4 ms·

Just noting for the record that Openoffice has tons of security problems and no development happening. Apache won't retire the project because they have some k

Just noting for the record that Openoffice has tons of security problems and no development happening. Apache won't retire the project because they have some kind of MBA-brained theory that the 'brand' is worth misleading people. Libreoffice is the active project: https://www.libreoffice.org/discover/writer/ https://www.libreoffice.org/discover/writer/

ryao 2y ago
This does not look inactive to me: https://github.com/apache/openoffice/graphs/commit-activity https://github.com/apache/openoffice/graphs/commit-activity It does not have as much activity as Libre Office, but saying it is inactive seems extreme to me: https://github.com/LibreOffice/core/graphs/commit-activity https://github.com/LibreOffice/core/graphs/commit-activity
- gittergold 2y ago
  I've found looking at commit counts is never very good for judging project activity, at least if they don't squash-merge all pulls. For example there can be pages of one liners https://github.com/apache/openoffice/commits/trunk/?after=c80bf67b751a9ae24aec362f0c0a44d47243fee0+139 https://github.com/apache/openoffice/commits/trunk/?after=c8... One pull as opposed to zero indeed may break the inactive barrier but probably good not to read too much into commit counts graphs.
  - aorloff 2y ago
    For the sake of ourselves, looking back at our own repo, squash merge !
  - ryao 2y ago
    That does not change that they have weekly activity. That is more than most repositories on GitHub.
- Brian_K_White 2y ago
  The previous comment correctly summarized the actual state of things on all counts. Look closer.
  - ryao 2y ago
    That is a popular remark by libre office fans, but it is not true when I look at commit counts. As for security issues, it is interesting how nobody repeating this ever can cite any known security flaws. A quick comparison between the open office security bulletin and recently published CVEs (2023 or more recent) suggests that they are all fixed. https://www.openoffice.org/security/bulletin.html https://www.openoffice.org/security/bulletin.html https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openoffice https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openoffice Note that two of the ones in the mitre results are in a PHP project that is not part of the Open Office code base. Unless you can prove otherwise, it looks to me like people saying this are spreading FUD. The GitHub commit analysis shows an active project, although not as active as libre office, so the remarks about Open Office being a dead project are exaggerations at best and outright lies at worst. Finally, I would like to remark that it is ridiculous to complain because I cited an open source project you do not use/like. This is vim vs emacs levels of nonsense.
    - Brian_K_White 2y ago
      Your charges of fanboism seem to be rather projection. I personally barely use any office apps for 5 minutes per year. I'm not a fan of any.
      - deleted 2y ago
        [deleted]
      - ryao 2y ago
        I did not even use the term fanboyism, but as long as we are using psychological terms to describe behavior, may I suggest you had a Freudian slip? I am the one being jumped by you and others for mentioning a competing office suite's word processor in a price comparison. You asked me to look closer, so I did and found that the claims being made against Open Office were baseless. You did not like that, so you made yet another unfounded accusation, this time targeting me. By the way, I use Google Docs, so I have little interest in either project. However, the FUD being spread against Open Office by LibreOffice proponents has damaged LibreOffice in my eyes.
- stonogo 2y ago
  Almost all of those commits (for years) are one-liner patches to documentation and/or spellcheck dictionaries. Do not mistake activity for development. The entire objective of the current Openoffice developers is convincing people that the project is still alive. The only new feature development happens when someone backports something from Libreoffice (which is getting more difficult as Openoffice falls further behind) or panicked development to fix the onslaught of CVEs. It's been over year since the last release, because there is no release manager. 4.2.0 was scheduled for "2024" and they have about two days left to hit that target. They published the dev preview for this version in 2019. They still don't support Apple Silicon nor do they yet have a build for 64-bit Windows. If you bring your concerns to the developers mailing list, they call you a sock puppet and return to fiddling with localization files. The localization is supposedly the main blocker for the 4.2.0 release but they're not even sure if it's done. Just use Libreoffice.
  - ryao 2y ago
    I checked the published CVEs. Not only am I unable to find any proof of your security flaw remark (at least upon inspecting CVEs from the past two years), but you just contradicted yourself on both claims you made earlier by acknowledging that the Open Office developers are fixing flaws found in their software. This lobbying is having the opposite effect of what you intend, since the more I see it, the more my opinion of LibreOffice sinks.
    - stonogo 2y ago
      I will not lose any sleep over failing to convince you. The information is there for all to see, which was my original intent. You can continue to use Openoffice to your heart's content; it makes no difference to me. As for 'contradicting myself,' I did not. Unfixed security flaws exist in the code base, the project used to address them, and now no longer does. I also urge onlookers to investigate how Openoffice handles CVEs: the Apache foundation is a CVE Numbering Authority, they only issue CVEs after a release contains fixes, and they falsely claim to be the only CNA who can issue CVEs for Apache software projects. So, for the rest of the world, you don't get to find out about the flaws until the project gets around to fixing them, which is a wait increasing by the day.

ryao 2y ago

This does not look inactive to me: https://github.com/apache/openoffice/graphs/commit-activity https://github.com/apache/openoffice/graphs/commit-activity It does not have as much activity as Libre Office, but saying it is inactive seems extreme to me: https://github.com/LibreOffice/core/graphs/commit-activity https://github.com/LibreOffice/core/graphs/commit-activity

gittergold 2y ago
I've found looking at commit counts is never very good for judging project activity, at least if they don't squash-merge all pulls. For example there can be pages of one liners https://github.com/apache/openoffice/commits/trunk/?after=c80bf67b751a9ae24aec362f0c0a44d47243fee0+139 https://github.com/apache/openoffice/commits/trunk/?after=c8... One pull as opposed to zero indeed may break the inactive barrier but probably good not to read too much into commit counts graphs.
- aorloff 2y ago
  For the sake of ourselves, looking back at our own repo, squash merge !
- ryao 2y ago
  That does not change that they have weekly activity. That is more than most repositories on GitHub.
Brian_K_White 2y ago
The previous comment correctly summarized the actual state of things on all counts. Look closer.
- ryao 2y ago
  That is a popular remark by libre office fans, but it is not true when I look at commit counts. As for security issues, it is interesting how nobody repeating this ever can cite any known security flaws. A quick comparison between the open office security bulletin and recently published CVEs (2023 or more recent) suggests that they are all fixed. https://www.openoffice.org/security/bulletin.html https://www.openoffice.org/security/bulletin.html https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openoffice https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openoffice Note that two of the ones in the mitre results are in a PHP project that is not part of the Open Office code base. Unless you can prove otherwise, it looks to me like people saying this are spreading FUD. The GitHub commit analysis shows an active project, although not as active as libre office, so the remarks about Open Office being a dead project are exaggerations at best and outright lies at worst. Finally, I would like to remark that it is ridiculous to complain because I cited an open source project you do not use/like. This is vim vs emacs levels of nonsense.
  - Brian_K_White 2y ago
    Your charges of fanboism seem to be rather projection. I personally barely use any office apps for 5 minutes per year. I'm not a fan of any.
    - deleted 2y ago
      [deleted]
    - ryao 2y ago
      I did not even use the term fanboyism, but as long as we are using psychological terms to describe behavior, may I suggest you had a Freudian slip? I am the one being jumped by you and others for mentioning a competing office suite's word processor in a price comparison. You asked me to look closer, so I did and found that the claims being made against Open Office were baseless. You did not like that, so you made yet another unfounded accusation, this time targeting me. By the way, I use Google Docs, so I have little interest in either project. However, the FUD being spread against Open Office by LibreOffice proponents has damaged LibreOffice in my eyes.
stonogo 2y ago
Almost all of those commits (for years) are one-liner patches to documentation and/or spellcheck dictionaries. Do not mistake activity for development. The entire objective of the current Openoffice developers is convincing people that the project is still alive. The only new feature development happens when someone backports something from Libreoffice (which is getting more difficult as Openoffice falls further behind) or panicked development to fix the onslaught of CVEs. It's been over year since the last release, because there is no release manager. 4.2.0 was scheduled for "2024" and they have about two days left to hit that target. They published the dev preview for this version in 2019. They still don't support Apple Silicon nor do they yet have a build for 64-bit Windows. If you bring your concerns to the developers mailing list, they call you a sock puppet and return to fiddling with localization files. The localization is supposedly the main blocker for the 4.2.0 release but they're not even sure if it's done. Just use Libreoffice.
- ryao 2y ago
  I checked the published CVEs. Not only am I unable to find any proof of your security flaw remark (at least upon inspecting CVEs from the past two years), but you just contradicted yourself on both claims you made earlier by acknowledging that the Open Office developers are fixing flaws found in their software. This lobbying is having the opposite effect of what you intend, since the more I see it, the more my opinion of LibreOffice sinks.
  - stonogo 2y ago
    I will not lose any sleep over failing to convince you. The information is there for all to see, which was my original intent. You can continue to use Openoffice to your heart's content; it makes no difference to me. As for 'contradicting myself,' I did not. Unfixed security flaws exist in the code base, the project used to address them, and now no longer does. I also urge onlookers to investigate how Openoffice handles CVEs: the Apache foundation is a CVE Numbering Authority, they only issue CVEs after a release contains fixes, and they falsely claim to be the only CNA who can issue CVEs for Apache software projects. So, for the rest of the world, you don't get to find out about the flaws until the project gets around to fixing them, which is a wait increasing by the day.