Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of paul.joseph.davis@gmail.com
 designates 209.85.220.180 as permitted sender)
Received-SPF: pass (google.com: domain of paul.joseph.davis@gmail.com
 designates 10.52.91.193 as permitted sender) client-ip=10.52.91.193;
MIME-Version: 1.0
In-Reply-To: 
 <CAL3q7H63fEABs6sSSaSt=xkb5KHWJ9zjo8uD9gjCm_s212xaUQ@mail.gmail.com>
References: 
 <CA+Y+445m_ofkwvLuB9eRnVwmAnOBR2LwQV2ZMbiARTwSCzj-ug@mail.gmail.com>
 <1FE932A3-8DF7-4B8A-9E88-448FBA671F8F@apache.org>
 <53080A6A-93C2-478F-B739-BBF7A3634C07@apache.org>
 <CAJ_m3YAQj-Vh8L+0a4d=Nk5Kc_rcsdN39wB52Lu0aYT==YmSJg@mail.gmail.com>
 <23D481E8-3F4E-4DF2-9818-935BB3FDA2F1@apache.org>
 <CA+Y+445wpZizQC0T8jP0fOwHp1pJoph+dPO4kkYDVrG3UEwX2Q@mail.gmail.com>
 <CABvT1DGKvvduSqWNERYQg4Vg3p-jX3Ff4Td53VN7J3PH4p+6-Q@mail.gmail.com>
 <BCFD271E-1C57-41BC-B788-97C06B569CC5@apache.org>
 <CA+Y+446K+pf0-J1QwoVO3CmVEEL7ZYFvWpiiTT3eQwt+3SepwQ@mail.gmail.com>
 <CAJ_m3YA8=+juu0N-qiT19PR6nS4D1c224ViJ7HCwY4mQuJ1Rwg@mail.gmail.com>
 <CABvT1DEd6VquWTVn2fxLeVNvaEPaTrRK_TgrhKUdRMy9LyumXg@mail.gmail.com>
 <CAN-3CB+Tnb9wH6oDQb0TnSPmaypieXO32m3Q7GyPanA951E_jA@mail.gmail.com>
 <CAL3q7H63fEABs6sSSaSt=xkb5KHWJ9zjo8uD9gjCm_s212xaUQ@mail.gmail.com>
From: Paul Davis <paul.joseph.davis@gmail.com>
Date: Wed, 22 Feb 2012 13:47:11 -0600
Message-ID: 
 <CAJ_m3YBo0VECBq6BnET5aFixyW4Ukg25QfmtHxRpXj+NNNZ+LA@mail.gmail.com>
Subject: Re: Issues blocking the 1.2.0 release
To: dev@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

JSON patch is committed:

http://git-wip-us.apache.org/repos/asf?p=3Dcouchdb.git;a=3Dcommitdiff;h=3Db=
a271a70b83c6df16af43204c2ba9f4d5ca89711

On Wed, Feb 22, 2012 at 12:39 AM, Filipe David Manana
<fdmanana@apache.org> wrote:
> I think COUCHDB-1413 wouldn't hurt to have for 1.2.0, after all it's
> about correct query results. 1.2.1 is also aceptable.
> If no objections, I'll push the fix to 1.2.x as well.
>
> On Tue, Feb 21, 2012 at 6:32 PM, Jason Smith <jhs@iriscouch.com> wrote:
>> My reading of the JIRA ticket (FWIW) is that Paul explained pretty
>> convincingly why this is only a minor bug if at all. For this release,
>> Paul had a simple fix; although I do not see it in 1.2.x nor JIRA and
>> don't recall offhand what it was exactly.
>>
>> On Tue, Feb 21, 2012 at 10:50 PM, Robert Newson <rnewson@apache.org> wro=
te:
>>> heh, actually I don't think we did.
>>>
>>> On 21 February 2012 22:41, Paul Davis <paul.joseph.davis@gmail.com> wro=
te:
>>>> Did we fix the original JSON thing that started this whole broughaha?
>>>>
>>>> On Tue, Feb 21, 2012 at 3:57 PM, Noah Slater <nslater@tumbolia.org> wr=
ote:
>>>>> Thanks.
>>>>>
>>>>> On Tue, Feb 21, 2012 at 9:46 PM, Jan Lehnardt <jan@apache.org> wrote:
>>>>>
>>>>>> On 21.02.2012, at 22:38, Robert Newson <rnewson@apache.org> wrote:
>>>>>>
>>>>>> > I resolved the ipv6 ticket as 'cannot reproduce' given that two
>>>>>> > committers have verified ipv6 replication with 1.2.x. Time for rou=
nd
>>>>>> > 2?
>>>>>>
>>>>>> +1
>>>>>>
>>>>>>
>>>>>> >
>>>>>> > On 21 February 2012 21:11, Noah Slater <nslater@tumbolia.org> wrot=
e:
>>>>>> >> Are we blocked on anything else? Are we good to go?
>>>>>> >>
>>>>>> >> On Tue, Feb 21, 2012 at 7:21 PM, Jan Lehnardt <jan@apache.org> wr=
ote:
>>>>>> >>
>>>>>> >>> Thanks guys, committed.
>>>>>> >>>
>>>>>> >>> Noah, 1.2.0 is unblocked on this one.
>>>>>> >>>
>>>>>> >>> On Feb 21, 2012, at 20:13 , Paul Davis wrote:
>>>>>> >>>
>>>>>> >>>> +1 on the patch to require admin for _changes.
>>>>>> >>>>
>>>>>> >>>> On Tue, Feb 21, 2012 at 3:36 AM, Jan Lehnardt <jan@apache.org> =
wrote:
>>>>>> >>>>> *nudge*
>>>>>> >>>>>
>>>>>> >>>>> I don't feel very confident with a single opinion (thanks Robe=
rt),
>>>>>> and
>>>>>> >>> would love your input on this one.
>>>>>> >>>>>
>>>>>> >>>>> Cheers
>>>>>> >>>>> Jan
>>>>>> >>>>> --
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>> On Feb 16, 2012, at 16:12 , Jan Lehnardt wrote:
>>>>>> >>>>>
>>>>>> >>>>>>
>>>>>> >>>>>> On Feb 14, 2012, at 13:14 , Noah Slater wrote:
>>>>>> >>>>>>
>>>>>> >>>>>>> Devs,
>>>>>> >>>>>>>
>>>>>> >>>>>>> Please outline:
>>>>>> >>>>>>>
>>>>>> >>>>>>> =A0- What remains to be fixed for regression purposes
>>>>>> >>>>>>
>>>>>> >>>>>> I want to bring up one more thing (sorry :).
>>>>>> >>>>>>
>>>>>> >>>>>> /_users/_changes is currently end-user readable. While
>>>>>> >>> /_users/_changes?include_docs=3Dtrue will not fetch docs the req=
uesting
>>>>>> user
>>>>>> >>> doesn't have access to, it still gets all doc ids in the /_users=
 db and
>>>>>> >>> thus easily can generate a list of all users.
>>>>>> >>>>>>
>>>>>> >>>>>> I'd like to propose to make /_user/_changes also admin-only b=
efore
>>>>>> we
>>>>>> >>> ship 1.2.0. Again, I'm happy to revisit and make things configur=
able
>>>>>> down
>>>>>> >>> the road.
>>>>>> >>>>>>
>>>>>> >>>>>> Note that the information that a particular user is registere=
d is
>>>>>> >>> leaked (a user can't sign up with a username that is already tak=
en,
>>>>>> from
>>>>>> >>> that it can be deduced that that particular username is already
>>>>>> >>> registered). This is in line with most signup systems. Making
>>>>>> >>> /_users/_changes admin-only doesn't prevent all leakage of what =
users
>>>>>> have
>>>>>> >>> signed up, but it stops bulk-leakage of *all* users in one swoop=
.
>>>>>> >>>>>>
>>>>>> >>>>>> What do you think?
>>>>>> >>>>>>
>>>>>> >>>>>> Cheers
>>>>>> >>>>>> Jan
>>>>>> >>>>>> --
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>
>>>>>> >>>
>>>>>> >>>
>>>>>>
>>
>>
>>
>> --
>> Iris Couch
>
>
>
> --
> Filipe David Manana,
>
> "Reasonable men adapt themselves to the world.
> =A0Unreasonable men adapt the world to themselves.
> =A0That's why all progress depends on unreasonable men."