Re: [JXPath] Pull requests available

2015-11-20 Thread Gary Gregory
Thank you Uwe. The next step here is to get a release manager to volunteer. Anyone? Gary On Fri, Nov 20, 2015 at 4:15 PM, Uwe Barthel wrote: > Hi, > > I’ve opened the first 3 pull requests for JXPath. > All of these are patches or tests attached on JIRA items. > > https://issues.apache.org/jir

[JXPath] Pull requests available

2015-11-20 Thread Uwe Barthel
Hi, I’ve opened the first 3 pull requests for JXPath. All of these are patches or tests attached on JIRA items. https://issues.apache.org/jira/browse/JXPATH-118 https://issues.apache.org/jira/browse/JXPATH-160 https://issues.apache.org/jira/browse/JXPATH-177 Maybe merge the pull requests provide

Re: Eirik Bjørsnøs' notsoserial deserialization protection agent, for Commons?

2015-11-20 Thread Uwe Barthel
Hi, I'm not a committer but interested and looking forward to work on/with both solutions. -- Uwe On November 20, 2015 6:50:53 PM Phil Steitz wrote: On 11/20/15 7:33 AM, Bertrand Delacretaz wrote: Hi Eirik, On Fri, Nov 20, 2015 at 7:52 AM, Eirik Bjørsnøs wrote: ...Do we need a declare

Re: Eirik Bjørsnøs' notsoserial deserialization protection agent, for Commons?

2015-11-20 Thread Bertrand Delacretaz
On Fri, Nov 20, 2015 at 12:50 PM, Phil Steitz wrote: > ...So the real question is is anyone interested in working on > this code?... Good question indeed - I'll very probably use it so yes I would contribute to its maintenance. -Bertrand -

Re: Eirik Bjørsnøs' notsoserial deserialization protection agent, for Commons?

2015-11-20 Thread Phil Steitz
On 11/20/15 7:33 AM, Bertrand Delacretaz wrote: > Hi Eirik, > > On Fri, Nov 20, 2015 at 7:52 AM, Eirik Bjørsnøs wrote: >> ...Do we need a declare a "winner" between notsoserial and IO-487.. > I don't think so, definitely not - both are useful tools for different > use cases. > >> ...My take is tha

Re: Eirik Bjørsnøs' notsoserial deserialization protection agent, for Commons?

2015-11-20 Thread Bertrand Delacretaz
Hi Eirik, On Fri, Nov 20, 2015 at 7:52 AM, Eirik Bjørsnøs wrote: > ...Do we need a declare a "winner" between notsoserial and IO-487.. I don't think so, definitely not - both are useful tools for different use cases. > ...My take is that if a donation to Apache Commons can make people be more >

Re: Eirik Bjørsnøs' notsoserial deserialization protection agent, for Commons?

2015-11-20 Thread Eirik Bjørsnøs
Hi Commons PMC, (Sorry for being a bit late to the table) I see three questions being discussed here: 1) Is notsoserial a "great solution" or a "useful solution" in mitigating the problem of promiscuous deserialization? 2) Is it a "better" solution than IO-487? 3) Is it in the interest of Common