Mailing-List: contact general-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@hadoop.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Message-Id: <74BDFA74-DB12-4109-89DF-B353FC7296C4@yahoo-inc.com>
From: Arun C Murthy <acm@yahoo-inc.com>
To: "general@hadoop.apache.org" <general@hadoop.apache.org>
In-Reply-To: <AANLkTinAk+8YNLHb580uFibMWtNc=oYdqq+sOdBc+=6U@mail.gmail.com>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v936)
Subject: Re: [DISCUSS] Hadoop Security Release off Yahoo! patchset
Date: Thu, 13 Jan 2011 18:12:32 -0800
References: <516684F5-0052-4381-805D-760B61DECB16@yahoo-inc.com>
 <366A9E58-5BD7-497D-9AE1-229959ED4065@apache.org>
 <18C5C999-4680-4684-BC55-A430C40FD746@yahoo-inc.com>
 <AANLkTim+y7CBi8WeV9W+FVckn-1D1SAV2hSc6RnEebSn@mail.gmail.com>
 <F8414465-24F2-4F40-97F1-B13048820F24@yahoo-inc.com>
 <D7FA8ED2-D9C6-4B45-AC3B-9E965ADD9F5D@apache.org>
 <2A07F1E6-7096-493B-B92E-89938689DD50@yahoo-inc.com>
 <5CDDF962-5828-459F-87C3-5033EC21E9BF@mac.com>
 <075308A1-129B-4BF7-8924-C04EC6106D3E@yahoo-inc.com>
 <AANLkTimbXjRTTmEXiY1wweFfNGKmc5aWKw9D03J7gjBg@mail.gmail.com>
 <388582DF-FC85-49D1-A89C-1F36CE34A0E2@yahoo-inc.com>
 <AANLkTim=+8_WBNbxU43xwH50WT8UQwbac_mR8FQ+0jjz@mail.gmail.com>
 <04705B3C-49A9-46B3-8AA9-5673EFBDE544@yahoo-inc.com>
 <AANLkTinAk+8YNLHb580uFibMWtNc=oYdqq+sOdBc+=6U@mail.gmail.com>


On Jan 13, 2011, at 5:35 PM, Eli Collins wrote:
> Given that Todd has already done the work to rebase the 0.20.104.3
> patch set on 0.20.2, and in a way that doesn't require one big change,
> and his patch set includes branch20-append which the HBase guys want
> an Apache release of wouldn't it make sense to go this route?  What do
> others think? Seems better to have one 0.20.100 release than multiple
> ones for security and append.


My concern around 0.20.104.3 is that it has serious security holes  
including a root exploit that we have since fixed. I'm sure you guys  
are aware of them, Todd has helped to fix some.

The version I'm offering to push to the community has fixed all of  
them, *plus* the added benefit of several stability and performance  
fixes we have done since 20.104.3, almost 10 internal releases. This  
is a battle tested and hardened version which we have deployed on  
40,000+ nodes. It is a significant upgrade on 0.20.104.3 which we  
never deployed. I'm pretty sure *some* users will find that valuable. ;)

Also, I've offered to push individual patches as a background activity  
on a branch - that should suffice, no? Or, do you consider this a  
blocker?

Again, my goal in this exercise is to get a stable, improved version  
of Hadoop into the hands of our users asap, and focus on 0.22 and  
beyond.

thanks,
Arun