DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=gUDw0tjyPRlb0VJJcir/zYk3qgsm3U7myjPvXuDQ9qybBzkspEOAs
	Wpcswu1GhZ4nu0OmEkgtfYLnt1YSLYuOHmsFco4DvWEmH+4SZuG1rh/H4onrh/qV
	h4eCtX1vfrb/KC4ZvWuJ5iOSMTlzQ3razpRmuSfqSlWsrOggRkbKL8=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Date: Wed, 9 Apr 2014 15:13:54 -0400
From: Christopher Faylor <cgf-use-the-mailinglist-please AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: We need steenking patches (Re: Cygwin kill utility...)
Message-ID: <20140409191354.GA5673@ednor.casa.cgf.cx>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <20140408181301 DOT GD2731 AT ednor DOT casa DOT cgf DOT cx> <CAAXzdLUJaQ3ap06EPD51ua45d7vqmaPanCZRo9CZDPKmMfm5=w AT mail DOT gmail DOT com> <20140409032833 DOT GA2351 AT ednor DOT casa DOT cgf DOT cx> <CAAXzdLUk3L3zRcGoLmb=GM-rnF7K8Y=fqNA8n9gfgVhja5TL2Q AT mail DOT gmail DOT com> <20140409055117 DOT GA1878 AT ednor DOT casa DOT cgf DOT cx> <CAAXzdLXxAnB0JYHuvJj44ZAT=Uc-G12Xt+xsirnmiPBkOJ4U-w AT mail DOT gmail DOT com> <53457A4C DOT 1050104 AT etr-usa DOT com> <CAAXzdLVfbuWujEXQXsZY2_puq7JkEmJemeEZJ+DXhdQHb2wQLA AT mail DOT gmail DOT com> <20140409171331 DOT GB6319 AT ednor DOT casa DOT cgf DOT cx> <CAAXzdLUK2FexSLDyn5rYrffSGYpAG1jSrXYu-=o-xNNCOy4Wtw AT mail DOT gmail DOT com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAAXzdLUK2FexSLDyn5rYrffSGYpAG1jSrXYu-=o-xNNCOy4Wtw@mail.gmail.com>
User-Agent: Mutt/1.5.20 (2009-06-14)

On Wed, Apr 09, 2014 at 12:43:25PM -0500, Steven Penny wrote:
>On Wed, Apr 9, 2014 at 12:13 PM, Christopher Faylor wrote:
>>It's possible that a site like github has more bandwidth and compute
>>power than sourceware.org and doesn't have to worry about bogging down
>>the system with malicious search attacks.  We, unfortunately, do.  So,
>>while it is possible to turn on searches, it seems like I'd have to
>>personally take some time to fixing the viewvc code to mitigate any
>>damage from using searches.  That is more effort than I'm willing to go
>>to on one person's claim that this functionality is vitally necessary.
>
>You dont want to take the time to fix it?  You want to maintain the
>status quo?  Thats cool.  But then dont go complaining on the mailing
>list when you are unwilling to take steps to fix it.

Any fix to viewvc was likely to be non-trivial.  It would require making
changes to unfamiliar code and, since we've had a lot of attacks on
sourceware.org over the years, I was leery about introducing another
vector.  So, given that you are a data point of one, it didn't seem
worth my time do spend a lot of time on this, despite your indulgenge in
the de rigeur internet style of claiming that your opinions are fact.

The good news is that when we eventually switch Cygwin to git we'll get
search functionality for free so it really is more worth my time to make
that switch than it is to investigate changing viewvc.  I'll try to get
to that in the next week or so.  I know that Corinna will be thrilled to
finally be on git.

cgf

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple