Re: veto on addition of ssl, evp code

2008-04-16 Thread William A. Rowe, Jr.
Roy T. Fielding wrote: I am kind of annoyed that a branch was done for 1.3.x before any release of 1.3.0. My opinion is that encourages folks to think of trunk as a dumping ground, which is fundamentally bad because trunk is the basis for collaboration. However, since Bill is the likely RM, I

Re: veto on addition of ssl, evp code

2008-04-15 Thread David Reid
Graham Leggett wrote: > Joe Orton wrote: > >> So again, I guess I presumed back then, and would still now, that >> these problems were understood and were going to be addressed. But >> that didn't actually happen; the problems are still there. Again, >> that is the basis of my veto. > > Yep, it

Re: veto on addition of ssl, evp code

2008-04-15 Thread Graham Leggett
Joe Orton wrote: So again, I guess I presumed back then, and would still now, that these problems were understood and were going to be addressed. But that didn't actually happen; the problems are still there. Again, that is the basis of my veto. Yep, it is still there, and that is because

Re: veto on addition of ssl, evp code

2008-04-15 Thread Roy T. Fielding
On Apr 15, 2008, at 5:55 AM, Graham Leggett wrote: The solution is simple: leave it on trunk, remove it from the v1.3.0 branch until the issues are resolved, so that the folks wanting to see v1.3.0 released are not prevented from making that happen. I don't think anybody would have objected

Re: veto on addition of ssl, evp code

2008-04-15 Thread Joe Orton
On Tue, Apr 15, 2008 at 02:55:54PM +0200, Graham Leggett wrote: > Justin Erenkrantz wrote: > >> No, as Joe said, you ignored prior comments - this isn't the first >> time that these concerns have been raised. > > I did not ignore prior comments, I responded to the comments, and my > responses were

Re: veto on addition of ssl, evp code

2008-04-15 Thread Graham Leggett
Justin Erenkrantz wrote: No, as Joe said, you ignored prior comments - this isn't the first time that these concerns have been raised. I did not ignore prior comments, I responded to the comments, and my responses were ignored. As a result of this, I had no clear indication of what further

Re: veto on addition of ssl, evp code

2008-04-15 Thread William A. Rowe, Jr.
Justin Erenkrantz wrote: No, as Joe said, you ignored prior comments - this isn't the first time that these concerns have been raised. [...] If and when you wish to address *all* of the issues, I (and I think Joe too; but I can't speak for him) will be happy to see it back on trunk. +1 - alth

Re: veto on addition of ssl, evp code

2008-04-15 Thread Jim Jagielski
On Apr 15, 2008, at 8:08 AM, Justin Erenkrantz wrote: But, releasing a half-completed API in 1.3 is extreme badness. -- justin +1... and causes extreme pain.

Re: veto on addition of ssl, evp code

2008-04-15 Thread Justin Erenkrantz
On Tue, Apr 15, 2008 at 1:18 PM, Graham Leggett <[EMAIL PROTECTED]> wrote: > To quote what Roy put into his sandbox at > https://svn.apache.org/repos/asf/httpd/sandbox/wakad/README.txt: > > "Don't knock over my castle." That's a sandbox - not something that is intended to be in a release. Please

Re: veto on addition of ssl, evp code

2008-04-15 Thread Graham Leggett
Joe Orton wrote: l) again, no demonstration that non-OpenSSL-based implementations are even possible, if an abstraction is the intent. http://msdn2.microsoft.com/en-us/library/aa380252(VS.85).aspx#csp_data_encryption_functions http://www.gnu.org/software/gnutls/comparison.html URLs != demons

Re: veto on addition of ssl, evp code

2008-04-15 Thread Joe Orton
On Mon, Apr 14, 2008 at 11:43:22PM +0200, Graham Leggett wrote: > Joe Orton wrote: >> h) the undocumented/unspecified API (e.g. in formats of cert/key files, >> naming of ciphers) is another leaky abstraction requiring the caller to >> know it using OpenSSL underneath; and hence may as well code

Re: veto on addition of ssl, evp code

2008-04-14 Thread Greg Marr
At 05:43 PM 4/14/2008, Graham Leggett wrote: If you revert this, you break mod_session_crypto, which in turn severely limits the usefulness of mod_session_cookie, which in turns limits the usefulness of mod_auth_form, which is turn limits the usefulness of httpd's powerful AAA mechanism that ha

Re: veto on addition of ssl, evp code

2008-04-14 Thread Roy T. Fielding
On Apr 14, 2008, at 2:13 PM, Ruediger Pluem wrote: On 04/14/2008 10:42 PM, Joe Orton wrote: I am also happy to do the grunt work of reversion if the authors are still unwilling to resolve these issues and don't want to (or don't have time to) do that themselves. Does this mean you revert i

Re: veto on addition of ssl, evp code

2008-04-14 Thread Graham Leggett
Joe Orton wrote: Per the other thread, the review for this has mostly been ignored. I have no wish to waste time banging my head against a wall, so I am: You raised questions after the code was committed in November 2007, and then didn't bother to follow up when those questions were answered.

Re: veto on addition of ssl, evp code

2008-04-14 Thread Ruediger Pluem
On 04/14/2008 10:42 PM, Joe Orton wrote: I am also happy to do the grunt work of reversion if the authors are still unwilling to resolve these issues and don't want to (or don't have time to) do that themselves. Does this mean you revert it on trunk or only on 1.3.x branch? If you revert

Re: veto on addition of ssl, evp code

2008-04-14 Thread David Reid
Joe Orton wrote: > Per the other thread, the review for this has mostly been ignored. I > have no wish to waste time banging my head against a wall, so I am: > > -1 on the addition of the SSL code, r415639 et al, on the basis that: > > a) the API is undocumented in basic ways for key functions;

veto on addition of ssl, evp code

2008-04-14 Thread Joe Orton
Per the other thread, the review for this has mostly been ignored. I have no wish to waste time banging my head against a wall, so I am: -1 on the addition of the SSL code, r415639 et al, on the basis that: a) the API is undocumented in basic ways for key functions; e.g. it is unspecified to wh