Re: [Dspam-devel] Status of development of dspam

[Thomas Preud'h. <ro...@ce...>]

Le mercredi 27 novembre 2013, 21:28:31 Tom Hendrikx a écrit :
> 
> Hi Thomas,

Hi Tom,

thanks for your quick answer.

> 
> You are right in stating that there is no active development on dspam.
> This is due to a small team of volunteers that don't have the manpower
> or even knowledge (I don't know C and dislike perl) to actively
> maintain the source.
> Attempts in the past on getting more help on board hasn't really
> resulted in anything, but the current sleeping state of the project
> won't help in solving that situation imho.

I understand. I was not doing any judgement.

> 
> I took a quick look at the bug reports you submitted, and I'd be happy
> to apply the patches to the source tree, but I'm unable to actually
> test them. The hash/css backend is known to be problematic when used
> in a larger scale environment, which is why almost nobody uses it in
> production. (Considering that POV, it would be unwise to ship the hash
> as the default backend like Debian does, but that's a different
> discussion.)

Well, that could be changed. Out of the other backends, which one is the most 
tested? As to the patches, I see several problems with the current situation.

1) The first problem is that patches only in the Debian package only benefits to 
Debian user while I think all of them are *not* Debian specific.

2) I did my best when writing these patches but although I know very wellh C, 
I am not familiar with dspam code so I might have made some mistakes. Thus, 
what I seek in merging them in dspam proper is, in addition to the first reason 
given above, mostly about getting review of the code. I'm willing to improve 
the patch myself if necessary but I need guidance.

On the other hand, I can take the time to walk any reviewer through my 
patches, explaining the motivation if necessary (it's normally already 
explained in the associated bug report) and the way the patch works.

> 
> There is still a nice userbase, as you can see in the dspam-user
> mailing list, including questions about new installs now and then. For
> most people, dspam is a stable tool that works as advertised, albeit
> with some 'stay away from this part!' and 'don't turn this knob
> unless...' cautions on the box.

Even stable, a software always needs now and then a small fix for compiling on 
a new platform or work with a new version of gcc. And if you look at the 
patches in Debian [0], at least one of them is a fix for a possible loss of 
email with dspam (no matter what driver is used). So although I don't expect 
new feature, I think it is important to have at least someone respond to bug 
report and react to the most important of them.

[0] http://patch-tracker.debian.org/package/dspam/3.10.2+dfsg-12

> 
> The question is whether Debian (and derative) users will be bothered
> by dspam dropping out of the repositories. That would be a question
> for dspam-user ml. Personal opinion: I use the packages on ubuntu, and
> am glad they're available.

Not really. I don't doubt some people use dspam and I maintain some packages 
with fewer users. But I don't want to give a false impression of security. 
Debian users can assume that a package in a stable release of Debian will be 
fixed if any security issue is discovered. If the issue is complicated enough, 
I would need some help from someone more familiar with the code base to answer 
some questions. Again, I am not asking for some new feature but I want someone 
responsible in case I bring a problem up. Else, it means I need to fix any 
possible bug myself and I certainly cannot do it for all bugs.

> 
> For now, there is no new release planned anytime soon. Maybe that
> should change but (I guess) everyone's priorities are somewhere else.
> I'll try to look into your patches and commit them.

It's alright. Even in Debian very few people expressed the need for new 
features and when that happened, a patch was proposed in the bug tracker 
(AFAIK). But it would be nice if patches for bugfix would be considered and 
applied if correct. If not, a comment to help the author of the patch improve 
it would already be a significant improvement over the current situation.

> 
> I do like that fact that you care whether we're still alive, and I'd
> say: yes, but only just :/

Good. So let me state it one last time. I am willing to keep dspam in Debian 
in the next release if there is someone I can talk to in case of a problem I 
cannot solve myself. Someone that knows the code better than I do and that 
could (i) review patches I provide and (ii) help me fix a bug if it is too 
complex for me. Note that this shouldn't require much time as so far I managed 
to provide a patch for all bugs submitted and only an occasional review is 
necessary. So far I have a bug report every 2 months I would say (I didn't 
check).

> 
> Kind regards,
> 	Tom

Best regards,

Thomas