On Monday 29 August 2011, Dirk-WIllem van Gulik wrote: > Folks, > > How do we wrap this up in what remains of the (US) day ? > > I can have ready a final draft or a 'more mitigation' draft - of > the stay tuned type. > > Since Advisory update-2 I gotten about 5 emails with helpful (but > small) improvements for what we have; 3 with some detailed > feedback - and a lot of reports that the fixes are good enough for > most. But nothing major. > > So the only reason to sent out a update rather than a final would > be that we expect the final one to be 24+ hours -- OR if we expect > the final one to be hard for admins to roll (which we have no > indication of). > > Correct ? > > What are people their thoughts ? Fair to assume we can have in the > next 6 to 12 hours: > > - Patch for 2.2 well tested
I think what's currently in branches/2.2.x is relatively well tested. Though more testers would of course be welcome. The recommended patch is just the diff from 2.2.19 for modules/http/byterange_filter.c. > > - Backport for 2.0 - ideally well tested too > AFAIK, nobody has looked at 2.0 so far. > > Or do we need to roll a complete version (guess not) ? Any verbiage > to include on this fix not being the final one (IMHO no - IETF > pointer is good enough). > > Who is in the right timezone to carry the ball the last few meters > over the finish line? Jim offered to RM 2.2.20, but I don't know what timezone he is in. If 2.2.20 doesn't happen today, it may be good to publish the patch in an update to the advisory. But I am in the wrong timezone for that ;-)
