Mailing-List: contact dev-help@hc.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "HttpComponents Project" <dev@hc.apache.org>
Received-SPF: pass (nike.apache.org: domain of sebbaz@gmail.com designates
 209.85.212.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <53FF8097.6070002@apache.org>
References: <7523C7C4-57DF-4788-9FE6-9EC32E1565D4@webweaving.org>
	<1407946481.19147.6.camel@ubuntu>
	<C78D7F45-7DE7-4FA8-B273-46155D08BE18@webweaving.org>
	<1408088529.3857.7.camel@ubuntu>
	<61F7BA1C-AE91-4ADE-A2BA-2B741D342E4B@webweaving.org>
	<1408095242.5749.4.camel@ubuntu>
	<BE24EE8B-AB24-46B2-B3BD-63D4C68CCFA5@webweaving.org>
	<7DDFAB5F-B4E1-4720-A7F0-FC63ED4C9B2D@webweaving.org>
	<1408103128.7084.0.camel@ubuntu>
	<53EDFDAE.4020106@apache.org>
	<A6DA33FC-2FF7-4704-8719-706F78A8C357@webweaving.org>
	<1408354584.17162.5.camel@ubuntu>
	<6720030B-70C7-4364-AAC6-F1E37F0573D2@webweaving.org>
	<1408627601.28732.4.camel@ubuntu>
	<10129193-0E8A-44C9-9097-4D1AC1741029@webweaving.org>
	<1409217604.26571.10.camel@ubuntu>
	<CAOGo0VYYXOtizNa3ANzSiL-DQWCSZVSecn74eVGvqm+Kxr4Jog@mail.gmail.com>
	<1409253104.1368.0.camel@ubuntu>
	<53FF8097.6070002@apache.org>
Date: Thu, 28 Aug 2014 20:22:04 +0100
Message-ID: 
 <CAOGo0VapwKNeQ4hEgg2CYv3Vn5SBh77zJni=PypcsfKwsi0oig@mail.gmail.com>
Subject: Re: [Legal] publicsuffix.org test data;
 was Re: CVE-2014-3577 postmortem
From: sebb <sebbaz@gmail.com>
To: HttpComponents Project <dev@hc.apache.org>
Content-Type: text/plain; charset=UTF-8

On 28 August 2014 20:18, Asankha C. Perera <asankha@apache.org> wrote:
> On 08/29/2014 12:41 AM, Oleg Kalnichevski wrote:
>>
>> On Thu, 2014-08-28 at 16:51 +0100, sebb wrote:
>>>
>>> On 28 August 2014 10:20, Oleg Kalnichevski <olegk@apache.org> wrote:
>>>>
>>>> On Thu, 2014-08-21 at 17:50 +0200, Dirk-Willem van Gulik wrote:
>>>>>
>>>>> Op 21 aug. 2014, om 15:26 heeft Oleg Kalnichevski <olegk@apache.org>
>>>>> het volgende geschreven:
>>>>>
>>>>>> I have pretty much completely rewritten every bit of code related to
>>>>>> hostname verification in SVN trunk.
>>>>>>
>>>>>>
>>>>>> https://github.com/apache/httpclient/tree/268d6cc113b305addc4a31a70bd7c3b6d545e337/httpclient/src/main/java/org/apache/http/conn/ssl
>>>>>>
>>>>>> I would truly appreciate someone doing a peer review of the changes
>>>>>> and / or giving me feedback with regards to further improvements.
>>>>>
>>>>> Looks good. Couple of thoughts
>>>>>
>>>>> - BAD_COUNTRY_2LDS, BAD_COUNTRY_WILDCARD_PATTERN
>>>>>
>>>>> My guess is that longer term you will get too many specials - and the
>>>>> end game is parsing something like https://publicsuffix.org/ and
>>>>> specifically
>>>>>
>>>>>        https://publicsuffix.org/list/effective_tld_names.dat
>>>>>
>>>> Folks
>>>>
>>>> It turns out that we already have a substantial amount of code for
>>>> publicsuffix.org support in our 'cookie' module. It was contributed by
>>>> Ortwin 'Odi' Glueck some while ago.
>>>>
>>>> I would like to enhance the existing implementation and also extend its
>>>> test coverage.
>>>>
>>>> There is a set of test scenarios distributed by Mozilla, which I would
>>>> like to re-use
>>>>
>>>>
>>>> http://mxr.mozilla.org/mozilla-central/source/netwerk/test/unit/data/test_psl.txt?raw=1
>>>>
>>>> It is distributed as Creative Commons zero copyright. We can incorporate
>>>> those test scenarios. Do we need to add attribution clause to our NOTICE
>>>> and Zero Copyright license to our LICENSE file?
>>>>
>>>> What do you think?
>>>
>>> The rule for adding stuff to NOTICE is here:
>>>
>>> http://www.apache.org/legal/resolved.html#required-third-party-notices
>>>
>>> What is the exact wording of the license used by Mozilla?
>>> Is there a URL for it?
>>>
>> The license can be found here:
>>
>> http://creativecommons.org/publicdomain/zero/1.0/
>
> I think it would be safer to add to NOTICE and LICENSE files

NOTICE is for _required_ attributions only.
NOTICE has to be passed on to downstream consumers so must be as short
as possible.

> regards
> asankha
>
> --
> Asankha C. Perera
> AdroitLogic, http://adroitlogic.org
>
> http://esbmagic.blogspot.com
>
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org