User:Dan Polansky/Blog

From FreeMind
Jump to navigationJump to search

I am starting a blog. It is perhaps not a bad idea.

Security assessment

I am in the process of assessing the security situation of FreeMind (FreeMind 1.0.1). Since FreeMind had last final release in 2014 (now it is 2026, 12 years later), this would generally raise a security concern. After some analysis, my impression is that the concern may be overblown.

As part of the assessment, I am assessing two security issues that were reported for Freeplane.

I updated multiple wiki pages to make them more accurate especially as concerns statements relevant to a security assessment.

--Dan Polansky (talk) 07:42, 27 August 2026 (UTC)

Is Freeplane more secure than FreeMind?

I don't know. It is not obvious.

Since FreeMind saw the last final release in 2014, it did not receive any security updates since then. But also, no security issues were reported against FreeMind in its bug tracker (see also the bug tracker itself) until recently, when I opened two security issues there (this and this), one still being more thoroughly investigated by me, and one applicable to an old version of Freeplane but not to FreeMind (the issues are mentioned at Security page). See also the page Security, which I have filled with content instead of a redirect and which I will be updating with more information.

Freeplane has been receiving a stream of changes for years. In principle, changes can introduce new security issues. For instance, Freeplane's switching away from NanoXML/Lite to NanoXML/Java introduced a security issue that FreeMind does not have. If someone would do a thorough security analysis of one version of Freeplane, that security analysis would become invalid in later versions of Freeplane. Inspecting the relatively rapidly coming "stable" versions as reported at Freeplane#Stable version list, I have no idea how anyone, even an organization, would be able and willing to perform a security analysis (maybe I am too skeptical?)

As for on which Java FreeMind and Freeplane are running, both are currently running on Java 23 (FreeMind needs a modified freemind.bat with a switch to allow the deprecated security manager), but none is running on Java 24 since it disabled/permanently removed the SecurityManager class and the associated framework. Freeplane has a discussion: Freeplane can not use Java version >= 24 because of removal of the Java Security Manager, opened on 23 Nov 2024, github.com.

I found some Freeplane page on its two security issues: https://docs.freeplane.org/attic/old-mediawiki-content/Fixed_security_vulnerabilities.html (see also Freeplane#Security issues). It seems to be in some "attic". I do not know whether the Freeplane web site has an up-to-date security issue page summarizing past security issues. Maybe I would just to look better. Searching through the Github issues could reveal more.

Disclaimer: While I am a software developer and software engineer by vocation, I have no professional/on-the-job experience with software security analysis. I expect my thinking to be quite naive in some ways.

--Dan Polansky (talk)

I am very happy about using MediaWiki for FreeMind

I am very happy about using MediaWiki for FreeMind web site, the same engine/software that runs Wikipedia. It gives us revision histories going back to September 2004 or earlier. The user interface is remarkable stable. I can use the same editing and UI habits I use in Wiktionary, Wikiversity and elsewhere. I find preservation of history important; using the same wiki is so much nicer than using, say, Wayback Machine, which does not capture all changes.

Someone may find the Monobook skin dated. That can be addressed by switching to a different skin. I think the Monobook skin is actually fine, although I find Vector okay too.

One mistake we made, I think, is to treat the wiki as an open wiki. We should have allowed only the core team to edit the wiki. For discussions, forums would have been better? I don't know. There is some charm to wiki too, even for feedback and discusion. --Dan Polansky (talk) 09:54, 27 August 2026 (UTC)

New issues in trackers created

Recently, I created new issues in trackers:

I added them for tracking purposes; I do not indicate that a new version of post-1.0.1 FreeMind is going to be released any time soon. --Dan Polansky (talk) 11:38, 27 August 2026 (UTC)

Releasing FreeMind 1.0.1-plus

I am wondering whether I would find the energy/motivation to release FreeMind 1.0.1-plus, which would make FreeMind 1.0.1 run on Java 24 by removing the security sandbox function and adding a GUI option to disable scripting altogether. Scripting would be disabled by default. I am not sure I know how to produce all the production files, including those for the Mac; I never did that. The last FreeMind released myself using my SourceForge account was some FreeMind before 0.7.1, perhaps FreeMind 0.6.7 (0.7.1 would have been the first release that was released in SourceForge by Christian Foltin, I think). I could at least release the binary zip and the source zip; that is straightforward. Or perhaps "ant post" would do the trick? I don't know. It would be kind of nice to have FreeMind running on the latest Java, with an easy option to disable Groovy scripting altogether.

FreeMind downloads at SourceForge still see ca. 2000 downloads per week. Some people still use FreeMind, not having switched to Freeplane.

As for the version number, perhaps 1.0.1-plus is not the best one. Would 1.0.2 do? Or does it look like too small an increment, given that the scripting restrictions would be lifted? Should this be 1.2.0, to skip over 1.1.0 occupied by a beta that, from what I recall, reworked the attribute function quite a bit? --Dan Polansky (talk) 09:43, 27 August 2026 (UTC)

Storage of feature requests in the wiki vs. SourceForge tracker

Historically, we allowed or even encouraged placement of feature requests/requests for enhancements in the wiki: Requests for enhancements. Alternatively, they could have been placed to a SourceForge tracker.

Both ways have pros and cons. The tracker way opens a possible discussion concerning a feature, which is quite a bit harder in the wiki. Maintaining a single wiki page for requests requires quite a bit of editing discipline. It can be done, but the trackers enforce the discipline automatically. Trackers are a proven/tested way to manage issues, whether bugs of feature requests. The trackers in SourceForge do not seem to offer a view in which not only the titles but also the leading part of the issue text is shown, and then, skimming the issue list is not as useful as it could be.

Perhaps one could have advantages of both if one would use the trackers as the primary issue storage, and then created reports in the wiki based on that storage. I did something of the sort in Finishing 0.9.0. --Dan Polansky (talk) 11:51, 27 August 2026 (UTC)

A massive spike in downloads for FreeMind 1.0.1 with Java runtime embedded

Stats for FreeMind 1.0.1 installer for Windows with Java runtime embedded [1] show a massive spike in downloads in June 2026. The total in the linked report was about 265,000, which includes the non-spike downloads, but these would be negligible. It is not clear what drove the skipe. Sure enough, FreeMind 1.0.1 does not run on Java 24 released in 2025, which could be one element in the explanation. Even so, it does not explain what was so special about that one month. --Dan Polansky (talk) 13:01, 27 August 2026 (UTC)

Retrieved from "https://freemind.sourceforge.io/wiki/index.php?title=User:Dan_Polansky/Blog&oldid=16142"