User:Dan Polansky/Blog

I am starting a blog. It is perhaps not a bad idea.

Security assessment

I am in the process of assessing the security situation of FreeMind (FreeMind 1.0.1). Since FreeMind had last final release in 2014 (now it is 2026, 12 years later), this would generally raise a security concern. After some analysis, my impression is that the concern may be overblown.

As part of the assessment, I am assessing two security issues that were reported for Freeplane.

I updated multiple wiki pages to make them more accurate especially as concerns statements relevant to a security assessment.

--Dan Polansky (talk) 07:42, 27 August 2026 (UTC)

Is Freeplane more secure than FreeMind?

I don't know. It is not obvious.

Since FreeMind saw the last final release in 2014, it did not receive any security updates since then. But also, no security issues were reported against FreeMind in its bug tracker (see also the bug tracker itself) until recently, when I opened two security issues there, one still being more thoroughly investigated by me, and one applicable to an old version of Freeplane but not to FreeMind (the issues are mentioned at Security page). See also the page Security, which I have filled with content instead of a redirect and which I will be updating with more information.

Freeplane has been receiving a stream of changes for years. In principle, changes can introduce new security issues. For instance, Freeplane's switching away from NanoXML/Lite to NanoXML/Java introduced a security issue that FreeMind does not have. If someone would do a thorough security analysis of one version of Freeplane, that security analysis would become invalid in later versions of Freeplane. Inspecting the relatively rapidly coming "stable" versions as reported at Freeplane#Stable version list, I have no idea how anyone, even an organization, would be able and willing to perform a security analysis (maybe I am too skeptical?)

As for on which Java FreeMind and Freeplane are running, both are currently running on Java 23 (FreeMind needs a modified freemind.bat with a switch to allow the deprecated security manager), but none is running on Java 24 since it disabled/permanently removed the SecurityManager class and the associated framework¨. (I must have seen some bug report or task in Freeplane Github on that.)

I found some Freeplane page on its two security issues: https://docs.freeplane.org/attic/old-mediawiki-content/Fixed_security_vulnerabilities.html. It seems to be in some "attic". I do not know where they are an up-to-date security issue page summarizing past security issues. Maybe I would just to look better. Searching through the Github issues could reveal more.

--Dan Polansky (talk) 08:57, 27 August 2026 (UTC)

I am very happy about using MediaWiki for FreeMind

I am very happy about using MediaWiki for FreeMind. It gives us revision histories going back to 2005, I think. The user interface is remarkable stable. I can use the same editing and UI habits I use in Wiktionary, Wikiversity and elsewhere.

Someone may find the Monobook skin dated. That can be addressed by switching to a different skin. I think the Monobook skin is actually fine, although I find Vector okay too.

One mistake we made, I think, is to treat the wiki as an open wiki. We should have allowed only the core team to edit the wiki. For discussions, forums would have been better? I don't know. There is some charm to wiki too, even for feedback and discusion. --Dan Polansky (talk) 08:36, 27 August 2026 (UTC)