FreeTDS Development Group

["ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>]

> 
> Hi Frediano,
> 
> On Wed, May 02, 2007 at 09:51:00AM +0200, ZIGLIO, Frediano, 
> VF-IT wrote:
> >   as someone should have noted lately I'm not that present 
> on ML. Here
> > (in Italy) there were some day off so I wasn't "connected".
> 
> > However... I have decided to stop any update to 0.63. I 
> know debian (and
> > so Ubuntu and I think others) still use this version but 
> you know.. we
> > are not Linux project that is there are no thousand 
> developers! We can't
> > backport as many updates we should (like buffer overflows 
> and security
> > related) so I think anybody should just update for its 
> safety. I just
> > delete any automated update script for 0.63 from my computer.
> 
> Would it be too much to ask that you notify me of any 
> security fixes that
> come along which might apply to 0.63?  It's a little late now 
> to change
> which version of FreeTDS is included in the latest Debian 
> release, so while
> it's fine if you decide you can't support 0.63, we still need to.
> 
> Now that etch is out I hope to have more time to follow this 
> list again (and
> to finally get 0.64 uploaded to Debian!), but I wouldn't want 
> our users'
> security to rely on me noticing a particular list mail.
> 

Well... usually I backported all security patch. So there should be any
security issue (obviously known). I think the faster way to keep you up
to date is to check ChangeLog (which is very detailed, just search for
buffer underflow/underflow, leak and similar). We could also open a bug
trace if we find a bug in recent version but I really have no time to
backport any fix or check if the issue is related to 0.63 (or former).

Well.. before you start packaging 0.64 (or newer) keep in mind that we
decided to remove the distribution of the core library, server stuff and
any related file (like includes) beside documentation. This obviously
breaks binary compatibility but should help to keep future one.

freddy77