Re: Security trouble

2012-03-27 Thread Olivier Lamy
2012/3/27 Jason Dillon : > Why don't you just fix the parsers in older mavens (ie. make a new release of > old-maven-version-x w/fixed parser) that allows for changes in newer versions? > > Seems like if you can never add new information to the pom to solve > problems/add features in Maven 3 w/o

Re: Security trouble

2012-03-27 Thread Jason Dillon
Why don't you just fix the parsers in older mavens (ie. make a new release of old-maven-version-x w/fixed parser) that allows for changes in newer versions? Seems like if you can never add new information to the pom to solve problems/add features in Maven 3 w/o completely breaking Maven 2, then

Re: Security trouble

2012-03-21 Thread Brian Fox
On Wed, Mar 21, 2012 at 4:35 AM, Sascha Scholz wrote: > Hi, > > On Tue, Mar 20, 2012 at 11:28 PM, Olivier Lamy wrote: >> BTW do we consider adding a warning in 3.0.5 if id != host and fail in 3.0.6 >> or fail directly in 3.0.5 > > Why not deprecate the id entry then instead of forcing users to se

Re: Security trouble

2012-03-21 Thread Sascha Scholz
Hi, On Tue, Mar 20, 2012 at 11:28 PM, Olivier Lamy wrote: > BTW do we consider adding a warning in 3.0.5 if id != host and fail in 3.0.6 > or fail directly in 3.0.5 Why not deprecate the id entry then instead of forcing users to set both to the same value? BTW, I don't see that preemptive authe

Re: Security trouble

2012-03-20 Thread Brian Fox
On Tue, Mar 20, 2012 at 6:28 PM, Olivier Lamy wrote: > 2012/3/20 Brian Fox : >> On Tue, Mar 20, 2012 at 5:07 PM, Olivier Lamy wrote: >>> 2012/3/20 Brian Fox : On Tue, Mar 20, 2012 at 12:58 PM, Olivier Lamy  wrote: > Hello Folks, > > The default preemptive on for GET is proba

Re: Security trouble

2012-03-20 Thread Olivier Lamy
2012/3/20 Brian Fox : > On Tue, Mar 20, 2012 at 5:07 PM, Olivier Lamy wrote: >> 2012/3/20 Brian Fox : >>> On Tue, Mar 20, 2012 at 12:58 PM, Olivier Lamy  wrote: >>> Hello Folks, The default preemptive on for GET is probably a bad idea. Imagine the following case, in your settin

Re: Security trouble

2012-03-20 Thread Brian Fox
On Tue, Mar 20, 2012 at 5:07 PM, Olivier Lamy wrote: > 2012/3/20 Brian Fox : >> On Tue, Mar 20, 2012 at 12:58 PM, Olivier Lamy  wrote: >> >>> Hello Folks, >>> >>> The default preemptive on for GET is probably a bad idea. >>> Imagine the following case, in your settings you have: >>> >>>     >>>  

Re: Security trouble

2012-03-20 Thread Olivier Lamy
2012/3/20 Brian Fox : > On Tue, Mar 20, 2012 at 12:58 PM, Olivier Lamy  wrote: > >> Hello Folks, >> >> The default preemptive on for GET is probably a bad idea. >> Imagine the following case, in your settings you have: >> >>     >>      olamy >>      reallycomplicatedpassword >>      foo.org >>    

Re: Security trouble

2012-03-20 Thread Brian Fox
On Tue, Mar 20, 2012 at 12:58 PM, Olivier Lamy  wrote: > Hello Folks, > > The default preemptive on for GET is probably a bad idea. > Imagine the following case, in your settings you have: > >     >      olamy >      reallycomplicatedpassword >      foo.org >     > > During dependencies resolution

Re: Security trouble

2012-03-20 Thread John Casey
On 3/20/12 12:58 PM, Olivier Lamy wrote: Hello Folks, The default preemptive on for GET is probably a bad idea. Imagine the following case, in your settings you have: olamy reallycomplicatedpassword foo.org During dependencies resolution, you get a pom with a r

Security trouble

2012-03-20 Thread Olivier Lamy
Hello Folks, The default preemptive on for GET is probably a bad idea. Imagine the following case, in your settings you have: olamy reallycomplicatedpassword foo.org During dependencies resolution, you get a pom with a repository. foo.org http://your