<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Bad idea,</p>
<p>I don't know what purple-otr is, but I see it hasn't taken any
patches from upstream past 2013 and is still vulnerable to:
<a class="moz-txt-link-freetext" href="https://nvd.nist.gov/vuln/detail/CVE-2015-8833">https://nvd.nist.gov/vuln/detail/CVE-2015-8833</a><br>
</p>
On 06/03/2025 15:04, Howard Chu wrote:<br>
<blockquote type="cite">Hefee wrote:<br>
> Hey,<br>
<br>
> thanks a lot for some insights into the the "project status"
and this makes me feel comfortable to ship libotr and pidgin-otr
in trixie.<br>
<br>
I would still recommend using purple-otr instead, since it
supports both pidgin and finch.<br>
<a class="moz-txt-link-freetext" href="https://github.com/hyc/purple-otr">https://github.com/hyc/purple-otr</a><br>
<br>
<br>
> Regards,<br>
<br>
> hefee<br>
<br>
> --<br>
<br>
> On Mittwoch, 5. März 2025 01:03:26 Mitteleuropäische
Normalzeit Jurre van Bergen wrote:<br>
>> Hi Hefee,<br>
>><br>
>> On 04/03/2025 22:26, Hefee wrote:<br>
>>> Hey,<br>
>>><br>
>>> thanks a lot for this fast response on the git repos,
than I keep the links to point to otr.cyperpunks.ca.<br>
>><br>
>> Perfect!<br>
>><br>
>>> That at least give me a first idea, that there are
still people caring about libotr. *yeah*<br>
>>><br>
>>> As the next Debian release (trixie) will soon happen,
I started to look at the packages, if they are still vital for the
next years.<br>
>>><br>
>>> libotr/pidgin-otr doesn't seen any update since 2016.
As I cannot scan through the bugtracker I cannot decide, if bugs
are just piling up or is OTR<br>
>>> just in "maintanacne mode". With "maintance mode" I
mean no active development, but issues may be fixed, if they are
to big to ignore ;)<br>
>><br>
>> Those will get fixed yeah!<br>
>><br>
>>> * Are you aware of any issue, that would mark libotr
or pidgin-otr as please do not ship it to endusers?<br>
>><br>
>> Personally no, except that Pidgin itself is a trash fire
:)<br>
>><br>
>>> * Are security vulnerabilities still been processed?<br>
>><br>
>> Yes, if someone reports a security vulnerability and
becomes known to us we'd ship a new version and will request a
cve.<br>
>><br>
>> Best,<br>
>><br>
>> Jurre<br>
>><br>
>>> _______________________________________________
OTR-dev mailing list <a class="moz-txt-link-abbreviated" href="mailto:OTR-dev@lists.cypherpunks.ca">OTR-dev@lists.cypherpunks.ca</a>
<a class="moz-txt-link-freetext" href="http://lists.cypherpunks.ca/mailman/listinfo/otr-dev">http://lists.cypherpunks.ca/mailman/listinfo/otr-dev</a><br>
<br>
<br>
> _______________________________________________ OTR-dev
mailing list <a class="moz-txt-link-abbreviated" href="mailto:OTR-dev@lists.cypherpunks.ca">OTR-dev@lists.cypherpunks.ca</a>
<a class="moz-txt-link-freetext" href="http://lists.cypherpunks.ca/mailman/listinfo/otr-dev">http://lists.cypherpunks.ca/mailman/listinfo/otr-dev</a><br>
<br>
<br>
<br>
</blockquote>
<span style="white-space: pre-wrap; display: block; width: 98vw;">> _______________________________________________
> OTR-dev mailing list
> <a class="moz-txt-link-abbreviated" href="mailto:OTR-dev@lists.cypherpunks.ca">OTR-dev@lists.cypherpunks.ca</a>
> <a class="moz-txt-link-freetext" href="http://lists.cypherpunks.ca/mailman/listinfo/otr-dev">http://lists.cypherpunks.ca/mailman/listinfo/otr-dev</a>
</span><br>
</body>
</html>