February 2014 - Koha-devel - lists.koha-community.org

Reporting security bugs
by Galen Charlton 05 Feb '14

05 Feb '14

Hi, There is now a mechanism in place for reporting security bugs via Bugzilla. If you look at the footer, you should now see a 'Report security bug' link. This allows someone who has a Bugzilla account to enter a bug in a new BZ product called 'Koha security'. Bugs reported in this fashion are visible only to the reporter and to members of a Koha security group currently consisting of the following individuals: Bernardo Gonzalez Kriegel Chris Cormack Frère Sébastien Marie Fridolin SOMERS Galen Charlton Ian Walls Jared Camins-Esakov Jonathan Druart Katrin Fischer Kyle M Hall M. de Rooy MJ Ray (software.coop) Paul Poulain Robin Sheat Tomás Cohen Arazi The idea is that members of the security group would be responsible for evaluating the bugs, fixing them (and drawing in outside help if needed), and releasing the fixes. Once a fix is released, the relevant bug(s) would be sanitized to remove mention of direct exploits, then have their products changed to 'Koha' so that they would be visible to all. This is not set in stone, so I invite discussion of the security policy. I also invite anybody who may have been sitting on security bugs for lack of a means to report them securely to go ahead and use BZ. Regards, Galen -- Galen Charlton Manager of Implementation Equinox Software, Inc. / The Open Source Experts email: gmc(a)esilibrary.com direct: +1 770-709-5581 cell: +1 404-984-4366 skype: gmcharlt web: http://www.esilibrary.com/ Supporting Koha and Evergreen: http://koha-community.org & http://evergreen-ils.org

3 3

Some thoughts on the SIP-server scalability
by Petter Goksøyr Åsen 03 Feb '14

03 Feb '14

Dear Koha devs! I work at at Oslo public library. We recently decided to go for Koha, and are now working on planning the migration from our current ILS. Our library is fully automated, with RFID-checkin machines taking care of almost all of our circulation. We currently have around 50 of these running at 15 branches around the city. Because of this, we naturally need the SIP-server to handle quite a load. I checked the logs of our current ILS, and found the number of SIP-messages peeked at 58 per second. (In addition to the checkin-machines - we have a lot of RFID-workstations which potentially also will make use of SIP) Correct me if I'm wrong, but this is what I have found out: Koha's SIP server can only handle one request at a time. So if you need more you have to spin up more SIP-severes. This fine for a few, but try to spin up 30 of theese - it takes 15 minutes just to get them all started on a new box with plenty of RAM & CPU. The servers are independent processes which share no resources.. Instead of forking seperate processes for each connection - what about a server which runs as _one_ process and handles multiple tcp connections? I've read about and tested Poe (http://poe.perl.org/) with this in mind - and it seems pretty nice. Poe is an evented framework (akin to Node for javascript or EventMachine in Ruby) which handles such multiplexing of severeal connections. Poe seems very mature, but I'm not competent to judge if its a good fit. There are other options as well (ex IO::Async & AnyEvent ) Any thoughts? We're also very keen on hearing about experiences from other automated Koha libraries, especially those with more than a checkin-machines. Best regards, Petter Goksøyr Åsen Deichmanske bibliotek / Oslo Public Library

4 7

Add itemnumber constraint to aqorders_items
by Marcel de Rooy 03 Feb '14

03 Feb '14

Hi, Would you mind putting a FK constraint on itemnumber in aqorders_items (with cascaded delete) ? Please feel free to join the discussion on report http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11617 Thanks, Marcel

1 0

meetings.koha-community.org site - link for 2014 meetings
by David Nind 02 Feb '14

02 Feb '14

I thought I would post this here first - I can log a bug report if that is the right way to do it. For http://meetings.koha-community.org/ there is no link on the main page or sub pages for the 2014 meetings. A folder for 2014 exists though: http://meetings.koha-community.org/2014/ I couldn't find the details of who looks after this site on http://wiki.koha-community.org/wiki/Website_Administration David Nind | david.nind(a)gmail.com PO Box 12367, Thorndon, Wellington, New Zealand 6144 h. +64 4 9720 600 | m. +64 21 0537 847 | w. +64 4 8906 098

2 2