User:Dan Polansky/Blog

I am starting a blog. It is perhaps not a bad idea.

Security assessment

I am in the process of assessing the security situation of FreeMind (FreeMind 1.0.1). Since FreeMind had last final release in 2014 (now it is 2026, 12 years later), this would generally raise a security concern. After some analysis, my impression is that the concern may be overblown.

As part of the assessment, I am assessing two security issues that were reported for Freeplane.

I updated multiple wiki pages to make them more accurate especially as concerns statements relevant to a security assessment.

--Dan Polansky (talk) 07:42, 27 August 2026 (UTC)

Is Freeplane more secure than FreeMind?

I don't know. It is not obvious.

Since FreeMind saw the last final release in 2014, it did not receive any security updates since then. But also, no security issues were reported against FreeMind in its bug tracker (see also the bug tracker itself) until recently, when I opened two security issues there, one still being more thoroughly investigated by me, and one applicable to an old version of Freeplane but not to FreeMind (the issues are mentioned at Security page). See also the page Security, which I have filled with content instead of a redirect and which I will be updating with more information.

Freeplane has been receiving a stream of changes for years. In principle, changes can introduce new security issues. For instance, Freeplane's switching away from NanoXML/Lite to NanoXML/Java introduced a security issue that FreeMind does not have. If someone would do a thorough security analysis of one version of Freeplane, that security analysis would become invalid in later versions of Freeplane.

As for on which Java FreeMind and Freeplane are running, both are currently running on Java 23, but none is running on Java 24 since it disabled/permanently removed the SecurityManager class and the associated framework¨. (I must have seen some bug report or task in Freeplane Github on that.)

I found some Freeplane page on its two security issues: https://docs.freeplane.org/attic/old-mediawiki-content/Fixed_security_vulnerabilities.html. It seems to be in some "attic". I do not know where they are an up-to-date security issue page summarizing past security issues. Maybe I would just to look better. Searching through the Github issues could reveal more.

--Dan Polansky (talk) 08:10, 27 August 2026 (UTC)