dspam-devel

[Dspam-devel] Status of development of dspam

[Thomas Preud'h. <ro...@ce...>]

Hi there,

TL;DR: maintainer of dspam's Debian package speaking. I would like to know
what is the current status of the development of dspam.

As for any software, bugs are regularly found in dspam. Everytime a Debian
user has reported such a bug, I did my best to triage it, debug it if it's a
real bug and if possible provide a patch in dspam's bug tracker. However, I
didn't see any reaction to my bug report there and there was no new commit in
dspam since august 2012. There is also not much traffic on this mailing list.

Therefore I am wondering what is the future of dspam. You might already know
it, a stable release of Debian is supported for about 3 years. I commited
myself to support dspam (in version 3.10.1) in the current Debian release
starting from october 2013 but given the current momentum, I am wondering if
I will do the same for the next release.

So I'm waiting to hear from you about the plan regarding dspam. Is there still
some people working on it? Will there be a new release soon? What about the
patches reported with a patch?

Best regards,

Thomas Preud'homme

Re: [Dspam-devel] Status of development of dspam

[Tom H. <to...@wh...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 26-11-13 15:34, Thomas Preud'homme wrote:
> Hi there,

Hi Thomas,

> 
> TL;DR: maintainer of dspam's Debian package speaking. I would like
> to know what is the current status of the development of dspam.
> 
> As for any software, bugs are regularly found in dspam. Everytime a
> Debian user has reported such a bug, I did my best to triage it,
> debug it if it's a real bug and if possible provide a patch in
> dspam's bug tracker. However, I didn't see any reaction to my bug
> report there and there was no new commit in dspam since august
> 2012. There is also not much traffic on this mailing list.

You are right in stating that there is no active development on dspam.
This is due to a small team of volunteers that don't have the manpower
or even knowledge (I don't know C and dislike perl) to actively
maintain the source.
Attempts in the past on getting more help on board hasn't really
resulted in anything, but the current sleeping state of the project
won't help in solving that situation imho.

I took a quick look at the bug reports you submitted, and I'd be happy
to apply the patches to the source tree, but I'm unable to actually
test them. The hash/css backend is known to be problematic when used
in a larger scale environment, which is why almost nobody uses it in
production. (Considering that POV, it would be unwise to ship the hash
as the default backend like Debian does, but that's a different
discussion.)

> 
> Therefore I am wondering what is the future of dspam. You might
> already know it, a stable release of Debian is supported for about
> 3 years. I commited myself to support dspam (in version 3.10.1) in
> the current Debian release starting from october 2013 but given the
> current momentum, I am wondering if I will do the same for the next
> release.

There is still a nice userbase, as you can see in the dspam-user
mailing list, including questions about new installs now and then. For
most people, dspam is a stable tool that works as advertised, albeit
with some 'stay away from this part!' and 'don't turn this knob
unless...' cautions on the box.

The question is whether Debian (and derative) users will be bothered
by dspam dropping out of the repositories. That would be a question
for dspam-user ml. Personal opinion: I use the packages on ubuntu, and
am glad they're available.

> 
> So I'm waiting to hear from you about the plan regarding dspam. Is
> there still some people working on it? Will there be a new release
> soon? What about the patches reported with a patch?

For now, there is no new release planned anytime soon. Maybe that
should change but (I guess) everyone's priorities are somewhere else.
I'll try to look into your patches and commit them.

I do like that fact that you care whether we're still alive, and I'd
say: yes, but only just :/

Kind regards,
	Tom

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCAAGBQJSllXvAAoJEJPfMZ19VO/1XakP/19brQErLSW715TeNrxBWu27
YAR6h3Bq+dETk8S8NZqobAmF1Q8N1I9BTdGHcEA5zBQnIajnUl+tsgkgsFRlUOpR
jU1HVoWTUtIQ1xnpoL7Q45OvJV7lMdIwjb3MGYDcUwyvLSxESbLz04JTsFTvxqHd
tqxwjuxGDiRIvJ7gbh21AYBM4UwU+tZoiUCEypUftCenemIGUzgjb8Q6l8cWCmAj
7fLoN2dgjCFQE5Huagj6Lwh8L6DU4rYdNIsbdXSAwM6TXclBb2kGzUQopEqnEUwA
z7Jn9yS3nJyl+f/ezVMURci/voNEe2RWtmn6xT+qi2rE7FcGnWozgH96JCP729Rw
zonSzBTq6mPG8zulxXm4Oj9qa90gA47FunyGPbusqhbVv8Ga8JTGOKBW6Jo79FVH
MpVbq9EejYghSd0AgJKAmSH8DQO9foDBUBQI/exJZkK6LzcIrl0EdPJ1CUTwgsXF
hhTBOX4ev4eElET+Wgawrim5MnjtImGlboQjFfSq/YOEQM3+fSYjdF3Ph+V+R8LV
ZFYLxLqVlZ+1tfz/1XmsYEveufqa8hoIL1Yj61b/0uON5ZdcPN9qSIUeY0wZDOYU
fhc4MeHIw9J3A2B2mXSD6Yyp5MlT4ibfFc2+By5bMGtTA28vjoB9EwrJcht9fDKt
q+CDBtMyj9qx7GJvHa4l
=oqjy
-----END PGP SIGNATURE-----

Re: [Dspam-devel] Status of development of dspam

[Thomas Preud'h. <ro...@ce...>]

Le mercredi 27 novembre 2013, 21:28:31 Tom Hendrikx a écrit :
> 
> Hi Thomas,

Hi Tom,

thanks for your quick answer.

> 
> You are right in stating that there is no active development on dspam.
> This is due to a small team of volunteers that don't have the manpower
> or even knowledge (I don't know C and dislike perl) to actively
> maintain the source.
> Attempts in the past on getting more help on board hasn't really
> resulted in anything, but the current sleeping state of the project
> won't help in solving that situation imho.

I understand. I was not doing any judgement.

> 
> I took a quick look at the bug reports you submitted, and I'd be happy
> to apply the patches to the source tree, but I'm unable to actually
> test them. The hash/css backend is known to be problematic when used
> in a larger scale environment, which is why almost nobody uses it in
> production. (Considering that POV, it would be unwise to ship the hash
> as the default backend like Debian does, but that's a different
> discussion.)

Well, that could be changed. Out of the other backends, which one is the most 
tested? As to the patches, I see several problems with the current situation.

1) The first problem is that patches only in the Debian package only benefits to 
Debian user while I think all of them are *not* Debian specific.

2) I did my best when writing these patches but although I know very wellh C, 
I am not familiar with dspam code so I might have made some mistakes. Thus, 
what I seek in merging them in dspam proper is, in addition to the first reason 
given above, mostly about getting review of the code. I'm willing to improve 
the patch myself if necessary but I need guidance.

On the other hand, I can take the time to walk any reviewer through my 
patches, explaining the motivation if necessary (it's normally already 
explained in the associated bug report) and the way the patch works.

> 
> There is still a nice userbase, as you can see in the dspam-user
> mailing list, including questions about new installs now and then. For
> most people, dspam is a stable tool that works as advertised, albeit
> with some 'stay away from this part!' and 'don't turn this knob
> unless...' cautions on the box.

Even stable, a software always needs now and then a small fix for compiling on 
a new platform or work with a new version of gcc. And if you look at the 
patches in Debian [0], at least one of them is a fix for a possible loss of 
email with dspam (no matter what driver is used). So although I don't expect 
new feature, I think it is important to have at least someone respond to bug 
report and react to the most important of them.

[0] http://patch-tracker.debian.org/package/dspam/3.10.2+dfsg-12

> 
> The question is whether Debian (and derative) users will be bothered
> by dspam dropping out of the repositories. That would be a question
> for dspam-user ml. Personal opinion: I use the packages on ubuntu, and
> am glad they're available.

Not really. I don't doubt some people use dspam and I maintain some packages 
with fewer users. But I don't want to give a false impression of security. 
Debian users can assume that a package in a stable release of Debian will be 
fixed if any security issue is discovered. If the issue is complicated enough, 
I would need some help from someone more familiar with the code base to answer 
some questions. Again, I am not asking for some new feature but I want someone 
responsible in case I bring a problem up. Else, it means I need to fix any 
possible bug myself and I certainly cannot do it for all bugs.

> 
> For now, there is no new release planned anytime soon. Maybe that
> should change but (I guess) everyone's priorities are somewhere else.
> I'll try to look into your patches and commit them.

It's alright. Even in Debian very few people expressed the need for new 
features and when that happened, a patch was proposed in the bug tracker 
(AFAIK). But it would be nice if patches for bugfix would be considered and 
applied if correct. If not, a comment to help the author of the patch improve 
it would already be a significant improvement over the current situation.

> 
> I do like that fact that you care whether we're still alive, and I'd
> say: yes, but only just :/

Good. So let me state it one last time. I am willing to keep dspam in Debian 
in the next release if there is someone I can talk to in case of a problem I 
cannot solve myself. Someone that knows the code better than I do and that 
could (i) review patches I provide and (ii) help me fix a bug if it is too 
complex for me. Note that this shouldn't require much time as so far I managed 
to provide a patch for all bugs submitted and only an occasional review is 
necessary. So far I have a bug report every 2 months I would say (I didn't 
check).

> 
> Kind regards,
> 	Tom

Best regards,

Thomas