Re: opengrok down

2011-10-10 Thread Shao Zhi Zhao
hi, https://svn.apache.org/repos/asf/incubator/ooo is ready now, how to get the OOO340.hg file? thanks mail:zhaos...@cn.ibm.com tel:54747 Address:2/F,Ring Bldg. No.28 Building, Zhong Guan Cun Software Park, No.8, Dong Bei Wang West Road, ShangDi, Haidian District, Beijing 100193, P.R.China

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Michael Meeks
Hi Rob, On Sun, 2011-10-09 at 15:26 -0400, Rob Weir wrote: Reading binary file formats, including the legacy MS Office formats, is notoriously difficult to do robustly. Agreed. 2) That security reports should be sent to successor project's security contacts. .. 3) We should list

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 6:10 AM, Michael Meeks michael.me...@suse.com wrote: Hi Rob, On Sun, 2011-10-09 at 15:26 -0400, Rob Weir wrote: Reading binary file formats, including the legacy MS Office formats, is notoriously difficult to do robustly.        Agreed. 2) That security reports

how to access the 2 services?

2011-10-10 Thread Shao Zhi Zhao
hi, 1. how to access https://tools.services.openoffice.org/EIS2 ? 2. how to access http://hg.services.openoffice.org ? thanks mail:zhaos...@cn.ibm.com tel:54747 Address:2/F,Ring Bldg. No.28 Building, Zhong Guan Cun Software Park, No.8, Dong Bei Wang West Road, ShangDi, Haidian District,

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Rory O'Farrell
On Mon, 10 Oct 2011 07:45:34 -0400 Rob Weir robw...@apache.org wrote: Security reports come from security reporters. Can you tell us whether Red Hat, Inc. security researcher Huzaifa Sidhpurwala is a TDF member and whether he was reporting this issue under instructions from TDF? Does it

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 8:06 AM, Rory O'Farrell ofarr...@iol.ie wrote: On Mon, 10 Oct 2011 07:45:34 -0400 Rob Weir robw...@apache.org wrote: Security reports come from security reporters.  Can you tell us whether Red Hat, Inc. security researcher Huzaifa Sidhpurwala is a TDF member and

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Simon Phipps
On 10 Oct 2011, at 12:45, Rob Weir wrote: No objections if you want to start a separate invitation-only security discussion list. It would probably get some use. But we'll continue to ask for security reports to come to ooo-security.i.a.o. We appeared to reach consensus[1] on this issue

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 8:24 AM, Simon Phipps si...@webmink.com wrote: On 10 Oct 2011, at 12:45, Rob Weir wrote: No objections if you want to start a separate invitation-only security discussion list.  It would probably get some use.  But we'll continue to ask for security reports to come to

Re: Volume Issue

2011-10-10 Thread Rob Weir
Cross posting to the ooo-dev list, since they might be more familiar with server-side use of OOo. Do we know of a regression in 3.3 with resource leaks and PDF conversion? -Rob On Mon, Oct 10, 2011 at 8:12 AM, Herter, Scott scott.her...@napersoft.com wrote: OpenOffice 2.4 was tested under

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Simon Phipps
On Mon, Oct 10, 2011 at 1:42 PM, Rob Weir robw...@apache.org wrote: Yes. I've read all the emails from last week. Please can you answer my question, then, I am not interested in your argument with Meeks. S.

Re: [DISCUSS] Publishing the PPMC Roster

2011-10-10 Thread Rob Weir
On Sun, Oct 9, 2011 at 9:21 PM, Dennis E. Hamilton orc...@apache.org wrote: orcmid note=Responses to Rob's questions in-line / -Original Message- From: Rob Weir [mailto:robw...@apache.org] Sent: Sunday, October 09, 2011 17:48 To: ooo-dev@incubator.apache.org Subject: Re: [DISCUSS]

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 9:08 AM, Simon Phipps si...@webmink.com wrote: On Mon, Oct 10, 2011 at 1:42 PM, Rob Weir robw...@apache.org wrote: Yes.  I've read all the emails from last week. Please can you answer my question, then, I am not interested in your argument with Meeks. I've

Re: [DISCUSS] Publishing the PPMC Roster

2011-10-10 Thread Daniel Shahaf
Rob Weir wrote on Mon, Oct 10, 2011 at 09:10:27 -0400: we're supposed to subscribe to that list using our Apache alias. Untrue.

Re: [DISCUSS] Publishing the PPMC Roster

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 9:16 AM, Daniel Shahaf d...@daniel.shahaf.name wrote: Rob Weir wrote on Mon, Oct 10, 2011 at 09:10:27 -0400: we're supposed to subscribe to that list using our Apache alias. Untrue. Of course it is true. If you don't subscribe with something that is in the alias

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Simon Phipps
On Mon, Oct 10, 2011 at 2:15 PM, Rob Weir robw...@apache.org wrote: I've restated, in more explicit form, what I think the consensus is. It's hard to read your words that way, as they leave no room for anyone but Apache committers. The clear consensus was for collaboration with the StarOffice

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 9:24 AM, Simon Phipps si...@webmink.com wrote: On Mon, Oct 10, 2011 at 2:15 PM, Rob Weir robw...@apache.org wrote: I've restated, in more explicit form, what I think the consensus is. It's hard to read your words that way, as they leave no room for anyone but Apache

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Jürgen Schmidt
On Mon, Oct 10, 2011 at 3:51 PM, Simon Phipps si...@webmink.com wrote: On 10 Oct 2011, at 14:31, Rob Weir wrote: This are not mutually exclusive options, Simon. And I have very clearly never argued for an exclusive arrangement, Rob. It's you that has, even if now you are attempting to

RE: Vulnerability fixed in LibreOffice

2011-10-10 Thread Dennis E. Hamilton
The discussion on how ooo-security would (or would not) work, and how cooperation with other security teams would (or would not work) was quite public and visible on ooo-dev. How is it that this reciprocal action occurred and was made known to the Apache OOo podling? And how is it that it was

RE: [DISCUSS] Publishing the PPMC Roster

2011-10-10 Thread Dennis E. Hamilton
orcmid note=more comments inline -Original Message- From: Rob Weir [mailto:robw...@apache.org] Sent: Monday, October 10, 2011 06:10 To: ooo-dev@incubator.apache.org Subject: Re: [DISCUSS] Publishing the PPMC Roster On Sun, Oct 9, 2011 at 9:21 PM, Dennis E. Hamilton orc...@apache.org

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Simon Phipps
On 10 Oct 2011, at 15:55, Jürgen Schmidt wrote: On Mon, Oct 10, 2011 at 3:51 PM, Simon Phipps si...@webmink.com wrote: Back to the actual issue: * for (A), AOOo clearly needs a private security list. We all agree. * for (B), the legacy StarOffice ecosystem clearly needs a shared private

RE: Vulnerability fixed in LibreOffice

2011-10-10 Thread Dennis E. Hamilton
Concerning the continued use of securityt...@openoffice.org, there are two issues 1. It is not clear what the fate of mailing lists @openoffice.org is going to be, and whether they are reliably-operated in the meantime. It would be great to have assistance in preserving the administration of

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Simon Phipps
On 10 Oct 2011, at 16:03, Dennis E. Hamilton wrote: Now, how is détente to be achieved? I suggest by mutually agreeing a list-user-managed venue for future non-partisan collaboration in the spirit that previously existed on securityt...@openoffice.org - please see the other message I just

Re: how to access the 2 services?

2011-10-10 Thread Pedro Giffuni
Hi Shao; --- On Mon, 10/10/11, Shao Zhi Zhao zhaos...@cn.ibm.com wrote: hi, 1. how to access https://tools.services.openoffice.org/EIS2 ? 2. how to access http://hg.services.openoffice.org ? It looks like (1) had an unrecoverable error :(. For all purposes (2) is now covered by

Re: [DISCUSS] Publishing the PPMC Roster

2011-10-10 Thread Donald Whytock
On Sun, Oct 9, 2011 at 8:29 PM, Dennis E. Hamilton orc...@apache.org wrote: I have not found any visible place where Incubator PPMC rosters can be found automatically. I think it would be a good idea to have such a roster visible to the public and, especially, this list. You might want to

Re: [DISCUSS] Publishing the PPMC Roster

2011-10-10 Thread Donald Whytock
On Mon, Oct 10, 2011 at 11:31 AM, Donald Whytock dwhyt...@gmail.com wrote: You might want to migrate/extend this discussion to imcubator general.  We've been working on a standard podlings XML file that would be used in webpage generation.  A standard per-podling XML file of, among other

RE: Vulnerability fixed in LibreOffice

2011-10-10 Thread Michael Meeks
Hi Dennis, On Mon, 2011-10-10 at 08:03 -0700, Dennis E. Hamilton wrote: How is it that this reciprocal action occurred and was made known to the Apache OOo podling ? Oh - it's quite simple, you ASF/OOo made your decision to not include TDF guys, and we (without an endless mail thread)

RE: Vulnerability fixed in LibreOffice

2011-10-10 Thread Dennis E. Hamilton
Thanks for clarifying that the reciprocation was on the security @tdf list, and not securityteam@ OO.o. It was not easy to discern that from your preceding statements or any others on this thread. I certainly agree that the security @tdf can be as exclusive as it chooses. Now I think it

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 11:37 AM, Michael Meeks michael.me...@suse.com wrote: Hi Dennis, On Mon, 2011-10-10 at 08:03 -0700, Dennis E. Hamilton wrote: How is it that this reciprocal action occurred and was made known to the Apache OOo podling ?        Oh - it's quite simple, you ASF/OOo made

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Malte Timmermann
What's this thread about - OOo/AOOo/TDF private security lists war reloaded? ;) To sum up: - Apache mentors/PPMCs made clear that only AOOo committers can be on the AOOo Security list (ooo-secur...@incubator.apache.org). Regardless of whether or not this rule makes sense in this special case

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread TJ Frazier
Hi, Malte, On 10/10/2011 12:33, Malte Timmermann wrote: What's this thread about - OOo/AOOo/TDF private security lists war reloaded? ;) To sum up: - Apache mentors/PPMCs made clear that only AOOo committers can be on the AOOo Security list (ooo-secur...@incubator.apache.org). Regardless of

Fixing security lists (was: Vulnerability fixed in LibreOffice)

2011-10-10 Thread Shane Curcuru
On 10/10/2011 12:33 PM, Malte Timmermann wrote: ...snip... - Which leaves us with 1 common list where we don't have such restrictive rules, and can continue with our cooperation: The old/original OOo security list securityt...@openoffice.org. ...snip... To ask a practical question: is there

Re: [patch} removal of OS2Bitmap.cxx

2011-10-10 Thread Yuri Dario
Hi, Committed as revision 1179380, along with the odma header removal. please revert this change, I'm going to work again on OOo OS/2 port and I will change the license for OS2Bitmap.cxx I hope to not be too late... -- Bye, Yuri Dario /* * OS/2 open source software *

Re: Fixing security lists

2011-10-10 Thread Malte Timmermann
I can moderate securityt...@openoffice.org, and I have a list of current subscribers, but I can't view/modify members. The list is not part of the security project, but is a top level list in the WWW project. I will ask stx if a can give me the needed access rights. For now - maybe I can

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Malte Timmermann
Hi TJ, On 10.10.2011 18:51, TJ Frazier wrote: Assuming that you are the mt listed as an administrator on the OO.o security project, that should make you an owner of the securityteam ML. In theory - but unfortunatly the list is not but of the security project, but of the WWW project (because

Apply as committer

2011-10-10 Thread Yuri Dario
Hi all, my name is Yuri Dario and in the past years I worked on the os2 port of OpenOffice.org; that work started with OOo 2.0 until version 3.2 released last year. Now it is time to get back to OOo and update the code base to the most current level, so I'd like to be invited (is this

Re: Apply as committer

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 1:35 PM, Yuri Dario mc6...@mclink.it wrote: Hi all, my name is Yuri Dario and in the past years I worked on the os2 port of OpenOffice.org; that work started with OOo 2.0 until version 3.2 released last year. Hi Yuri, Welcome to the project and welcome to Apache!

Re: [patch} removal of OS2Bitmap.cxx

2011-10-10 Thread Pedro Giffuni
Welcome Yuri! --- On Mon, 10/10/11, Yuri Dario mc6...@mclink.it wrote: Hi, Committed as revision 1179380, along with the odma header removal. please revert this change, I'm going to work again on OOo OS/2 port and  I will change the license for OS2Bitmap.cxx I have great sympathy for

Slooooow spreadsheet documents

2011-10-10 Thread Rob Weir
Does anyone have a good example of a really slow spreadsheet document? Preferably ones that was slow due to computation/calculation, and one that is not merely slow due to size alone. I was talking to someone earlier who had ideas for speeding up spreadsheet computation through parallelization,

RE: svn commit: r1181165 - /incubator/ooo/trunk/main/LICENSE

2011-10-10 Thread Dennis E. Hamilton
Although there seems to be some confusion in this area, I thought the LICENSE file should be the Apache ALv2 license document alone and the NOTICE file includes all of the third party stuff (as well as a simple ALv2 claim for the overall combination). I don't disagree with removing

Re: svn commit: r1181165 - /incubator/ooo/trunk/main/LICENSE

2011-10-10 Thread Ross Gardler
On 10 October 2011 21:32, Dennis E. Hamilton dennis.hamil...@acm.org wrote: Although there seems to be some confusion in this area, I thought the LICENSE file should be the Apache ALv2 license document alone and the NOTICE file includes all of the third party stuff (as well as a simple ALv2

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Michael Meeks
Hi Rob, On Mon, 2011-10-10 at 12:19 -0400, Rob Weir wrote: It does not seem reasonable to publicly excoriate AOOo for having a private security list restricted to members while you are simultaneously and without notice proceed to enforce the same policy for the TDF security list. It

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Michael Meeks
On Mon, 2011-10-10 at 18:33 +0200, Malte Timmermann wrote: old/original OOo security list securityt...@openoffice.org. Which of course is highly sub-optimal, since it is an openoffice.org branded list, soon to be Apache owned - which is not neutral. Apparently we can't administer it

RE: svn commit: r1181165 - /incubator/ooo/trunk/main/LICENSE

2011-10-10 Thread Pedro Giffuni
Yes; I think Rob took the LICENSE file from Apache POI and a lot of things that didn't belong there crept in. I cleaned it but perhaps my commit didn't express it well. Pedro. --- On Mon, 10/10/11, Dennis E. Hamilton dennis.hamil...@acm.org wrote: Although there seems to be some confusion

Re: Slooooow spreadsheet documents

2011-10-10 Thread Pedro Giffuni
Hi Rob; If they want to design their own acid tests ... Point them to the Matrix Market: http://math.nist.gov/MatrixMarket/ And if they want cool algorithms point them to MTL: http://www.osl.iu.edu/research/mtl/ and the Coin-OR OSI interface: https://projects.coin-or.org/Osi Pedro. --- On

Re: svn commit: r1181165 - /incubator/ooo/trunk/main/LICENSE

2011-10-10 Thread Pedro Giffuni
--- On Mon, 10/10/11, Rob Weir robw...@apache.org wrote: Yes; I'd recommend replacing with an authentic clean copy of the license from some authoritative source, rather then trying to guess what parts are wrong. No problem. I took it from here:

Re: Slooooow spreadsheet documents

2011-10-10 Thread Joost Andrae
Hi Rob, just a remark: In my private opinion it would make more sense to invest resources into impementing a formula reference which points to expanded formula cells (/edit/fill) like it is already done for formatting templates within the sheet. A slow sheet doesn't necessarily mean that

Re: Slooooow spreadsheet documents

2011-10-10 Thread Andreas Säger
Am 10.10.2011 22:24, Rob Weir wrote: Does anyone have a good example of a really slow spreadsheet document? Preferably ones that was slow due to computation/calculation, and one that is not merely slow due to size alone. Database surrogate (complete madness in millions of xls files): X1

Re: Slooooow spreadsheet documents

2011-10-10 Thread Joost Andrae
Hi, At one of the OOo conferences I vaguely remember there was a university project that already parallelized computation of Calc sheets. Unfortunately I cannot remember the project/university name anymore. Probably having a look at the conference session drafts might give us some more insight.

ooocon.org seems to be down

2011-10-10 Thread Joost Andrae
Hi, I don't know who's in charge of this system (Maybe Stefan?) but unfortunately it shows a database error message. I just encountered that part of the historical conference data isn't hosted at marketing.openoffice.org but on ooocon.org Kind regards, Joost

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 4:41 PM, Michael Meeks michael.me...@suse.com wrote: snip   All I'm doing is suggesting that we treat AOOo security like we do for every other Apache project.        Sounds great - lets have open-ness to other projects, and cross-fertilisation of list composition

RE: Vulnerability fixed in LibreOffice

2011-10-10 Thread Dennis E. Hamilton
Michael, When will the real CVE-2011-2713, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2713, stand up and provide whatever clarity there is to be had about the specific nature of the defect and the kind of exploit it was vulnerable to until fixed in LO 3.4.3? Until it is possible to

RE: Vulnerability fixed in LibreOffice

2011-10-10 Thread Dennis E. Hamilton
+1 -Original Message- From: Michael Meeks [mailto:michael.me...@suse.com] Sent: Monday, October 10, 2011 13:54 To: ooo-dev@incubator.apache.org Subject: Re: Vulnerability fixed in LibreOffice On Mon, 2011-10-10 at 18:33 +0200, Malte Timmermann wrote: old/original OOo security list

Re: Slooooow spreadsheet documents

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 5:33 PM, Andreas Säger ville...@t-online.de wrote: Am 10.10.2011 22:24, Rob Weir wrote: Does anyone have a good example of a really slow spreadsheet document? Preferably ones that was slow due to computation/calculation, and one that is not merely slow due to size

Re: Slooooow spreadsheet documents

2011-10-10 Thread Rob Weir
On Mon, Oct 10, 2011 at 5:35 PM, Joost Andrae joost.and...@gmx.de wrote: Hi Rob, just a remark: In my private opinion it would make more sense to invest resources into impementing a formula reference which points to expanded formula cells (/edit/fill) like it is already done for formatting

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Ross Gardler
On 10 October 2011 21:41, Michael Meeks michael.me...@suse.com wrote: ...        It seems that are you asserting that the advice from the established Apache security mechanism was to be as insular as possible though; is that really the case ? are all other Apache projects security lists

Re: Slooooow spreadsheet documents

2011-10-10 Thread 依瑪貓
Dear Rob, Last time I encounter it, it was an Excel document with 15000+ empty (and hence invisible) text frames. I suppose this was cause by many users copy-paste without noticing it. And I got this complaint since user does not notice this in MS Excel, which I assume that 15000+ text

RE: Vulnerability fixed in LibreOffice

2011-10-10 Thread Dennis E. Hamilton
Not to make too fine a point of it, but secur...@apache.org (another private list) is automatically included on everything that happens on ooo-security @incubator.apache.org. It is not like there is any absence of oversight. Also, as a member of the ooo-security list, it never occurred to me

Re: Vulnerability fixed in LibreOffice

2011-10-10 Thread Shane Curcuru
(cutting and snipping liberally to get to the worthwhile stuff) On 10/10/2011 7:34 PM, Ross Gardler wrote: On 10 October 2011 21:41, Michael Meeksmichael.me...@suse.com wrote: ...snip... b) Because other communities exist based on a common code base it makes sense to attempt to build an