[freelists-users] Re: Old bug...

  • From: John Madden <weez@xxxxxxxxxxxxx>
  • To: "Brian L. Johnson" <blj8@xxxxxxxx>
  • Date: Tue, 12 Mar 2002 08:14:09 -0500

Brian, I'm cc'ing freelists-users so everyone else is up on what's 

> Remember that problem I had where messages from juno.com users weren't
> being summarized in the digest's TOC?
> Well, it's still there; never went away really...
> But now that the dust has settled somewhat over the Listar suit, I was
> wondering if you could resubmit it as a bug (or reopen it if it's still
> on their system)?

Well, here's the thing about Listar/Ecartis...  In short, we might not be 
using it for long.  

A post came through on Bugtraq last night about the recent security 
problems found in the software that were labeled as "infinite" in number.  
Worse, the developers were described as not wanting or caring to fix them. 
 After asking about it on ecartis-support, I was told by one of the people 
who are apparently developing Ecartis now that she "fixed all that she 
could find, but didn't have the time to look for the rest of the 

...I don't like that attitude.  Yes, it's Free Software, and maintained on 
a volunteer basis, but I don't seem to have any trouble getting bugfixes 
quickly for my linux kernels (etc.)...

Basically, the issue is that they've coded throughout with sprintf()'s, 
which are widely known to allow buffer overflows, and really never 
should've been used to begin with.  

Given the usually-slow development of the product, and the recent attitude 
of the developers, I'm thinking about evaluating other packages or writing 
our own.  

Then again, either of those options would be an absolutely huge 
undertaking, and honestly, Ecartis is probably the best package out there 
for mailing list management, despite its shortcomings.  A re-write of its 
MIME library is next on its TODO list, which would mean a lot of these 
silly MIME-related issues (the digest TOC problem, for example) would go 

If anyone's got any ideas or feelings on the matter, we're open to them.  
That includes suggestions on other Free Software mailing list managers.  


- FreeLists Staff

The FreeLists-Users mailing list
Archives: //www.freelists.org/archives/freelists-users
Administrative contact: weez@xxxxxxxxxxxxx

Other related posts: