4 ms·

Apache OpenOffice is insecure

100 points by davidgerard 11y ago

voltagex_ 11y ago
https://www.openoffice.org/security/cves/CVE-2015-1774.html https://www.openoffice.org/security/cves/CVE-2015-1774.html
amk_ 11y ago
> the security hole: HWP files can be exploited and pwn your PC. obscure minor format, no problem … except that if you get a HWP file with a .DOC extension - say, what appears to be a MS Word file emailed you by anyone - you can get pwned by that. > they’ve known about this since april 2015 and haven’t fixed it. they have distributed over 8 million known-vulnerable copies of AOO since 27 april. (and the 143 million vulnerable before that.) > the fix is, literally, remove one file from the installer. they haven’t got it together to do this in five months. --- If the state of OpenOffice is really as bad as this person says, it would probably be a good time to try to roll LibreOffice back under the banner as the mainline (ala iojs -> node). IMHO one reason Libre never took off on Windows as much as Linux is the strange brand name, at least to non-participants in the great free software nomenclature war.
- bad_user 11y ago
  I don't get what the word "libre" has with the "great free software nomenclature war" or why that would make people avoid LibreOffice. It's also a very common word coming from the romance languages, with English being the strange one that doesn't make a distinction between free as in beer or as in speech. And in spite of what you may think, free as in beer on Windows means freeware and that kind of software has really bad connotations, hence the distinction is kind of necessary even from a branding perspective. And btw, Occam's Razor applies: if LibreOffice has less success than OpenOffice on Windows, that's probably because there's no Sun anymore to promote it.
  - thaumaturgy 11y ago
    A lot of end-users still mispronounce Firefox as "Foxfire". They don't understand what an operating system is and they don't know the URL bar exists so they Google everything. If your friendly neighborhood computer nerd, like me, tells them to check out "Lee Bray Office", first they think that's a dumb name, and then they fail to find it online. In the geek niche, yeah, LibreOffice is fine. Outside of that, it's a disadvantage. (Doesn't help that the product was slow and buggy for a long time either, so for a lot of users, it became, "oh, it was that crappy Microsoft Office knockoff".)
    - metalliqaz 11y ago
      I pronounce it more like "leeb-RAW-fiss"
  - 1amzave 11y ago
    > I don't get what the word "libre" has with the "great free software nomenclature war" or why that would make people avoid LibreOffice. Personally, I avoid "office suites" in general like the plague and hence don't have much of a horse in this race, but "LibreOffice" has always struck me as a name that rolls off the tongue in approximately the way a refrigerator would roll off a flatbed truck.
    - bad_user 11y ago
      Right, but I'm from Romania, our version is Liber (the original from Latin) and I can pronounce libre just fine. We also understand the word. And then we have to learn and use brands such as Microsoft Office, or Powerpoint, or Excel, even though these aren't Romanian words. Oh, the horror.
      - WorldWideWayne 11y ago
        Good for you, but it seems like most people don't like the sound of LibreOffice when compared to OpenOffice since the complaint about its name is never far behind any mention of the product.
nullterminated 11y ago
isn't the raison d'etre of foundations such as Apache to see to it that this sort of thing doesn't happen to its products?
- littlewing 11y ago
  No, it is not the raison d'etre of Apache. See: http://community.apache.org/newbiefaq.html#NewbieFAQ-HowareprojectsmanagedinTheApacheSoftwareFoundation http://community.apache.org/newbiefaq.html#NewbieFAQ-Howarep... Some key parts of that: * "How are projects managed in The Apache Software Foundation? ... Apache Projects work because people like you participate constructively within them!" * "How do I get user support for an ASF project? Everyone active in ASF projects is here as a volunteer, nobody is paid to provide support here. ... Remember that Apache committers are generally working as volunteers on Apache mailing lists." Projects survive on volunteerism. Apache doesn't support the projects themselves. However, that does not mean they are fully unobligated. In the Code of Conduct: http://www.apache.org/foundation/policies/conduct.html http://www.apache.org/foundation/policies/conduct.html it states that those in all spaces managed by ASF strive to: "7. Step down considerately. Members of every project come and go. When somebody leaves or disengages from the project they should tell people they are leaving and take the proper steps to ensure that others can pick up where they left off. In doing so, they should remain respectful of those who continue to participate in the project and should not misrepresent the project's goals or achievements. Likewise, community members should respect any individual's choice to leave the project." Based on that there could be grounds to have them stop hosting Open Office or any other project if it has become a liability because their committers have disengaged. If you want to get involved, write the president https://en.wikipedia.org/wiki/Ross_Gardler https://en.wikipedia.org/wiki/Ross_Gardler and tell him about this at: president@apache.org However, what it means to be disengaged is up for debate. You might also suggest that Apache reconsider the expectations they set of project owners.
- chris_wot 11y ago
  The amount of half-finished and unmaintained projects hosted by Apache is remarkable.
  - 11y ago
samspenc 11y ago
I'm glad this got voted up. I've been tossing up on whether to use and recommend OpenOffice or LibreOffice, and now I know which one to choose. Its too bad there's so much FUD and arguments going back and forth between the LibreOffice and OpenOffice communities. I wish the OpenOffice devs would just support LibreOffice and make it a much better product and really competing with MS Office.
mlinksva 11y ago
My it is dismal to encounter an article about OpenOffice. I wish those involved would mend whatever feelings and contracts are involved and get to redirecting openoffice.org to libreoffice.org. I skim comments and don't notice any path toward that happening (please point out if I've missed!) and close tab. But I just realized I have some old blog posts linking to openoffice.org. I've changed those to point to libreoffice.org. A tiny thing...
davidgerard 11y ago
Original title: URGENT: get the hell off Apache OpenOffice, it’s insecure and not worked on any more. LibreOffice is better in literally every way.

100 points by davidgerard 11y ago

https://www.openoffice.org/security/cves/CVE-2015-1774.html https://www.openoffice.org/security/cves/CVE-2015-1774.html

amk_ 11y ago

> the security hole: HWP files can be exploited and pwn your PC. obscure minor format, no problem … except that if you get a HWP file with a .DOC extension - say, what appears to be a MS Word file emailed you by anyone - you can get pwned by that. > they’ve known about this since april 2015 and haven’t fixed it. they have distributed over 8 million known-vulnerable copies of AOO since 27 april. (and the 143 million vulnerable before that.) > the fix is, literally, remove one file from the installer. they haven’t got it together to do this in five months. --- If the state of OpenOffice is really as bad as this person says, it would probably be a good time to try to roll LibreOffice back under the banner as the mainline (ala iojs -> node). IMHO one reason Libre never took off on Windows as much as Linux is the strange brand name, at least to non-participants in the great free software nomenclature war.

bad_user 11y ago
I don't get what the word "libre" has with the "great free software nomenclature war" or why that would make people avoid LibreOffice. It's also a very common word coming from the romance languages, with English being the strange one that doesn't make a distinction between free as in beer or as in speech. And in spite of what you may think, free as in beer on Windows means freeware and that kind of software has really bad connotations, hence the distinction is kind of necessary even from a branding perspective. And btw, Occam's Razor applies: if LibreOffice has less success than OpenOffice on Windows, that's probably because there's no Sun anymore to promote it.
- thaumaturgy 11y ago
  A lot of end-users still mispronounce Firefox as "Foxfire". They don't understand what an operating system is and they don't know the URL bar exists so they Google everything. If your friendly neighborhood computer nerd, like me, tells them to check out "Lee Bray Office", first they think that's a dumb name, and then they fail to find it online. In the geek niche, yeah, LibreOffice is fine. Outside of that, it's a disadvantage. (Doesn't help that the product was slow and buggy for a long time either, so for a lot of users, it became, "oh, it was that crappy Microsoft Office knockoff".)
  - metalliqaz 11y ago
    I pronounce it more like "leeb-RAW-fiss"
- 1amzave 11y ago
  > I don't get what the word "libre" has with the "great free software nomenclature war" or why that would make people avoid LibreOffice. Personally, I avoid "office suites" in general like the plague and hence don't have much of a horse in this race, but "LibreOffice" has always struck me as a name that rolls off the tongue in approximately the way a refrigerator would roll off a flatbed truck.
  - bad_user 11y ago
    Right, but I'm from Romania, our version is Liber (the original from Latin) and I can pronounce libre just fine. We also understand the word. And then we have to learn and use brands such as Microsoft Office, or Powerpoint, or Excel, even though these aren't Romanian words. Oh, the horror.
    - WorldWideWayne 11y ago
      Good for you, but it seems like most people don't like the sound of LibreOffice when compared to OpenOffice since the complaint about its name is never far behind any mention of the product.

nullterminated 11y ago

isn't the raison d'etre of foundations such as Apache to see to it that this sort of thing doesn't happen to its products?

littlewing 11y ago
No, it is not the raison d'etre of Apache. See: http://community.apache.org/newbiefaq.html#NewbieFAQ-HowareprojectsmanagedinTheApacheSoftwareFoundation http://community.apache.org/newbiefaq.html#NewbieFAQ-Howarep... Some key parts of that: * "How are projects managed in The Apache Software Foundation? ... Apache Projects work because people like you participate constructively within them!" * "How do I get user support for an ASF project? Everyone active in ASF projects is here as a volunteer, nobody is paid to provide support here. ... Remember that Apache committers are generally working as volunteers on Apache mailing lists." Projects survive on volunteerism. Apache doesn't support the projects themselves. However, that does not mean they are fully unobligated. In the Code of Conduct: http://www.apache.org/foundation/policies/conduct.html http://www.apache.org/foundation/policies/conduct.html it states that those in all spaces managed by ASF strive to: "7. Step down considerately. Members of every project come and go. When somebody leaves or disengages from the project they should tell people they are leaving and take the proper steps to ensure that others can pick up where they left off. In doing so, they should remain respectful of those who continue to participate in the project and should not misrepresent the project's goals or achievements. Likewise, community members should respect any individual's choice to leave the project." Based on that there could be grounds to have them stop hosting Open Office or any other project if it has become a liability because their committers have disengaged. If you want to get involved, write the president https://en.wikipedia.org/wiki/Ross_Gardler https://en.wikipedia.org/wiki/Ross_Gardler and tell him about this at: president@apache.org However, what it means to be disengaged is up for debate. You might also suggest that Apache reconsider the expectations they set of project owners.
chris_wot 11y ago
The amount of half-finished and unmaintained projects hosted by Apache is remarkable.
- 11y ago

samspenc 11y ago

I'm glad this got voted up. I've been tossing up on whether to use and recommend OpenOffice or LibreOffice, and now I know which one to choose. Its too bad there's so much FUD and arguments going back and forth between the LibreOffice and OpenOffice communities. I wish the OpenOffice devs would just support LibreOffice and make it a much better product and really competing with MS Office.

mlinksva 11y ago

My it is dismal to encounter an article about OpenOffice. I wish those involved would mend whatever feelings and contracts are involved and get to redirecting openoffice.org to libreoffice.org. I skim comments and don't notice any path toward that happening (please point out if I've missed!) and close tab. But I just realized I have some old blog posts linking to openoffice.org. I've changed those to point to libreoffice.org. A tiny thing...

davidgerard 11y ago

Original title: URGENT: get the hell off Apache OpenOffice, it’s insecure and not worked on any more. LibreOffice is better in literally every way.