Re: Any Xerces-J 2.12.0 release date to address CVE-2012-0881?

2018-01-15 Thread dbrosIus
Perhaps xerces should auto add a wider group of commiters as was done in Apache Commons, in order to spur activity Original message From: Michael Glavassevich Date: 1/11/18 3:29 PM (GMT-05:00) To: j-users@xerces.apache.org Subject: Re: Any Xerces-J 2.12.0 release date to a

Re: Any Xerces-J 2.12.0 release date to address CVE-2012-0881?

2018-01-15 Thread Cantor, Scott
On 1/14/18, 10:30 PM, "Will Herrmann" wrote: > I’m interested in becoming a committer, although admittedly, I’m only > interested in building a new release that fixes > this bug (which was previously stated to already be in the code). What do I > need to do to make that happen? Probably the b

Re: Any Xerces-J 2.12.0 release date to address CVE-2012-0881?

2018-01-15 Thread Will Herrmann
It’s necessary to get my employer on file even if I’m not doing it on company time? Also, in my case, I both have an employer and am self-employed (side job). How does that work? -Will > On Jan 15, 2018, at 4:39 PM, Cantor, Scott wrote: > > On 1/14/18, 10:30 PM, "Will Herrmann" wrote: > >>

Re: Any Xerces-J 2.12.0 release date to address CVE-2012-0881?

2018-01-15 Thread Cantor, Scott
On 1/15/18, 5:41 PM, "Will Herrmann" wrote: > It’s necessary to get my employer on file even if I’m not doing it on company > time? That depends on the jurisdiction, I couldn't answer that for you. Most US states are, I think, work for hire, meaning your employer owns anything you do that is

Re: Any Xerces-J 2.12.0 release date to address CVE-2012-0881?

2018-01-15 Thread Will Herrmann
Alright, in that case, how do I go about getting an Apache CLA on file with my employer being involved? -Will > On Jan 15, 2018, at 4:45 PM, Cantor, Scott wrote: > > On 1/15/18, 5:41 PM, "Will Herrmann" wrote: > >> It’s necessary to get my employer on file even if I’m not doing it on >> com

Re: Any Xerces-J 2.12.0 release date to address CVE-2012-0881?

2018-01-15 Thread Cantor, Scott
On 1/15/18, 5:47 PM, "Will Herrmann" wrote: > Alright, in that case, how do I go about getting an Apache CLA on file with > my employer being involved? Well, the CLA files are split into the two types. http://apache.org/dev/new-committers-guide#cla The Corporate one is the one that would hand