Re: (commons-validator) 08/11: Removed unnecessary lambdas in the tests

2024-11-18 Thread Mike Drob
In practical terms, what is the time cost? I imagined the lambda APIs existing to avoid heavy processing, like printing out the state of a database or other large complex graph. StringBuilder doesn't seem like a huge issue and the readability is nice. Have we spent more time writing these emails th

Re: [DISCUSSs] new Iterator

2024-10-19 Thread Mike Drob
What is the advantage of using an ExtendedIterator to filter/chain/map/flatten instead of using Stream to do the same? On Sat, Oct 19, 2024 at 5:16 AM Claude Warren wrote: > I would like to introduce a new Iterator to the iterator library: > ExtendedIterator > > This Iterator is an Iterator that

Re: [beanutils] Should Commons BeanUtil types implement Serializable

2024-09-03 Thread Mike Drob
+1 Please include an example (or pseudocode) for people of a serialization proxy, since not all readers may be familiar with Bloch or his book. On Tue, Sep 3, 2024 at 11:54 AM Melloware Inc wrote: > +1 from me. > > On Tue, Sep 3, 2024 at 12:51 PM Gary D. Gregory > wrote: > > > Hi All, > > > >

Re: Re: [LANG] Support single quotes in DurationFormatUtils methods' formats

2024-05-29 Thread Mike Drob
On Wed, May 29, 2024 at 8:17 AM Gary Gregory wrote: > (Sorry for the top post, phone) > > A case I can imagine an empty '' occurring is when the format string itself > is built programmatically for example a '%s' or using string concatenate of > a variable that holds a string where that string ca

Re: Security model for Commons Imaging, Compress, Codec and IO: RCE and DOS?

2023-12-14 Thread Mike Drob
On Thu, Dec 14, 2023 at 8:31 AM Arnout Engelen wrote: > On Thu, Dec 14, 2023 at 2:00 PM Elliotte Rusty Harold > wrote: > > > On Thu, Dec 14, 2023 at 6:09 AM Arnout Engelen > wrote: > > > * I'd say parsing/decompression/decoding should never allow malicious > > input > > > to trigger arbitrary c

Re: [ALL] Change to GitHub Workflow message subjects

2023-10-05 Thread Mike Drob
But often [VOTE] and [RESULT] are send with the same otherwise subject (and sometimes even [DISCUSS] before the vote, on other projects) On Thu, Oct 5, 2023 at 11:43 AM sebb wrote: > On Thu, 5 Oct 2023 at 17:25, Gary Gregory wrote: > > > > Should we use (VOTE) instead of [VOTE]? > > I doubt tha

Re: [EMAIL] Fluent interface

2023-09-29 Thread Mike Drob
I think the natural next question is whether we can have a major version change? Mike On Fri, Sep 29, 2023 at 6:24 AM sebb wrote: > On Fri, 29 Sept 2023 at 12:13, Filip Strajnar > wrote: > > > > Greetings, > > > > > > I've noticed that some methods on the org.apache.commons.mail.Email > > clas

[security] finding known issues for commons projects

2023-08-28 Thread Mike Drob
Hello commons-dev! I found the very lovely https://commons.apache.org/security.html page and I very much appreciate the links out to individual project's security pages. However, it looks like a little under half (9/21) have security pages linked. Does this mean that the other 12 projects have

Re: Move NO algorithms from ANY projects to math libraries

2023-07-17 Thread Mike Drob
Can we move implementations, have old definitions be thin proxies to the new locations, mark existing methods as deprecated, and document that future development happens somewhere else? On Mon, Jul 17, 2023 at 9:55 AM sebb wrote: > On Mon, 17 Jul 2023 at 14:31, Elliotte Rusty Harold > wrote: >

Re: [jxpath] reported CVE and path forward

2022-10-11 Thread Mike Drob
Thanks for this outline, Mark. Some questions in line. Mike On Tue, Oct 11, 2022 at 6:13 AM Mark Thomas wrote: > Roman - don't do anything yet. > > Commons folk, I suggest the following which is based on how we have > oss-fuzz setup on Tomcat. > > 1. Create a Google account for fuzz-testing@c.a

[jxpath] reported CVE and path forward

2022-10-10 Thread Mike Drob
Howdy folks, I recently saw that there was a reported CVE[1] for Apache JXPath that became public due to no response to the reporter over 90 days. I am uncertain if the reporter had tried reaching out to the appropriate security lists before-hand and was ignored, or failed to follow our establi