RE: Re: Publish statement on Commons Text CVE

2022-10-24 Thread Wolfgang Jung
Dear Gary, I’ve sent this exact problem on Dec. 11 2021 to the mail-address mentioned on the above change security page: secur...@commons.apache.org But never received a response… Therefore my question: Is this mail-address still correct? Best regards (and glad, that the default behaviour will

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-24 Thread Alex Herbert
On Sun, 23 Oct 2022 at 14:09, Gary D. Gregory wrote: > > Ah, well, let's have you review git master now and feel free to refactor. I > think we are close if not done for another RC. WDYT? Since this thread was for the RC1 vote I started a new thread titled: [csv] validation of duplicate

Re: Re: Publish statement on Commons Text CVE

2022-10-24 Thread Gary Gregory
Wow, the email issue with the .invalid email address is on the Apache side (DMARC). Gary On Mon, Oct 24, 2022, 14:54 Gary Gregory wrote: > The problem is that you sent your message from what I assume is a bogus > email reply address: p...@wolfgang-jung.net.invalid > > To reply to this email I

Re: Publish statement on Commons Text CVE

2022-10-24 Thread Gary Gregory
Wow, I had no idea we did this, sure is painful to deal with :-( Gary On Mon, Oct 24, 2022, 15:10 Mark Thomas wrote: > On 24/10/2022 19:54, Gary Gregory wrote: > > The problem is that you sent your message from what I assume is a bogus > > email reply address: p...@wolfgang-jung.net.invalid >

Re: Publish statement on Commons Text CVE

2022-10-24 Thread Mark Thomas
On 24/10/2022 19:54, Gary Gregory wrote: The problem is that you sent your message from what I assume is a bogus email reply address: p...@wolfgang-jung.net.invalid No, the ".invalid" was added by the ASF mail servers. See: https://blogs.apache.org/infra/entry/dmarc_filtering_on_lists_that

Re: Re: Publish statement on Commons Text CVE

2022-10-24 Thread Gary Gregory
The problem is that you sent your message from what I assume is a bogus email reply address: p...@wolfgang-jung.net.invalid To reply to this email I had to hand edit the reply to and am guessing that maybe p...@wolfgang-jung.net will reach you, but, who knows... I usually don't bother fiddling

Re: JEXL Security

2022-10-24 Thread Mark Thomas
On 24/10/2022 17:02, Henri Biestro (Apache) wrote: Hello Commons; JEXL-381 is an attempt at making JEXL's default more secure or at least less 'permeable' wrt to the application/platform/JVM/file-system/host that runs it. Based on JexlPermissions - a crude security visibility manager -, this

JEXL Security

2022-10-24 Thread Henri Biestro (Apache)
Hello Commons; JEXL-381 is an attempt at making JEXL's default more secure or at least less 'permeable' wrt to the application/platform/JVM/file-system/host that runs it. Based on JexlPermissions - a crude security visibility manager -, this restricts the *default* behavior of what is visible to

RE: Re: Publish statement on Commons Text CVE

2022-10-24 Thread Wolfgang Jung
Dear Gary, I’ve sent this exact problem on Dec. 11 2021 to the mail-address mentioned on the above changed security page: secur...@commons.apache.org But never received a response… Therefore my question: Is this mail-address still correct? Best regards (and glad, that the default behaviour