On 2011-10-04 at 14:22 +0300, Odhiambo Washington wrote:
> 1. What would you consider as "substantial testing"? Only one person has so
> far raised (reminded you about) this issue.
We'd get the code out there and have people testing it, for a period of
time, well before the next release is due. There's nothing wrong with
running a locally-patched piece of software, _especially_ when you know
the patch will be in the next release, so there's no maintenance burden.
> Would you consider his testing and report as substantial or how many
> admins are lined up for the testing of this?
How many people are using "interface" to divide up their mail flows on
outbound mail? Anyone who is, should test the patch when we put it out
for testing.
> 2. When do you expect to push out the RELEASE? Can it not wait for (1) to be
> done first?
No, we'd like to get the inlist/inlisti alternatives for the match_*
expansion conditions, and the restricted match_* conditions, out there
as soon as is practical, so that people can be pressured into fixing the
security holes they've created in their configurations.
Saying "don't use match_address{$foo}{$bar}, use eqi{$foo}{$bar}"
doesn't cut it, because time and again we're seeing people quite
reasonably use the condition which has a name which says "match these
addresses", not realising that the second argument is an addresslist;
the problem is counter-intuitive except to those who know Exim well
enough to truly understand lists.
So at this point, anything which makes the next release less stable or
less well tested is out. Simple fixes are in.
-Phil
