Neidhart
On 06/23/2015 05:59 PM, sebb wrote: The default karma needed for committing to the SVN dist/release/TLP areas is membership of the LDAP PMC group. This can be changed to be membership of the LDAP committer group if required. I'm not sure about the current karma needed for Nexus upload, it

Re: [Math] Nearest neighbors search

2015-06-23 Thread Thomas Neidhart
On Fri, Jun 19, 2015 at 3:56 PM, Gilles gil...@harfang.homelinux.org wrote: Hi. Referring to the newly created MATH-1235. I was looking for a way to improve the performance of a code that also needs, for some point p, to select the n closest neighbours (from a list of sample data points).

Re: porting fixes to v 3.2.X

2015-06-21 Thread Thomas Neidhart
On 06/19/2015 05:41 PM, Marc-André Chartrand wrote: Can bug fixes from version 4.0 be ported to v 3.2.X ? and also, when is the next 3.2.X version coming out ? The fix I'm looking at in particular is : https://issues.apache.org/jira/browse/COLLECTIONS-294 Which is only fixed in 4.0

Re: [LANG][COLLECTIONS] Require a static function to swap 2 elements in a array (primitive as well non-primitive)

2015-06-18 Thread Thomas Neidhart
Hi, I think such a feature belongs to the ArrayUtils class in lang. Thomas On Thu, Jun 18, 2015 at 5:08 AM, venkatesha murthy venkateshamurth...@gmail.com wrote: Hi All I was looking to ArrayUtils(version 3.4) to hopefully find a swap method . Is this some thing available else where or

Re: [VOTE] Release Configuration 2.0-beta1 based on RC1

2015-06-17 Thread Thomas Neidhart
On 06/14/2015 10:10 PM, Oliver Heger wrote: Hi all, this is a vote for the first beta version of [configuration] 2.0 based on the first release candidate. After two alpha versions, it is now time to move to a beta version. Since the last alpha version, there has only be a small change: an

Re: Finding a Place to Help

2015-06-16 Thread Thomas Neidhart
On 06/16/2015 07:21 PM, Landon Blake wrote: I'm interested in helping a bit with Jakarta Commons. Is there anyone currently working on the BeanUtils or Collections modules? What about the image IO modules? We are currently in the progress of making a new release for collections and could need

Re: Pool 2.4 jar SNAFU is possible for all components

2015-05-30 Thread Thomas Neidhart
On 05/30/2015 10:16 PM, Gary Gregory wrote: I am wondering if we need an updated build process here. At work, in a large Ant based project, we run unit tests against the jars files built earlier by the build. We ship jars, not class files, so we test jars. It seems like a basic design

Re: [collections] FluentIterable

2015-05-27 Thread Thomas Neidhart
On 05/27/2015 06:52 PM, Gary Gregory wrote: Let's not reinvent the wheel indeed. This is not about reinventing the wheel or reimplementing Java 8 streams. The rationale is to glue together existing functionality in collections by a fluent API, very much the same as already exists in guava or

[collections] FluentIterable

2015-05-26 Thread Thomas Neidhart
Hi, today, I have committed a first version of a FluentIterable (COLLECTIONS-464). Example usage: ListString result = FluentIterable .of(1, 2, 3, 4, 5, 6, 7, 8, 9, 10) .filter(new PredicateInteger() { public boolean evaluate(Integer number) { return number % 2 == 0;

[ANNOUNCE] Commons Email version 1.4 released

2015-05-25 Thread Thomas Neidhart
Hello. The Apache Commons team is pleased to announce the release of commons-email-1.4. Commons-Email aims to provide an API for sending email. It is built on top of the JavaMail API, which it aims to simplify. Commons Email can be downloaded from the following page:

Re: [collections] Preparing a 4.1 release

2015-05-24 Thread Thomas Neidhart
On 05/24/2015 05:52 PM, Gary Gregory wrote: Why not just move to Java 7? The reason to move to Java 6 is to add support for NavigableMap, which unfortunately is missing right now. Moving to Java 7 is not really necessary, the next logical move would be to Java 8 imho. In fact it would be

[RESULT][VOTE] Release Email 1.4 Based on RC1

2015-05-23 Thread Thomas Neidhart
Hi, the vote to release Commons Email 1.4 based on RC1 passes with the following binding votes: * +1 Gary * +1 Luc * +1 Benedikt * +1 Oliver * +1 Thomas Additionally, there were the following non-binding votes: * +1 Bruno No other votes have been cast. I will continue with the release

[collections] Preparing a 4.1 release

2015-05-23 Thread Thomas Neidhart
Hi, in the next few weeks I will hopefully finish all open issues for an upcoming 4.1 release. Note: the release will also update the minimum required java version to 1.6. Thomas - To unsubscribe, e-mail:

Re: [VOTE] Release Email 1.4 Based on RC1

2015-05-19 Thread Thomas Neidhart
Default locale: en_US, platform encoding: UTF-8 OS name: linux, version: 3.13.0-49-generic, arch: i386, family: unix for which class file did you get the mentioned error? Thomas Not blocking, I am +1 for this release. Oliver Am 18.05.2015 um 22:15 schrieb Thomas Neidhart: I would like to call

  1   2   3   4   5   6   7   8   9   >