See https://www.kde.org/announcements/announce-applications-16.12.0.php for the announcement and https://www.kde.org/announcements/fulllog_applications.php?version=16.12.0 for the reaaaaaaaaally long changelog.
Well done everyone :)
A blog about random things and sometimes about my work translating and developing KDE and anything
Thursday, December 15, 2016
Wednesday, December 07, 2016
The dangers of stable/LTS/supported versions
Ubuntu 14.04 LTS is supported until April 2019 and ships poppler 0.24.5 http://packages.ubuntu.com/search?suite=trusty&searchon=names&keywords=libpoppler-dev
RHEL 7.3 ships poppler 0.26.5 (I may be wrong, https://git.centos.org/summary/?r=rpms/poppler is the best info i could find, Red Hat does not make easy to know what you're buying)
Debian stable (Jessie) ships poppler 0.26.5 https://packages.debian.org/search?suite=jessie&searchon=names&keywords=libpoppler-dev
Current release is poppler 0.49 https://poppler.freedesktop.org/releases.html
This means that people are running stable versions and thinking they are secure, but if we trust security specialists, [almost] every crash can be exploited, and I'm almost sure neither Ubuntu nor RedHat nor Debian have backported all of the crash fixes of the more than 20 releases and 2 years of development behind those *very old* versions they are shipping.
I don't know how/if this can be fixed, but i honestly think we're giving users a false sense of security by letting them run those versions.
RHEL 7.3 ships poppler 0.26.5 (I may be wrong, https://git.centos.org/summary/?r=rpms/poppler is the best info i could find, Red Hat does not make easy to know what you're buying)
Debian stable (Jessie) ships poppler 0.26.5 https://packages.debian.org/search?suite=jessie&searchon=names&keywords=libpoppler-dev
Current release is poppler 0.49 https://poppler.freedesktop.org/releases.html
This means that people are running stable versions and thinking they are secure, but if we trust security specialists, [almost] every crash can be exploited, and I'm almost sure neither Ubuntu nor RedHat nor Debian have backported all of the crash fixes of the more than 20 releases and 2 years of development behind those *very old* versions they are shipping.
I don't know how/if this can be fixed, but i honestly think we're giving users a false sense of security by letting them run those versions.
No one "works" on Poppler
I thought that was obvious, but today someone thought that i was "working" as "paid working" on it.
No, I don't get paid for the work i do on Poppler.
It's my computing hobby, and on top of that it's not even my "primary" computing hobby, lots of KDE stuff take precedence over it, and i guess Gnome stuff may also take precedence for Carlos (second top commiter according to the git shortlog)
Aside a few paid contributions and some patches that may have come from people that use the software on their business (and we could file them under "paid" since they did the fix as part of their job) no one has a paid job that is mainly "work on poppler".
I guess we've done a good enough job as hobbyist :)
Obviously we could do better, so if you have lots of money and are interested in making free software PDF rendering beter please hire someone to help us (no, this is not me asking for money, I've a good enough job already).
And if you don't have money but you have some free time and like to help, join us :)
And if you really really have some free time or lots of money you could port Okular, Evince et al to pdfium and see if it's actually better/worse than poppler.
No, I don't get paid for the work i do on Poppler.
It's my computing hobby, and on top of that it's not even my "primary" computing hobby, lots of KDE stuff take precedence over it, and i guess Gnome stuff may also take precedence for Carlos (second top commiter according to the git shortlog)
Aside a few paid contributions and some patches that may have come from people that use the software on their business (and we could file them under "paid" since they did the fix as part of their job) no one has a paid job that is mainly "work on poppler".
I guess we've done a good enough job as hobbyist :)
Obviously we could do better, so if you have lots of money and are interested in making free software PDF rendering beter please hire someone to help us (no, this is not me asking for money, I've a good enough job already).
And if you don't have money but you have some free time and like to help, join us :)
And if you really really have some free time or lots of money you could port Okular, Evince et al to pdfium and see if it's actually better/worse than poppler.