Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Message-ID: <4F15D40E.1070200@rowe-clan.net>
Date: Tue, 17 Jan 2012 14:03:26 -0600
From: "William A. Rowe Jr." <wrowe@rowe-clan.net>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:8.0) Gecko/20111105 Thunderbird/8.0
MIME-Version: 1.0
To: dev@httpd.apache.org
CC: Eric Covener <covener@gmail.com>
Subject: Re: security patches and releases (was [VOTE] Release Apache httpd
 2.4.0)
References: <BF2F3B0C-B842-4BE2-B20B-C6625B383A10@jaguNET.com>
 <4F14FF5C.9090101@rowe-clan.net> <4F15008E.5050805@rowe-clan.net>
 <5C41D092-DE8E-4D9D-843C-FA91F85A74FD@jaguNET.com>
 <4F159A0C.9070200@rowe-clan.net>
 <FE25B666-2789-4DF8-8625-F47537E3AF3A@sharp.fm>
 <4F15B05F.6070508@rowe-clan.net>
 <CALK=YjN+opxBG5rmXUqA1JuywQiN_PKp+CZoETBLsZO1BzsNNQ@mail.gmail.com>
 <4F15D2D5.3070304@rowe-clan.net>
 <CALK=YjNQhG8zeOT2JDV-eMCd3gAEgOhF11cpG3qMjDAyTgkqEg@mail.gmail.com>
In-Reply-To: 
 <CALK=YjNQhG8zeOT2JDV-eMCd3gAEgOhF11cpG3qMjDAyTgkqEg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 1/17/2012 2:01 PM, Eric Covener wrote:
> On Tue, Jan 17, 2012 at 2:58 PM, William A. Rowe Jr.
> <wrowe@rowe-clan.net> wrote:
>> On 1/17/2012 1:56 PM, Eric Covener wrote:
>>>> I'd suggest that patches/apply_to_x.y.z/ is a clumsy notation.  It seems
>>>> more efficient to set these up as patches/CVE-yyyy-iiii/ with individual
>>>> files for actively (or semi-actively) maintained versions.  If there is
>>>> one patch which applies to 2.2.n < 2.2.17, and a second patch for 2.2.17
>>>> and higher, it would be easier to differentiate these all within one
>>>> directory.
>>>
>>> The current scheme has one benefit in that a responsible user on the
>>> latest release has a one-stop shop for "What do I need to add?".
>>>
>>> With the CVE as the directory, they'd have to start with some other
>>> resource/hint or browse through the descriptions/patches.
>>
>> I'm not sure about that.  If I have 2.2.18, what do I apply?  If there
>> were patches in .21 how do I know they apply to me?
>>
> 
> Cross your fingers and visit three directories full of patches -- the
> farther back you stay, the more work you've got in store for you.
> 
> I don't think you're in much better shape tracking down e.g. 7 CVEs though.

Actually, I think you are (now).

  http://httpd.apache.org/security/vulnerabilities_22.html