User:Dan Polansky/Blog - Revision history

Dan Polansky: /* New issues in trackers created */

2026-08-28T12:24:50Z

New issues in trackers created

← Older revision		Revision as of 12:24, 28 August 2026
Line 45:		Line 45:
	* https://sourceforge.net/p/freemind/feature-requests/905/ Remove scripting from physical styles/patterns		* https://sourceforge.net/p/freemind/feature-requests/905/ Remove scripting from physical styles/patterns
	* https://sourceforge.net/p/freemind/feature-requests/906/ Store node scripts in their own XML element rather than in user attributes		* https://sourceforge.net/p/freemind/feature-requests/906/ Store node scripts in their own XML element rather than in user attributes
			* https://sourceforge.net/p/freemind/feature-requests/907/ Store a binding of a menu item to user Groovy script in FreeMind home directory
	* https://sourceforge.net/p/freemind/issues/40/ File history.txt has suspect section FreeMind 0.8.1		* https://sourceforge.net/p/freemind/issues/40/ File history.txt has suspect section FreeMind 0.8.1
	I added them for tracking purposes; I do not indicate that a new version of post-1.0.1 FreeMind is going to be released any time soon.		I added them for tracking purposes; I do not indicate that a new version of post-1.0.1 FreeMind is going to be released any time soon.
	--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 11:38, 27 August 2026 (UTC)		--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 11:38, 27 August 2026 (UTC)
			: Expanded. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 12:24, 28 August 2026 (UTC)

	== Releasing FreeMind 1.0.1-plus ==		== Releasing FreeMind 1.0.1-plus ==

Dan Polansky: /* Is Freeplane more secure than FreeMind? */

2026-08-28T10:16:34Z

Is Freeplane more secure than FreeMind?

← Older revision		Revision as of 10:16, 28 August 2026
Line 25:		Line 25:
	--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]])		--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]])

	I have now completed some first half-decent analysis of formulas in Freeplane, in [[Freeplane#Formulas]]. It exemplifies how added complexity and high technology adds additional expository surface, also from security standpoint. Since Freeplane formulas are based on Groovy and are automatically evaluated when a mind map is loaded, Freeplane exposed (before it fixed its ~~secuirity~~ issue) the users to the kind of security risk that FreeMind users never had; FreeMind does not have formulas and its mind maps scripts are not automatically evaluated when a mind map is loaded.		I have now completed some first half-decent analysis of formulas in Freeplane, in [[Freeplane#Formulas]]. It exemplifies how added complexity and high technology adds additional expository surface, also from security standpoint. Since Freeplane formulas are based on Groovy and are automatically evaluated when a mind map is loaded, Freeplane exposed (before it fixed its security issue) the users to the kind of security risk that FreeMind users never had; FreeMind does not have formulas and its mind maps scripts are not automatically evaluated when a mind map is loaded.

	I am reminded of a Dijskstra quote about untamed complexity being the bane of software making or the like. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 10:15, 28 August 2026 (UTC)		I am reminded of a Dijskstra quote about untamed complexity being the bane of software making or the like. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 10:16, 28 August 2026 (UTC)

	== I am very happy about using MediaWiki for FreeMind ==		== I am very happy about using MediaWiki for FreeMind ==

Dan Polansky: /* Is Freeplane more secure than FreeMind? */

2026-08-28T10:15:38Z

Is Freeplane more secure than FreeMind?

← Older revision		Revision as of 10:15, 28 August 2026
Line 24:		Line 24:

	--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]])		--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]])

			I have now completed some first half-decent analysis of formulas in Freeplane, in [[Freeplane#Formulas]]. It exemplifies how added complexity and high technology adds additional expository surface, also from security standpoint. Since Freeplane formulas are based on Groovy and are automatically evaluated when a mind map is loaded, Freeplane exposed (before it fixed its secuirity issue) the users to the kind of security risk that FreeMind users never had; FreeMind does not have formulas and its mind maps scripts are not automatically evaluated when a mind map is loaded.

			I am reminded of a Dijskstra quote about untamed complexity being the bane of software making or the like. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 10:15, 28 August 2026 (UTC)

	== I am very happy about using MediaWiki for FreeMind ==		== I am very happy about using MediaWiki for FreeMind ==

Dan Polansky: /* A massive spike in downloads for FreeMind 1.0.1 with Java runtime embedded */

2026-08-27T13:01:34Z

A massive spike in downloads for FreeMind 1.0.1 with Java runtime embedded

← Older revision		Revision as of 13:01, 27 August 2026
Line 60:		Line 60:

	== A massive spike in downloads for FreeMind 1.0.1 with Java runtime embedded ==		== A massive spike in downloads for FreeMind 1.0.1 with Java runtime embedded ==
	Stats for FreeMind 1.0.1 installer for Windows with Java runtime embedded [https://sourceforge.net/projects/freemind/files/freemind/1.0.1/FreeMind-Windows-Installer-1.0.1-max-java-installer-embedded.exe/stats/timeline?dates=2026-06-01%20to%202026-07-14] show massive spike in downloads. The total was about 265,000, which includes the non-spike downloads, but these would be negligible. It is not clear what drove the skipe. Sure enough, FreeMind 1.0.1 does not run on Java 24 released in 2025, which could be one element in the explanation. Even so, it does not explain what was so special about that one month. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 13:00, 27 August 2026 (UTC)		Stats for FreeMind 1.0.1 installer for Windows with Java runtime embedded [https://sourceforge.net/projects/freemind/files/freemind/1.0.1/FreeMind-Windows-Installer-1.0.1-max-java-installer-embedded.exe/stats/timeline?dates=2026-06-01%20to%202026-07-14] show a massive spike in downloads in June 2026. The total in the linked report was about 265,000, which includes the non-spike downloads, but these would be negligible. It is not clear what drove the skipe. Sure enough, FreeMind 1.0.1 does not run on Java 24 released in 2025, which could be one element in the explanation. Even so, it does not explain what was so special about that one month. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 13:01, 27 August 2026 (UTC)

Dan Polansky at 13:00, 27 August 2026

2026-08-27T13:00:33Z

← Older revision		Revision as of 13:00, 27 August 2026
Line 58:		Line 58:

	Perhaps one could have advantages of both if one would use the trackers as the primary issue storage, and then created reports in the wiki based on that storage. I did something of the sort in [[Finishing 0.9.0]]. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 11:51, 27 August 2026 (UTC)		Perhaps one could have advantages of both if one would use the trackers as the primary issue storage, and then created reports in the wiki based on that storage. I did something of the sort in [[Finishing 0.9.0]]. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 11:51, 27 August 2026 (UTC)

			== A massive spike in downloads for FreeMind 1.0.1 with Java runtime embedded ==
			Stats for FreeMind 1.0.1 installer for Windows with Java runtime embedded [https://sourceforge.net/projects/freemind/files/freemind/1.0.1/FreeMind-Windows-Installer-1.0.1-max-java-installer-embedded.exe/stats/timeline?dates=2026-06-01%20to%202026-07-14] show massive spike in downloads. The total was about 265,000, which includes the non-spike downloads, but these would be negligible. It is not clear what drove the skipe. Sure enough, FreeMind 1.0.1 does not run on Java 24 released in 2025, which could be one element in the explanation. Even so, it does not explain what was so special about that one month. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 13:00, 27 August 2026 (UTC)

Dan Polansky: /* Storage of feature requests in the wiki vs. SourceForge tracker */

2026-08-27T11:51:19Z

Storage of feature requests in the wiki vs. SourceForge tracker

← Older revision		Revision as of 11:51, 27 August 2026
Line 57:		Line 57:
	Both ways have pros and cons. The tracker way opens a possible discussion concerning a feature, which is quite a bit harder in the wiki. Maintaining a single wiki page for requests requires quite a bit of editing discipline. It can be done, but the trackers enforce the discipline automatically. Trackers are a proven/tested way to manage issues, whether bugs of feature requests. The trackers in SourceForge do not seem to offer a view in which not only the titles but also the leading part of the issue text is shown, and then, skimming the issue list is not as useful as it could be.		Both ways have pros and cons. The tracker way opens a possible discussion concerning a feature, which is quite a bit harder in the wiki. Maintaining a single wiki page for requests requires quite a bit of editing discipline. It can be done, but the trackers enforce the discipline automatically. Trackers are a proven/tested way to manage issues, whether bugs of feature requests. The trackers in SourceForge do not seem to offer a view in which not only the titles but also the leading part of the issue text is shown, and then, skimming the issue list is not as useful as it could be.

	--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 11:48, 27 August 2026 (UTC)		Perhaps one could have advantages of both if one would use the trackers as the primary issue storage, and then created reports in the wiki based on that storage. I did something of the sort in [[Finishing 0.9.0]]. --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 11:51, 27 August 2026 (UTC)

Dan Polansky at 11:48, 27 August 2026

2026-08-27T11:48:20Z

← Older revision		Revision as of 11:48, 27 August 2026
Line 51:		Line 51:

	As for the version number, perhaps 1.0.1-plus is not the best one. Would 1.0.2 do? Or does it look like too small an increment, given that the scripting restrictions would be lifted? Should this be 1.2.0, to skip over 1.1.0 occupied by a beta that, from what I recall, reworked the attribute function quite a bit? --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 09:43, 27 August 2026 (UTC)		As for the version number, perhaps 1.0.1-plus is not the best one. Would 1.0.2 do? Or does it look like too small an increment, given that the scripting restrictions would be lifted? Should this be 1.2.0, to skip over 1.1.0 occupied by a beta that, from what I recall, reworked the attribute function quite a bit? --[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 09:43, 27 August 2026 (UTC)

			== Storage of feature requests in the wiki vs. SourceForge tracker ==
			Historically, we allowed or even encouraged placement of feature requests/requests for enhancements in the wiki: [[Requests for enhancements]]. Alternatively, they could have been placed to a SourceForge tracker.

			Both ways have pros and cons. The tracker way opens a possible discussion concerning a feature, which is quite a bit harder in the wiki. Maintaining a single wiki page for requests requires quite a bit of editing discipline. It can be done, but the trackers enforce the discipline automatically. Trackers are a proven/tested way to manage issues, whether bugs of feature requests. The trackers in SourceForge do not seem to offer a view in which not only the titles but also the leading part of the issue text is shown, and then, skimming the issue list is not as useful as it could be.

			--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 11:48, 27 August 2026 (UTC)

Dan Polansky: /* New issues in trackers created */

2026-08-27T11:38:03Z

New issues in trackers created

← Older revision		Revision as of 11:38, 27 August 2026
Line 40:		Line 40:
	* https://sourceforge.net/p/freemind/feature-requests/904/ Add option to disable Groovy scripting altogether		* https://sourceforge.net/p/freemind/feature-requests/904/ Add option to disable Groovy scripting altogether
	* https://sourceforge.net/p/freemind/feature-requests/905/ Remove scripting from physical styles/patterns		* https://sourceforge.net/p/freemind/feature-requests/905/ Remove scripting from physical styles/patterns
			* https://sourceforge.net/p/freemind/feature-requests/906/ Store node scripts in their own XML element rather than in user attributes
	* https://sourceforge.net/p/freemind/issues/40/ File history.txt has suspect section FreeMind 0.8.1		* https://sourceforge.net/p/freemind/issues/40/ File history.txt has suspect section FreeMind 0.8.1
	I added them for tracking purposes; I do not indicate that a new version of post-1.0.1 FreeMind is going to be released any time soon.		I added them for tracking purposes; I do not indicate that a new version of post-1.0.1 FreeMind is going to be released any time soon.
	--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 10:44, 27 August 2026 (UTC)		--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 11:38, 27 August 2026 (UTC)

	== Releasing FreeMind 1.0.1-plus ==		== Releasing FreeMind 1.0.1-plus ==

Dan Polansky: /* New issues in trackers created */

2026-08-27T10:44:15Z

New issues in trackers created

← Older revision		Revision as of 10:44, 27 August 2026
Line 37:		Line 37:
	* https://sourceforge.net/p/freemind/bugs/1310/ Removal of SecurityManager in Java 24 leads to FreeMind not starting		* https://sourceforge.net/p/freemind/bugs/1310/ Removal of SecurityManager in Java 24 leads to FreeMind not starting
	* https://sourceforge.net/p/freemind/bugs/1311/ Freeplane security issue on parsing of mind map XML to be assessed for FreeMind		* https://sourceforge.net/p/freemind/bugs/1311/ Freeplane security issue on parsing of mind map XML to be assessed for FreeMind
	* https://sourceforge.net/p/freemind/feature-requests/904/ Add option to disable Groovy scripting altogether
	* https://sourceforge.net/p/freemind/feature-requests/903/ Add Java version to the Help > About popup window		* https://sourceforge.net/p/freemind/feature-requests/903/ Add Java version to the Help > About popup window
			* https://sourceforge.net/p/freemind/feature-requests/904/ Add option to disable Groovy scripting altogether
			* https://sourceforge.net/p/freemind/feature-requests/905/ Remove scripting from physical styles/patterns
	* https://sourceforge.net/p/freemind/issues/40/ File history.txt has suspect section FreeMind 0.8.1		* https://sourceforge.net/p/freemind/issues/40/ File history.txt has suspect section FreeMind 0.8.1
	I added them for tracking purposes; I do not indicate that a new version of post-1.0.1 FreeMind is going to be released any time soon.		I added them for tracking purposes; I do not indicate that a new version of post-1.0.1 FreeMind is going to be released any time soon.
	--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 09:22, 27 August 2026 (UTC)		--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]) 10:44, 27 August 2026 (UTC)

	== Releasing FreeMind 1.0.1-plus ==		== Releasing FreeMind 1.0.1-plus ==

Dan Polansky: /* Is Freeplane more secure than FreeMind? */

2026-08-27T10:26:52Z

Is Freeplane more secure than FreeMind?

← Older revision		Revision as of 10:26, 27 August 2026
Line 21:		Line 21:
	I found some Freeplane page on its two security issues: https://docs.freeplane.org/attic/old-mediawiki-content/Fixed_security_vulnerabilities.html (see also [[Freeplane#Security issues]]). It seems to be in some "attic". I do not know whether the Freeplane web site has an up-to-date security issue page summarizing past security issues. Maybe I would just to look better. Searching through the Github issues could reveal more.		I found some Freeplane page on its two security issues: https://docs.freeplane.org/attic/old-mediawiki-content/Fixed_security_vulnerabilities.html (see also [[Freeplane#Security issues]]). It seems to be in some "attic". I do not know whether the Freeplane web site has an up-to-date security issue page summarizing past security issues. Maybe I would just to look better. Searching through the Github issues could reveal more.

	--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]]~~) 09:57, 27 August 2026 (UTC~~)		Disclaimer: While I am a software developer and software engineer by vocation, I have no professional/on-the-job experience with software security analysis. I expect my thinking to be quite naive in some ways.

			--[[User:Dan Polansky\|Dan Polansky]] ([[User talk:Dan Polansky\|talk]])

	== I am very happy about using MediaWiki for FreeMind ==		== I am very happy about using MediaWiki for FreeMind ==