Slashdot Mirror
OpenBSD Project Will Release OpenCVS
thequbemaster writes "The OpenBSD project, responsible for OpenSSH, OpenBGPD, and OpenNTPD, has created OpenCVS, a BSD licensed implementation of CVS client and server. From the site: 'It aims to be as compatible as possible with other CVS implementations, except when particular features reduce the overall security of the system. The OpenCVS project was started after discussions regarding the latest GNU CVS vulnerabilities that came out. Although CVS is widely used, its development has been mostly stagnant in the last years and many security issues have popped up, both in the implementation and in the mechanisms.' No releases are available yet. The README in the OpenCVS CVS repository states that the server is not ready yet, but looks like the client is usable." Update: 12/15 20:18 GMT by T : This project was mentioned briefly the other day, too.
The OpenCVS CVS repository?
lol
hahahahahahaha. I kill me.
Yeah? Well I think you're overrated too.
Not that I mind mind you, I just didn't see why there have been to articles on OpenCVS starting up. At least this one isn't saying it was because OpenBSD hates the GPL and are trying to replace a GPL CVS system.
I'm sick of following my dreams - I'm just going to ask them where they're going and hook up with them later.
already aware of this?
/ 11 54242&tid=8&tid=7
http://bsd.slashdot.org/article.pl?sid=04/12/06
That was back on December 6th!
Even if I knew that tomorrow the world would go to pieces, I would still plant my apple tree. -Martin Luther
Merge the userfriendlyness of OpenBSD with the userfriendlyness of CVS!
What is wrong with subversion?
What will really put this into a mainstream enviornment is if there are some good GUI clients available for it. If an easy to use, and perhaps more importantly, cross platform GUI client is released, you can bet that the popularity will go up. Visual Source Safe (Microsoft) isn't all that great, but people still use it because CVS doesn't have a robust windows GUI client. Or at least it didn't early on and so the first impressions were not very friendly from companies looking at products where they wouldn't have to train their employees as much. If they can come up with a great GUI right off the bat, Microsoft will really sweat.
Hm. Well, maybe. There have been a couple releases this year, and the mailing list remains active.
I kind of feel that the torch is being passed on to Subversion, with no hard feelings between anyone. Lots of folks are converting over and most folks seem pretty happy with it. But CVS is still widely used and there are a bunch of of gurus who hang out on the list and answer questions.
Oh, and here's a mirror of various CVS releases if anyone needs them.
The Army reading list
isn't just the fact that it's a dupe.
5 /1936218 - I imagine this will be changed once the admins notice . . . well, probably.
It's that the posted link, to the article that this is a dupe of, is a link into the admin interface. For the curious, right now it's https://slashdot.org/admin.pl?op=edit&sid=04/12/1
Breaking Into the Industry - A development log about starting a game studio.
Maybe this disclaimer should appear at the end of every article summary...
"Any remaining problems"?
You obviously are unfamiliar with the CVS dungpile, err.. codebase. For instance, there is no access provider mechanism - they copied and pasted the code from the filesystem tree to make the pserver tree, then nobody thought "hey, maybe this will be a maintainability problem later?"
There is also no application-level interface to CVS. CVS tools typically use regexp or other parsing techniques to invoke the CVS command-line and parse its contents.
If this causes a slower transition to Subversion, it will be because people don't need to run away from the existing CVS implementation screaming anymore. A good implementation of CVS will put the emphasis of subversion right where it should be - adding compelling features which will convince people to move to it.
As far as 'less interoperability between operating systems' is concerned, I do not see why this would be restricted to BSD systems, any more than openssh was.
No thanks, I prefer visual source safe.
And the GNU people have run to Arch with the usual zealot flair. A good comparison can be found here.
Some will always be above others. Destroy the equality today, and it will appear again tomorrow. --Ralph Waldo Emerson
Because a lot of existing infrastructure still uses CVS? In the long term, transitioning this to SVN is a good idea, and I certainly wouldn't recommend that a new project use CVS. In the mean time, however, I think the OpenBSD people feel that it would be nice to have a CVS implementation that was secure and maintainable.
I am TheRaven on Soylent News
The OpenBSD folks would re-implement GCC in a heartbeat, if they could afford the man-years to do so.
-- "Makes Little Debbie look like a pile of puke!" - Moe Szyslak
I am not a fanatic about BSD vs. GPL, but let me count the ways...
OpenBSD has been slowly stripping/replacing GPL software wherever they can. Recent fatalities include gzip and gawk. It's their distribution, and they can do what they want.
But I for one am glad for OpenBSD. It fits me like a glove. I just wish that Microsoft couldn't copy so much of it.
This is no longer a necessity. There is a filesystem-oriented repository format now. We have been using it for over a month now with no problems.
You do realize you can run subversion under Apache, so that subversion security == Apache security. Right?
Yes, of course I realize. Additionally, I realize that your statement is blatently incorrect.
Subversion security != Apache Security
First, I referenced apache 1.3.x, afaik, subversion only runs under 2.
Secondly, subversion *CAN* run under apache, but it can also run standalone.
Subversion is not secure, and running under apache does not make it secure. If anything, it makes apache much more insecure.
Let me see if I understand this... there were some security problems with CVS as-is, so the OpenBSD folks did the right thing and reviewed the code, discovered any remaining problems and submitted... no, no it seems they instead wrote their own CVS.
Actually, they did review the code, find the bugs, make patches for them, and submit the patches to the CVS crew. The CVS folks did the same thing Apache did, which was to ignore the patches. The OpenBSD people were in the same boat again. They had improvements to an existing project that the project wasn't accepting. They could've forked the CVS code, which was probably what they were going to do, but the existing CVS code turned out to be so bad that starting from scratch would've been easier than forking. In light of this, most of the rest of your comment is pointless to reply to, because it's based on information you didn't have before you shot off your mouth.
For those not familiar with the state of the world, this is going to mean a slower/longer transition to subversion (the logical successor to CVS), less interoperability between operating systems for developers and yet another tool that the OpenBSD people (who clearly did not have enough work to do already), to support.
Subversion isn't the logical successor to CVS. Subversion has a handful of issues that stand in the way of it becoming even a viable competitor to CVS, much less a successor, and that doesn't address the svn design issues.
OpenCVS is also compatible with CVS, except where CVS has design issues that affect security. For the most part, most people won't ever notice the difference, and the world is better for having OpenCVS around, especially when the original CVS group doesn't want to take security patches.
Finally, the OpenBSD developers are very experienced. It's likely that OpenCVS already has fewer bugs in it than the original CVS; furthermore, the code is cleaner than CVS's and will be far easier to maintain.
What happened to OpenBSD? Wasn't it an actual member of the open source community at one point?
OpenBSD is taking care of OpenBSD. If that methodology results in a better operating system than others, then there's something flawed with the other methodologies. It's not OpenBSD's problem if you don't like them.
Oh well, as long as no one tries to make me use their mutant CVS, I'll be happy.
I'll bet that within two years, you'll be using OpenCVS with 95% exclusivity because it's a better, more secure, more stable product. It's not a good thing to rail against software projects in their infancy, because you don't know where your needs will be in time. Nobody will blame you later on for using OpenCVS.
Lastly, I'm putting an OpenCVSup on my Christmas list. It would be outstanding to not have to choose between installing a binary package and installing a Modula-3 compiler.
http://www.ie.openbsd.org/faq/faq6.html#OpenNTPD
I personally think it's something of a waste to write yet another replacement for CVS, but if they feel they need it, then great. It's open-source, it's volunteer, so nobody has any business telling these people *not* to write OpenCVS.
That said, I (and many others) consider Subversion to be the logical successor to CVS, and it seems to me that any effort spent on revision control would be better spent contributing to Subversion (or Arch maybe) instead of writing yet another version of something that's essentially obsolete.
OTOH, if they have major disagreements with the fundamental architecture of Subversion (and I understand that some people do) then maybe it would be better to just start from scratch, and design their own vision of an ideal revision control system?
Either way, it probably means more quality open source code, and in the long run, everybody ultimately benefits.
// TODO: Insert Cool Sig
You know, this is precissely how OpenBSD was born. Theo de Raadt was contributing to NetBSD until the NetBSD core decided to remove his write privileges from its sources. Theo, upset, decided to fork and start OpenBSD.
Originally, it had nothing to do with security, but rather with "openness" (from Theo's point of view, after he was kicked out). I suppose it would be called SecureBSD had security been the reason Theo started working on it.
You can find out more about this straight from the horse's mouth.
So, I suppose, forking established projects due to disagreements such as these is nothing new for the OpenBSD people.
Eh? cvs uses ssh for connecting to the server, or
l ibexec/ anoncvssh/
operates locally.
What? You're using pserver/kserver? Don't.
You can even use anoncvs to make non-anynomous
read/write accounts for users to access the CVS
repository by means of cvs server, preventing them
from directly writing into the repo.
http://mirbsd.bsdadvocacy.org/cvs.cgi/src/
My Karma isn't excellent, damn it! (And