Re: Libre Office Development Compared to OpenOffice Development

[FR web forum]

>but you need to innovate
What kind of innovating did you talking about?
If you have some ideas, you can propose to Bugzilla as feature or enhancement.

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Proposal: AOO 4.2.0

[FR web forum]

Hello dev,
Is it possible to provide an explicit release date for next 4.2.0?
To avoid a previous denigration campaign like for 4.1.2.

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Proposal: AOO 4.2.0

[donaldupre .]

+1 a roadmap is a must.

On Sat, Jan 16, 2016 at 1:53 PM, FR web forum  wrote:

> Hello dev,
> Is it possible to provide an explicit release date for next 4.2.0?
> To avoid a previous denigration campaign like for 4.1.2.
>
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
>
>

Re: Libre Office Development Compared to OpenOffice Development

[donaldupre .]

Hard to see that happens as MS is a sponsor of ASF... :
http://www.apache.org/foundation/thanks.html

On Fri, Jan 15, 2016 at 5:45 PM, Chuck Davis  wrote:

> But I agree that
> open source needs to take the innovation prize away from MS.
>
>
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
>
>

Re: [REPORT] Issue Clearance Quality + Technical Debt

[donaldupre .]

Very interesting, thank you.
Perhaps the reduced activity is an indication for the saturation state of
the project (i.e. all the possible bugs and features already exist in
Bugzilla)?
Is it possible to compare this information with other office suites?

On Fri, Jan 15, 2016 at 9:22 PM, Dennis E. Hamilton 
wrote:

> [BCC to Project Management Committee and users@ oo.a.o]
>
> SUMMARY
>
> The top-level analysis of Bugzilla issue handling has been completed for
> all issues opened on the project through December 31, 2015.
>
> The complete tabulation is in the PDF document at  >.
>
> It remains the case that since the establishment of Apache OpenOffice as
> an ASF Top Level Project in November, 2012, the accrual of unresolved
> issues exceeds 40%.  That is, for every 100 new issues, on the average more
> than 40 of them will be unresolved indefinitely.
>
> In contrast, although there is a very large number of unresolved issues
> that remain in the Bugzilla from its history as part of OpenOffice.org,
> that previous technical debt was, proportionally, under 20%.
>
> Some highlights:
>
>  * Even though the monthly rate of new issues and comments on issues has
> been decreasing significantly since mid-2014, the rate of technical debt as
> the proportion of unresolved issues has not improved.
>
>  * Although a reduction to 35% unresolved-issue is seen in the last 5
> months of 2015, this may be distorted by issues created and then resolved
> in the staging of AOO 4.1.2 release candidates and QA on the candidates.
> Results for the first-quarter of 2016 are needed to determine if this is a
> new trend or a hiccup.
>
> DETAIL AND QUALITY MATTERS
>
> This is a rough analysis, although the consistent trend is difficult to
> explain away.
>
> Refinement requires a closer look at the nature of issues and
> understanding of exactly what resolution means, not just what being left
> unresolved means.
>
> There is also a suspected disconnect with regard to what is considered an
> issue and how the ways of closing an issue are actually applied.
>
>  * Closing of a new issue as a duplicate qualifies as a resolution.  The
> incidence of long-standing issues that continue to receive duplicate
> reports is useful to understand in this case, and that requires more detail.
>
>  * Some issues are closed as Resolved Fixed when the fact of the matter is
> that there was insufficient detail to understand and confirm the issue and
> the reporting party failed to provide additional information (if it was
> even requested).
>
>  * Some comments on issues tailgate possibly-different problems onto known
> ones, although the resemblance may be superficial and the issues need to be
> split.
>
>  * Enhancement/feature requests are not distinguished.
>
>  * Resolved issues are sometimes closed without obtaining confirmation
> that incorporation of the identified resolution in distributed code
> actually addresses the originally-reported difficulty.
>
>  * Some issue reports are closed as not issues because they are declared
> user problems and kicked to the Community Forum.
>
> These may all have small effects.  We will know only by looking more
> closely into Bugzilla details.
>
> The last case deserves more careful attention.
>
> The next-in-line users of Apache OpenOffice distributions consist of
> around 50 million users who are mainly individuals and 87% of whom are
> using Microsoft Windows.  Such casual users, whatever their limited
> experience in trouble-shooting and describing problems, are the main users
> of this software.  The usability issues they encounter are important to the
> project; even though they may not involve bugs in the code, they point to
> defects in the product.  Capturing those experiences and recognizing them
> as real issues for the user community is important.  That feedback is
> important for determining and making available workarounds and advice.  It
> can also inform changes to the software that might ameliorate those
> difficulties for non-experts.  Here's a simple example: having an
> easy-to-use option for resetting the user profile.
>
> FUTURE STEPS
>
> Along with extending the current analysis into the first quarter of 2016,
> exploration of the nature of unresolved and resolved issues will be
> introduced.
>
>
>  - Dennis
>
>
>
>
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
>
>

Re: Remove NSS from xmlsecurity - alternatives?

[Damjan Jovanovic]

On Sat, Jan 16, 2016 at 12:16 AM, Kay Schenk  wrote:

>
> On 01/15/2016 12:18 AM, Damjan Jovanovic wrote:
> > Hi
> >
> > I believe we now have enough evidence that a serious issue, #125431,
> where
> > AOO lies that the password for encrypted files is wrong when it isn't, is
> > caused by a failure in NSS:
> > * deliberately corrupting the Mozilla profile reproduces the issue on all
> > operating systems
> > * a patch I've written that reimplements xmlsecurity digest functions
> using
> > OpenSSL instead of NSS, allows encrypted documents to open despite a
> > corrupted Mozilla profile
> > * someone with the issue on FreeBSD reported my patch fixes it
> >
> > Always having been category B and now also commonly breaking in the
> field,
> > it's past time for NSS to go. But this brings me to my question: what do
> we
> > replace it with?
> >
> > We already use OpenSSL for some things, and my patch which uses it is
> > enough to fix the problem with opening encrypted files. Its license suits
> > us better. Our libxmlsec library can use it in place of NSS.
>
> Thank you for your work on this. I am certainly in favor of just
> using OpenSSL assuming it won't cause backward compatibly issues.
>
> >
> > Java has a rich cryptographic API and is widely used for cryptography. It
> > is however an optional dependency to AOO. It also needs the unlimited
> > strength JCE policy files to use AES-256, but there are workarounds.
> >
> > Are there more?
> >
> > The important differences are:
> > * NSS has passed FIPS-140 validation (
> > https://wiki.mozilla.org/FIPS_Validation). OpenSSL hasn't really (
> > https://www.openssl.org/docs/fipsnotes.html) while Java supposedly has (
> >
> http://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/FIPS.html
> ).
> > Do we care?
> > * We use certificate verification (for what, digitally signed
> documents?).
> > This means we need access to the root certificates of all the CAs.
> Securely
> > updating, expiring and revoking CA certificates across 40 million users
> is
> > a problem we should rather delegate to someone else. Currently, we are
> > using MSCrypto on Windows, and Thunderbird's/Firefox's certificates (via
> > NSS) on other platforms. OpenSSL doesn't come with a list of CA
> > certificates. Java does, but I don't know whether "This file is
> encrypted,
> > please install Java to open it" will fly.
> >
> > Maybe we could combine them. Use OpenSSL for most of xmlsecurity, and
> fall
> > back to Java when available for its certificates? Or keep NSS but scale
> it
> > down to only dealing with certificates, and use something else for
> > implementing other xmlsecurity features?
> >
> > Thank you
> > Damjan
> >
>

I came to the conclusion NSS was probably chosen for FIPS-140 compliance,
the root CA certificates, and the UI in Thunderbird/Firefox for configuring
digital certificates system-wide on many platforms, and since it does a lot
and no other crypto library really has all those features, it's best to
debug and fix our NSS usage for now and consider the other options later.
Which I did in r1724971:

#i125431# "The Password is incorrect. The file cannot be opened."

Fix a serious cross-platform regression caused during SeaMonkey's removal
and first released in version 4.1.0, where all features provided by NSS
(like opening and saving encrypted documents, digital signatures, etc.)
were failing.

SYSTEM_MOZILLA doesn't exist any more, yet was being used to check whether
to skip loading nssckbi when SECMOD_HasRootCerts() is true, so we were
always attempting to load it even when not necessary. Also with
SYSTEM_MOZILLA skipping loading it from the system path, we were
always trying to load it from "${OOO_BASE_DIR}/program/libnssckbi.so"
even when it wasn't there because --with-system-nss was passed to
./configure.

This patch fixes the above problems by using SYSTEM_NSS instead of
SYSTEM_MOZILLA, which actually exists, now both skipping loading
nssckbi when unnecessary, and loading it from the right place
when necessary.

Now let's release that to our users in 4.2.0 soon?

Regards
Damjan

RE: Remove NSS from xmlsecurity - alternatives?

[Dennis E. Hamilton]

Great work!

Considering the nature of the issue, where users have important files they can 
no longer open, I would think getting it into an early maintenance release 
(e.g., a 4.1.3) along with many other fixes that don't impact UI, localization, 
documentation, etc., would be a preferable solution.

This does not seem to be the kind of problem to hold back to a feature release.

 - Dennis

> -Original Message-
> From: Damjan Jovanovic [mailto:dam...@apache.org]
> Sent: Saturday, January 16, 2016 05:26
> To: Apache OO 
> Subject: Re: Remove NSS from xmlsecurity - alternatives?
> 
[ ... ]
> Which I did in r1724971:
> 
> #i125431# "The Password is incorrect. The file cannot be opened."
> 
> Fix a serious cross-platform regression caused during SeaMonkey's
> removal
> and first released in version 4.1.0, where all features provided by NSS
> (like opening and saving encrypted documents, digital signatures, etc.)
> were failing.
> 
> SYSTEM_MOZILLA doesn't exist any more, yet was being used to check
> whether
> to skip loading nssckbi when SECMOD_HasRootCerts() is true, so we were
> always attempting to load it even when not necessary. Also with
> SYSTEM_MOZILLA skipping loading it from the system path, we were
> always trying to load it from "${OOO_BASE_DIR}/program/libnssckbi.so"
> even when it wasn't there because --with-system-nss was passed to
> ./configure.
> 
> This patch fixes the above problems by using SYSTEM_NSS instead of
> SYSTEM_MOZILLA, which actually exists, now both skipping loading
> nssckbi when unnecessary, and loading it from the right place
> when necessary.
> 
> Now let's release that to our users in 4.2.0 soon?
> 
> Regards
> Damjan


-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Proposal: AOO 4.2.0

[Andrea Pescetti]

FR web forum wrote:

Is it possible to provide an explicit release date for next 4.2.0?


I believe that, to continue with a reasonable and sustainable pace, the 
next release should (in theory) be targeted to February.


We don't lack code at the moment, since in 4.1.2 we included only a 
fraction of the new code developments we had by then, and we now have more.


There are many issues to address and discuss, but the only blocker I see 
at the moment is with localization. We still need to look at integrating 
translations from Pootle (that are in large part already completed for 
4.2.0). Once that is done, planning becomes possible.


Regards,
  Andrea.

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

RE: [REPORT] Issue Clearance Quality + Technical Debt

[Dennis E. Hamilton]

> -Original Message-
> From: donaldupre . [mailto:donaldu...@gmail.com]
> Sent: Saturday, January 16, 2016 04:51
> To: dev@openoffice.apache.org; orc...@apache.org
> Subject: Re: [REPORT] Issue Clearance Quality + Technical Debt
> 
> Very interesting, thank you.
> Perhaps the reduced activity is an indication for the saturation state
> of
> the project (i.e. all the possible bugs and features already exist in
> Bugzilla)?
[orcmid] 

That's an interesting idea.  

I don't know how to test that with the data that we have.  


> Is it possible to compare this information with other office suites?
> 
[orcmid] 

I don't know.  I haven't looked for such information and I am not aware of any 
form it might be available in.  

Considering how different projects can be, I am not certain what lessons might 
transfer from one to another.  

Do you envision how having such information would be helpful in assessing the 
effectiveness of this project's handling of reported issues and how that is 
reflected in improvements to the product?


> On Fri, Jan 15, 2016 at 9:22 PM, Dennis E. Hamilton 
> wrote:
> 
> > [BCC to Project Management Committee and users@ oo.a.o]
> >
> > SUMMARY
> >
> > The top-level analysis of Bugzilla issue handling has been completed
> for
> > all issues opened on the project through December 31, 2015.
> >
> > The complete tabulation is in the PDF document at
>  > >.
> >
[ ... ]


-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Proposal: AOO 4.2.0

[Marco A.G.Pinto]

Hello Andrea,

I have been adding words to the pt_PT autocorrect XML:
DocumentList.xml

So far I have added around 80-90 words.

I would like to update the official 2010 version of the file with my 
version before AOO 4.2.0 is released.


What is the correct procedure? I know how to pack the files and rename 
to acor_pt-PT.dat .


I also noticed that LO 5 seems to have the same little words of AOO 
(pt_PT) but it has over 1000 entries of special symbols.


PS-> It will take months to add all the words from my grammar books 
which means that AOO 4.2.0 will only have some of the words.


Thanks!

Kind regards,
 >Marco A.G.Pinto
   ---


On 16/01/2016 17:57, Andrea Pescetti wrote:

FR web forum wrote:

Is it possible to provide an explicit release date for next 4.2.0?


I believe that, to continue with a reasonable and sustainable pace, 
the next release should (in theory) be targeted to February.


We don't lack code at the moment, since in 4.1.2 we included only a 
fraction of the new code developments we had by then, and we now have 
more.


There are many issues to address and discuss, but the only blocker I 
see at the moment is with localization. We still need to look at 
integrating translations from Pootle (that are in large part already 
completed for 4.2.0). Once that is done, planning becomes possible.


Regards,
  Andrea.





--

Re: Proposal: AOO 4.2.0

[Andrea Pescetti]

Marco A.G.Pinto wrote:

I would like to update the official 2010 version of the file with my
version before AOO 4.2.0 is released.


For sure this is not going to happen tomorrow. So we can go through 
Bugzilla normally.



What is the correct procedure? I know how to pack the files and rename
to acor_pt-PT.dat .


Open an issue, attach your new file and assign it to me. Note that this 
has nothing to do with the updates from Pootle I mentioned, so this is a 
"routine" update, like updating a dictionary.



PS-> It will take months to add all the words from my grammar books
which means that AOO 4.2.0 will only have some of the words.


No problem: being a "routine" update, it can be done at every release 
(like, for example, at any 4.2.x release that might exist in future).


Regards,
  Andrea.

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: License status of code from forum.openoffice.org without headers

[Andrea Pescetti]

Carl Marcum wrote:

On 01/15/2016 07:20 PM, Carl Marcum wrote:

Can code like this be used as-is in an Apache project?
[1] https://forum.openoffice.org/en/forum/viewtopic.php?t=2520


Your best option is probably to contact the author and ask him for 
permission to use under the Apache License 2 the code he posted in forum 
discussions. Failing that, it's hard to tell what license applies to 
that code due to the several infrastructure and policy changes over the 
last 8 years.



I forgot to mention I tried the "Policies and Terms of Use" link on the
main page that linked to [2] and got  404 page not found.
[2] http://www.openoffice.org/terms_of_use


I think that page has moved to https://openoffice.apache.org/terms.html 
; can somebody confirm it before we update the link in the Forum site 
footer, please?


Regards,
  Andrea.

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: License status of code from forum.openoffice.org without headers

[Carl Marcum]

On 01/16/2016 04:43 PM, Andrea Pescetti wrote:

Carl Marcum wrote:

On 01/15/2016 07:20 PM, Carl Marcum wrote:

Can code like this be used as-is in an Apache project?
[1] https://forum.openoffice.org/en/forum/viewtopic.php?t=2520


Your best option is probably to contact the author and ask him for 
permission to use under the Apache License 2 the code he posted in 
forum discussions. Failing that, it's hard to tell what license 
applies to that code due to the several infrastructure and policy 
changes over the last 8 years.



I forgot to mention I tried the "Policies and Terms of Use" link on the
main page that linked to [2] and got  404 page not found.
[2] http://www.openoffice.org/terms_of_use


I think that page has moved to 
https://openoffice.apache.org/terms.html ; can somebody confirm it 
before we update the link in the Forum site footer, please?


Regards,
  Andrea.


Thanks Andrea,

I was able to contact the author and they were very gracious.  I have 
been granted permission to use the code under the Apache 2.0 license.


Thanks,
Carl

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: [REPORT] Issue Clearance Quality + Technical Debt

[Dave Fisher]

In line

Sent from my iPhone

> On Jan 16, 2016, at 10:22 AM, Dennis E. Hamilton  wrote:
> 
> 
> 
>> -Original Message-
>> From: donaldupre . [mailto:donaldu...@gmail.com]
>> Sent: Saturday, January 16, 2016 04:51
>> To: dev@openoffice.apache.org; orc...@apache.org
>> Subject: Re: [REPORT] Issue Clearance Quality + Technical Debt
>> 
>> Very interesting, thank you.
>> Perhaps the reduced activity is an indication for the saturation state
>> of
>> the project (i.e. all the possible bugs and features already exist in
>> Bugzilla)?
> [orcmid] 
> 
> That's an interesting idea.  
> 
> I don't know how to test that with the data that we have.  

I concur with the idea. That the saturation point has to do with overall 
activity level. When the level of Contribution dropped after November 2014 
technical debt accelerated. Compare the overall commit / bugzilla resolution 
levels with number of contributors multiplied by the average size of the 
contribution.


> 
> 
>> Is it possible to compare this information with other office suites?
> [orcmid] 
> 
> I don't know.  I haven't looked for such information and I am not aware of 
> any form it might be available in.  
> 
> Considering how different projects can be, I am not certain what lessons 
> might transfer from one to another.  
> 
> Do you envision how having such information would be helpful in assessing the 
> effectiveness of this project's handling of reported issues and how that is 
> reflected in improvements to the product?

An interesting comparison might include counting the the size of contributions 
of those who are paid by their day job to work on the project. A count of 
students and retirees would be interesting metrics as well.

Strict development comparisons are only fair to a point. For example the forums 
are hosted by the ASF and the volunteers and community answer all questions 
about any part of the OpenOffice / ODF ecosystem.

Regards,
Dave

> 
> 
>> On Fri, Jan 15, 2016 at 9:22 PM, Dennis E. Hamilton 
>> wrote:
>> 
>>> [BCC to Project Management Committee and users@ oo.a.o]
>>> 
>>> SUMMARY
>>> 
>>> The top-level analysis of Bugzilla issue handling has been completed
>> for
>>> all issues opened on the project through December 31, 2015.
>>> 
>>> The complete tabulation is in the PDF document at
>>  [ ... ]
> 
> 
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
> 

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org