From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-yw1-x1130.google.com (mail-yw1-x1130.google.com [IPv6:2607:f8b0:4864:20::1130]) by sourceware.org (Postfix) with ESMTPS id 8968C3858D1E for ; Thu, 12 Oct 2023 04:15:52 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 8968C3858D1E Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-yw1-x1130.google.com with SMTP id 00721157ae682-5a7c95b8d14so7253737b3.3 for ; Wed, 11 Oct 2023 21:15:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1697084152; x=1697688952; darn=cygwin.com; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=nr/6BL8yA1NQdEnnjVK/VGXqyoJiu1+QTOKTe6LJacI=; b=EqAKc07HBkWAoT0P0K1CYbud5hZxolHPjCPPMaU+sc9bJ8SeuVUcp9/6nrzAOOVxVF 1jkcyjG7OccRfNSivgV/vLiX+OY4/GuSybw1qNiSaNWyj4MpSq4wXDvUvEOUDU9gWc9z MOzuQeST8mTyuzGJdSQeUqaSobBVWsJFw1Wt5xurG9xjEruAieVlXWDqQl9CKyFW+qHl bprOmxf26+Rp6jlZ4pEbWKauAHa8r3nfCiIqUTRMKbf/xamzgg/H8KuzYE84mERQcQik 1qbJ8ovBgKnTLJOS0s2BRWHsbeXJw5Nz9ZCCBTZOsrl8fUDvjC7nr0aFYL1lW7JO52ik B7CA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1697084152; x=1697688952; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=nr/6BL8yA1NQdEnnjVK/VGXqyoJiu1+QTOKTe6LJacI=; b=d/42JnVDF1Dfvqo8jo3ecqWTPN4OuibwYKDoiucxD5VfOOIfEVgC1N6GDq5KVcBBkz uY1h1wDS0IO4Ui5yGs3Qm39LbQ9uU4iAeMRLeDqzpeaRxVTFkVQib6PBnConsO/7asgh xvjL1zgdLyzq5xkjKO4dV3ZeZrsNtDZ3s6oDo0fUUYrU0juGb2odyQcGISjMzLB1VwZR Wa69m5BgnVHvhw/3t9AyMIKFHUrbyRqwgQCGtMki1VeWVQh9ZYjEYJlGx5eHZxBpzpW2 YxPG0LzC+XzjEzcCU04jCHawRBSpNmIZgu1Xn21MHuLWtE0kUYMU/xaOfSGuo83eL1IJ 5vPg== X-Gm-Message-State: AOJu0Yw6MjBdeHKW9ORbG9CpcsRiYb74XR707gxmDoUdcA1zt8GdPRml fyRTyDy1pr+Hfo27yGypjEca3wSWhMpM87IxwIAr3L5y X-Google-Smtp-Source: AGHT+IFyc5XAmmRSwUNfK2KsYKTVLfXlBihwxcMbJkbFk60RYlDBXke32aJYIToOA4mhsH379A615448DspOTKI05ik= X-Received: by 2002:a25:dcce:0:b0:d9a:5419:fb8b with SMTP id y197-20020a25dcce000000b00d9a5419fb8bmr7986391ybe.23.1697084151659; Wed, 11 Oct 2023 21:15:51 -0700 (PDT) MIME-Version: 1.0 References: <8cae1a30-cc92-cbea-4599-d7d550850ac5@cs.umass.edu> In-Reply-To: From: Eric D Hendrickson Date: Wed, 11 Oct 2023 23:15:40 -0500 Message-ID: Subject: Re: Ruby EOL in Cygwin 3.4.9? To: gs-cygwin.com@gluelogic.com Cc: "Hendrickson, Eric D" , "cygwin@cygwin.com" Content-Type: multipart/alternative; boundary="00000000000003821706077d329f" X-Spam-Status: No, score=-0.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: --00000000000003821706077d329f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello, Thanks for your reply. Again, to the point that this is an all volunteer effort. And not taking away from any of what you said. However, sorry I was not more clear. The issue here is as follows. Is Cygwin as a whole not more important than any one package? Cygwin is distributing a suite of packages. Are you really saying that if there were a 0day vulnerability discovered in an EOL package still being distributed by Cygwin, that this would do no damage to the reputation of Cygwin? How does Cygwin being an all volunteer effort have any bearing on this question, other than the time and interest of the volunteers? Perhaps the volunteer team should consider adopting a process of evaluating the support status of every package it redistributes, even at the expense of slowing down the rate of releases. Or dropping packages when no one has the time or interest in creating a package from a supported version of the tool in question. Again for the benefit of Cygwin as a whole - distributing EOL packages could put Cygwin as a whole at risk, which I'm sure you would agree is much worse than dropping a package from the suite. This goes back to my other question - Is there an Issues log or backlog a la GitHub where bugs / enhancement requests / feature suggestions like this can be logged for future consideration / evaluation, instead of one off discussions in this ephemeral medium of email? thank you and Cheers to you as well, Eric On Wed, Oct 11, 2023 at 10:59=E2=80=AFPM wrot= e: > On Wed, Oct 11, 2023 at 09:55:04PM -0500, Eric D Hendrickson via Cygwin > wrote: > > Sorry for the unclarity - I meant this for the whole list - not just yo= u. > > > > Thank you so much for taking the time to respond. Like you said, this > > really is all volunteers. > > > > For the whole list: > > > > Totally taking into account the all volunteer nature of Cygwin, would it > > make sense to defer on further non-emergency releases of Cygwin until a= ll > > packages that are EOL have been updated? Since this is the case with > ruby, > > I am guessing it's likely the case with other packages in Cygwin too. > > > > Is there a Issues log of some sort (ala github) for Cygwin somewhere, so > > that I can document this in the backlog and come back later to > investigate > > this myself if I have time this winter? > > > > > > On Wed, Oct 11, 2023 at 8:11=E2=80=AFPM Eliot Moss = wrote: > > > > > On 10/11/2023 6:36 PM, Hendrickson, Eric D wrote: > > > > Hi Eliot, > > > > > > > > Thanks for responding. That makes total sense. > > > > > > > > Totally taking into account the all volunteer nature of Cygwin, > would it > > > make sense to defer on further non-emergency releases of Cygwin until > all > > > packages that are EOL have been updated? Since this is the case with > ruby, > > > I am guessing it's likely the case with other packages in Cygwin too. > > > > > > > > Is there a backlog for Cygwin somewhere, so that I can investigate > this > > > myself if I have time this winter? > > > > > > > > Thank you and all the best, > > > > Eric > > > > > > > > -----Original Message----- > > > > From: Eliot Moss > > > > Sent: Wednesday, October 11, 2023 5:03 PM > > > > To: Hendrickson, Eric D ; cygwin@cygwin.com > > > > Cc: Eric @ Gmail > > > > Subject: Re: Ruby EOL in Cygwin 3.4.9? > > > > > > > > On 10/11/2023 12:37 PM, Hendrickson, Eric D via Cygwin wrote: > > > >> Hello all, > > > >> > > > >> As a ~25 year user and sometime contributor to Cygwin, I support > Cygwin > > > here at my place of work. Does anyone know why we are deploying Ruby > 2.6 > > > which EOL about 18 months ago? > > > >> > > > >> https://www.ruby-lang.org/en/downloads/branches/ > > > >> > > > >> I'm concerned about proliferation of EOL versions of Ruby in case > some > > > security risk / 0Day is identified. > > > >> > > > >> Please advise. > > > >> Eric Hendrickson > > > > > > You should send such things to the list, not me. I'm just > > > a user who has only made occasional small contributions ... > > > > > > Eliot > > > > > > > If nobody has responded I can give a generic response: > > > > "Because cygwin is all volunteer and someone has not volunteered, or > did > > > volunteer and is behind, or fell off the radar." > > > > > > > > Someone else will know how to look up if there is a currently > registered > > > volunteer for Ruby ... > > > > > > > > Eliot Moss > > > > > > > >> This e-mail, including attachments, may include confidential and/or > > > >> proprietary information, and may be used only by the person or > entity > > > >> to which it is addressed. If the reader of this e-mail is not the > > > >> intended recipient or intended recipient=E2=80=99s authorized agen= t, the > > > >> reader is hereby notified that any dissemination, distribution or > > > >> copying of this e-mail is prohibited. If you have received this > e-mail > > > >> in error, please notify the sender by replying to this message and > > > delete this e-mail immediately. > > > >> > > > > > > > > This e-mail, including attachments, may include confidential and/or > > > > proprietary information, and may be used only by the person or enti= ty > > > > to which it is addressed. If the reader of this e-mail is not the > > > intended > > > > recipient or intended recipient=E2=80=99s authorized agent, the rea= der is > hereby > > > > notified that any dissemination, distribution or copying of this > e-mail > > > is > > > > prohibited. If you have received this e-mail in error, please notify > the > > > > sender by replying to this message and delete this e-mail > immediately. > > > > > > > > > On Wed, Oct 11, 2023 at 09:55:04PM -0500, Eric D Hendrickson via Cygwin > wrote: > > For the whole list: > > > > Totally taking into account the all volunteer nature of Cygwin, would it > > make sense to defer on further non-emergency releases of Cygwin until a= ll > > packages that are EOL have been updated? > > Absolutely not. That makes *zero* sense for an all volunteer group. > > Not every single package is important to everyone. > (I am speaking personally, as maintainer of a single package on Cygwin.) > > You care about Ruby? Good. > I do not use Ruby, so that is not important *to me*. > > If some specific packages are important to you, please consider finding > the maintainers of those packages and offering to help maintain those > packages. > > https://cygwin.com/cygwin-pkg-maint > > There are many ruby-* packages that have been orphaned. Have at it. :) > > Cheers, Glenn > --=20 Good government never depends upon laws, but upon the personal qualities of those who govern. The machinery of government is always subordinate to the will of those who administer that machinery. The most important element of government, therefore, is the method of choosing leaders. -- Law and Governance, The Spacing Guild Manual, Children of Dune --00000000000003821706077d329f--