X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 6DB0C385E032
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1697123979;
	bh=m9+Qx1Gp3qzZszd6Rtyv3F9zkH8WOBcsoK8J6T9+tJI=;
	h=To:CC:Subject:Date:References:In-Reply-To:List-Id:
	 List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:
	 From:Reply-To:From;
	b=XWeF4Pr6x9O9HshORbuMcJJu4dtlV44IvGgVpmGuCgvMjKLGi8Sn205zioZI/Ov9x
	 mJ3CV/MF6ChOUwE869PN+YgQZ4OY+JDfxIlw7/x65Fnlk3oytkxItWKMmNIcbdVifX
	 Kev3gesyTWXOaku6UHGi+AR7rtvpCxRiJ/jnH+VA=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 97C2C3858404
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1697123937; x=1697728737;
 h=mime-version:content-language:accept-language:in-reply-to
 :references:message-id:date:thread-index:thread-topic:subject:cc:to
 :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
 bh=C2XhlPJpDgmCsbPUae45qPL+44bEFm61N03eZfLtMzc=;
 b=pdeKlF+M2/oe9A9POAE/1Pf8VhNss2+ttEdDAoGK5wXwUMi31VR+dQrJfeAePOiY/r
 +mBjDZfXtbllSIGomsJQi51MjbnsVkmQMLctcVPNpv2+SzJXSSiOzKc6NLqKl1Bn0Tng
 t7gx3lOgxHgCq5rngcDspXF1N+VeX5dGmNWUzuTzEJ3FA7NNcY8wgVJEsNnlrW+0BcqL
 FW7VJqBtu9pGRq2tKH4UufPSyo3HLCtgUCvDDPezGu30YoA0xo/PMsrZKoI8OhUgGcMe
 XblBqDLTxkcWWGpY+baQhZVNr7P7eWOnrJ1iq2kr18zi6GbS9D+1UyeA/8BhhS43x/PU
 fxzg==
X-Gm-Message-State: AOJu0YxmOFui8WAhExm1vhMQGki396LNmgVAPZNHxy3Sdmb/jh61bo3j
 eUPKJtzzqftjd3rjgWfv2U8=
X-Google-Smtp-Source: AGHT+IFxsUNEUmL3JKrE8HI0880MboPYYhnCkF5QPcHhTWLbRz5K1kOGf67Bluh7QjW0qmljSQswNg==
X-Received: by 2002:a05:6e02:1d93:b0:351:4f0c:b95c with SMTP id
 h19-20020a056e021d9300b003514f0cb95cmr28904902ila.24.1697123936532; 
 Thu, 12 Oct 2023 08:18:56 -0700 (PDT)
To: "gs-cygwin DOT com AT gluelogic DOT com" <gs-cygwin DOT com AT gluelogic DOT com>
CC: "Hendrickson, Eric D" <edh AT optum DOT com>,
        "cygwin AT cygwin DOT com"
 <cygwin AT cygwin DOT com>
Subject: Re: Ruby EOL in Cygwin 3.4.9?
Thread-Topic: Ruby EOL in Cygwin 3.4.9?
Thread-Index: Adn8YMNDXmVDKz+NSu2EZiG/1p4RjzU1OWMwQTRBRDM4YWYzY2dyeTlfRzcyN3ZBRFdnWnl6MFA27z/i1BI=
X-MS-Exchange-MessageSentRepresentingType: 1
Date: Thu, 12 Oct 2023 15:18:55 +0000
Message-ID: <CH0P223MB03167E1EDAF8D71E6744F8EEF8D3A@CH0P223MB0316.NAMP223.PROD.OUTLOOK.COM>
References: <PH7PR22MB31209C697AD372E36AD384ABAFCCA AT PH7PR22MB3120 DOT namprd22 DOT prod DOT outlook DOT com>
 <8cae1a30-cc92-cbea-4599-d7d550850ac5 AT cs DOT umass DOT edu>
 <PH7PR22MB3120ED5DF8EB2AA48EB8C436AFCCA AT PH7PR22MB3120 DOT namprd22 DOT prod DOT outlook DOT com>
 <d5eb20bc-bbe9-327f-bafc-e56dacfb23b8 AT cs DOT umass DOT edu>
 <CAByPD9=cE_-cuS8BXYv9EPy7_VNqhyXHj=2HMQ_ro4+V5t+sng AT mail DOT gmail DOT com>
 <ZSdvEv7Ds2UY72FG AT xps13>
 <CAByPD9kifZGr+N2oS6sgGieJHfsp2Wr_SNFqs_uDb+w14Cbz5A AT mail DOT gmail DOT com>
 <ZSd6PcPx9022z1ly AT xps13>
In-Reply-To: <ZSd6PcPx9022z1ly@xps13>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: 
X-MS-Exchange-Organization-RecordReviewCfmType: 0
MIME-Version: 1.0
X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00, DKIM_SIGNED,
 DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, HTML_MESSAGE,
 KAM_SHORT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS,
 TXREP autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
 server2.sourceware.org
X-Content-Filtered-By: Mailman/MimeDel 2.1.30
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: Eric Hendrickson via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Eric Hendrickson <ericdavidhendrickson AT gmail DOT com>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by delorie.com id 39CFJe5g018077

I don’t know who all is on this distribution but I’m going to be very clear.

I asked a few very reasonable questions in regard to security and best practices for a mature and widely known product like Cygwin. In this context, it doesn’t matter much that it’s all volunteers except in terms of resourcing - the answers should be basically the same. Either it’s important to Cygwin or it’s not.

I’m even offering to contribute back to Cygwin.

I got no answers to my questions except “you’re stupid”.

I don’t care how many stupid questions this volunteer team gets, or random emails. This is unacceptable for the open source community. Or for any community.

The Cygwin team needs to internally examine its maturity and professionalism.  Decisions clearly need to be made about how to communicate with the community. Anyone who treats people the way Glenn does should be ejected from the community.

Sent from Outlook<https://aka.ms/qtex0l> on my Tricorder
________________________________
From: gs-cygwin DOT com AT gluelogic DOT com <gs-cygwin DOT com AT gluelogic DOT com>
Sent: Wednesday, October 11, 2023 11:46:53 PM
To: Eric D Hendrickson <ericdavidhendrickson AT gmail DOT com>
Cc: Hendrickson, Eric D <edh AT optum DOT com>; cygwin AT cygwin DOT com <cygwin AT cygwin DOT com>
Subject: Re: Ruby EOL in Cygwin 3.4.9?

On Wed, Oct 11, 2023 at 11:15:40PM -0500, Eric D Hendrickson wrote:
> Hello,
>
> Thanks for your reply.  Again, to the point that this is an all volunteer
> effort.
>
> And not taking away from any of what you said.
>
> However, sorry I was not more clear.  The issue here is as follows.
>
> Is Cygwin as a whole not more important than any one package?
>
> Cygwin is distributing a suite of packages.  Are you really saying that if
> there were a 0day vulnerability discovered in an EOL package still being
> distributed by Cygwin, that this would do no damage to the reputation of
> Cygwin?
>
> How does Cygwin being an all volunteer effort have any bearing on this
> question, other than the time and interest of the volunteers?
>
> Perhaps the volunteer team should consider adopting a process of evaluating
> the support status of every package it redistributes, even at the expense
> of slowing down the rate of releases.  Or dropping packages when no one has
> the time or interest in creating a package from a supported version of the
> tool in question.
>
> Again for the benefit of Cygwin as a whole - distributing EOL packages
> could put Cygwin as a whole at risk, which I'm sure you would agree is much
> worse than dropping a package from the suite.
>
> This goes back to my other question -
>
> Is there an Issues log or backlog a la GitHub where bugs / enhancement
> requests / feature suggestions like this can be logged for future
> consideration / evaluation, instead of one off discussions in this
> ephemeral medium of email?
>
> thank you and Cheers to you as well,
> Eric
>
> On Wed, Oct 11, 2023 at 10:59 PM <gs-cygwin DOT com AT gluelogic DOT com> wrote:
>
> > On Wed, Oct 11, 2023 at 09:55:04PM -0500, Eric D Hendrickson via Cygwin
> > wrote:
> > > Sorry for the unclarity - I meant this for the whole list - not just you.
> > >
> > > Thank you so much for taking the time to respond.  Like you said, this
> > > really is all volunteers.
> > >
> > > For the whole list:
> > >
> > > Totally taking into account the all volunteer nature of Cygwin, would it
> > > make sense to defer on further non-emergency releases of Cygwin until all
> > > packages that are EOL have been updated?  Since this is the case with
> > ruby,
> > > I am guessing it's likely the case with other packages in Cygwin too.
> > >
> > > Is there a Issues log of some sort (ala github) for Cygwin somewhere, so
> > > that I can document this in the backlog and come back later to
> > investigate
> > > this myself if I have time this winter?
> > >
> > >
> > > On Wed, Oct 11, 2023 at 8:11 PM Eliot Moss <moss AT cs DOT umass DOT edu> wrote:
> > >
> > > > On 10/11/2023 6:36 PM, Hendrickson, Eric D wrote:
> > > > > Hi Eliot,
> > > > >
> > > > > Thanks for responding.  That makes total sense.
> > > > >
> > > > > Totally taking into account the all volunteer nature of Cygwin,
> > would it
> > > > make sense to defer on further non-emergency releases of Cygwin until
> > all
> > > > packages that are EOL have been updated?  Since this is the case with
> > ruby,
> > > > I am guessing it's likely the case with other packages in Cygwin too.
> > > > >
> > > > > Is there a backlog for Cygwin somewhere, so that I can investigate
> > this
> > > > myself if I have time this winter?
> > > > >
> > > > > Thank you and all the best,
> > > > > Eric
> > > > >
> > > > > -----Original Message-----
> > > > > From: Eliot Moss <moss AT cs DOT umass DOT edu>
> > > > > Sent: Wednesday, October 11, 2023 5:03 PM
> > > > > To: Hendrickson, Eric D <edh AT optum DOT com>; cygwin AT cygwin DOT com
> > > > > Cc: Eric @ Gmail <ericdavidhendrickson AT gmail DOT com>
> > > > > Subject: Re: Ruby EOL in Cygwin 3.4.9?
> > > > >
> > > > > On 10/11/2023 12:37 PM, Hendrickson, Eric D via Cygwin wrote:
> > > > >> Hello all,
> > > > >>
> > > > >> As a ~25 year user and sometime contributor to Cygwin, I support
> > Cygwin
> > > > here at my place of work.  Does anyone know why we are deploying Ruby
> > 2.6
> > > > which EOL about 18 months ago?
> > > > >>
> > > > >> https://www.ruby-lang.org/en/downloads/branches/
> > > > >>
> > > > >> I'm concerned about proliferation of EOL versions of Ruby in case
> > some
> > > > security risk / 0Day is identified.
> > > > >>
> > > > >> Please advise.
> > > > >> Eric Hendrickson
> > > >
> > > > You should send such things to the list, not me.  I'm just
> > > > a user who has only made occasional small contributions ...
> > > >
> > > > Eliot
> > > >
> > > > > If nobody has responded I can give a generic response:
> > > > > "Because cygwin is all volunteer and someone has not volunteered, or
> > did
> > > > volunteer and is behind, or fell off the radar."
> > > > >
> > > > > Someone else will know how to look up if there is a currently
> > registered
> > > > volunteer for Ruby ...
> > > > >
> > > > > Eliot Moss
> > > > >
> > > > >> This e-mail, including attachments, may include confidential and/or
> > > > >> proprietary information, and may be used only by the person or
> > entity
> > > > >> to which it is addressed. If the reader of this e-mail is not the
> > > > >> intended recipient or intended recipient’s authorized agent, the
> > > > >> reader is hereby notified that any dissemination, distribution or
> > > > >> copying of this e-mail is prohibited. If you have received this
> > e-mail
> > > > >> in error, please notify the sender by replying to this message and
> > > > delete this e-mail immediately.
> > > > >>
> > > > >
> > > > > This e-mail, including attachments, may include confidential and/or
> > > > > proprietary information, and may be used only by the person or entity
> > > > > to which it is addressed. If the reader of this e-mail is not the
> > > > intended
> > > > > recipient or intended recipient’s authorized agent, the reader is
> > hereby
> > > > > notified that any dissemination, distribution or copying of this
> > e-mail
> > > > is
> > > > > prohibited. If you have received this e-mail in error, please notify
> > the
> > > > > sender by replying to this message and delete this e-mail
> > immediately.
> > > >
> > > >
> >
> >
> > On Wed, Oct 11, 2023 at 09:55:04PM -0500, Eric D Hendrickson via Cygwin
> > wrote:
> > > For the whole list:
> > >
> > > Totally taking into account the all volunteer nature of Cygwin, would it
> > > make sense to defer on further non-emergency releases of Cygwin until all
> > > packages that are EOL have been updated?
> >
> > Absolutely not.  That makes *zero* sense for an all volunteer group.
> >
> > Not every single package is important to everyone.
> > (I am speaking personally, as maintainer of a single package on Cygwin.)
> >
> > You care about Ruby?  Good.
> > I do not use Ruby, so that is not important *to me*.
> >
> > If some specific packages are important to you, please consider finding
> > the maintainers of those packages and offering to help maintain those
> > packages.
> >
> > https://cygwin.com/cygwin-pkg-maint
> >
> > There are many ruby-* packages that have been orphaned.  Have at it. :)
> >
> > Cheers, Glenn

Your suggestions might be given slightly more weight if you made *any*
substantive contribution besides sharing your questionable assumptions,
and opinions on work that your think *other* people (who are volunteers)
should do.

Aside: The preference on this list is to bottom-post.

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple