[self-follow-up] At 2026-09-23T00:50:15-0500, G. Branden Robinson wrote: > None of the problems is exploitable by rendering a man page to the > terminal, to PostScript, or to PDF.
I need to modify this claim, but only slightly. None of the problems is exploitable by using a man(1) command to render a man page to the terminal, to PostScript, or to PDF, whether the man implementation is that of Colin Watson's man-db or the shell script of FreeBSD and macOS. I believe my claim to stand even if one populates the environment variables MANROFFOPT and/or MANROFFSEQ creatively. (And of course mandoc man(1) doesn't use groff at all--that's its raison d'être.) > Fellow groff developers, I ask for your attention to recently filed > "private" tickets in Savannah. If you are a member of the "groff" > group and logged in, you should be able to access the tickets > straightforwardly. > > https://savannah.gnu.org/bugs/index.php > > (If you're a member of more than one Savannah group, I expect you'll > have to select the "groff" one. I don't know for sure, because I am > not.) Ingo Schwarze kindly pointed out to me privately that the foregoing URL is not helpful if you've just logged into Savannah and haven't built up the appropriate state in your browser (via cookies, I reckon). Once you're logged in to Savannah, you can go here: https://savannah.gnu.org/projects/groff or straight to the bug tracker: https://savannah.gnu.org/bugs/?group=groff The "basic" query form is the default, and it will show you all of the nearly 500 open tickets groff has. To winnow these down, select the "Enhanced" query form, then click the "Apply" button. Next, select "Private" under the "Privacy" drop-down list and click the "Apply" button again. That will reduce the list of matching tickets dramatically. The oldest of these contains a lengthy comment from me on governance and administration issues involving tensions I perceive between security management and my preferred administrative philosophy of "radical transparency". I welcome feedback on that as much as on the technical issues, all of which I feel competent to resolve one way or another. (FORTUNE: All your hostage are belong to us.) After the immediate difficulties have passed, I hope to bring that discussion to this forum. Regards, Branden
signature.asc
Description: PGP signature
