Re: Release commons-lang:2.6.1 with a fix for CVE-2025-48924

2025年11月16日 14:44:17 -0800

Hi Phil,
On 14.11.2025 22:44, Phil Steitz wrote:
>> On Nov 14, 2025, at 2:19 PM, Elliotte Rusty Harold <[email protected]> 
>> wrote:
>> On Fri, Nov 14, 2025 at 8:15 AM Vladimir Sitnikov 
>> <[email protected]> wrote:
>>> How much does the release cost?
>>> Is 10ドル enough? Is 50ドル enough? Is 100ドル enough?
>>
>> You'd have to ask someone who has release permissions, but I suspect
>> you're off by more than one order of magnitude. And if it's not worth
>> that much to anyone, then it's probably not actually all that
>> important.
> 
> You guys are both off by a category. Believe it or not, people
> actually volunteer here. Unless people who actually do work here
> object, I will work on an RC this weekend.
I think Elliotte's point is precisely that people don't work for *free*,
but *volunteer* their time.
Your work on a release still has a market value. A Logback release is
valued at around 1,200ドル (see [1]), and that number does not seem inflated.
I don’t think I’ve ever spent less than four hours on a Log4j release,
even with an almost fully automated process. Reviving Commons Lang 2
would be *significantly more* expensive.
To be clear, I am not suggesting that users should pay the ASF or its
committers for releases. But if commercial users still find Commons Lang
2 in their dependency stack 14 years after the release of Commons Lang
3, they should seriously consider contributing upgrades from Lang 2 to
Lang 3 across the OSS projects they rely on.
Piotr
[1] https://github.com/sponsors/qos-ch?frequency=one-time
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to