microcosm-cc / bluemonday

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

Home Page:https://github.com/microcosm-cc/bluemonday

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

New maintainers for bluemonday in 2024

buro9 opened this issue · comments

commented

This is a public declaration that I intend to pass control of bluemonday to new maintainers as of March / April (perhaps sooner).

The reasons for this are multiple:

  1. This project was originally written in a few days and created for a small website, but is currently used by 10.8k projects, many of which are content management systems in their own right and in turn they power hundreds of thousands of websites and projects (if not more), it should have more eyeballs on it than it does, and it should not be possible for a single person to impact such a scope, and bluemonday has very much become https://xkcd.com/2347/

  1. I barely code now, the last 5+ years of my "career" have been predominantly spent in a management and leadership role, you are more likely to find me in a meeting, speaking to a customer, jumping on a plane, or going into a senior leadership call... I struggle to find time to code, and when I code it's usually for myself and not for an OSS project, I've also spent more time in other languages and feel Rusty about Go, I may be doing it wrong and no longer know.

  2. I'm not meeting the expectations of you, the community, as I've been fairly opinionated about choosing an extremely secure position — IMHO this is right, but I'm not particularly aware of other workflows community members have and how to accommodate "I have this desire to run super old version, you must let me do this", I'm not even sure I should care, but I care as I care too much so it causes stress for me, it is very much https://xkcd.com/1172/

  1. Sometimes you just have to let go, most of my life has been defined by doing things for others and not so much doing things for myself... I give to everyone, but perhaps I need to stop that and figure out how to give to me, I'm older and childhood trauma has caught up to me, I would like less on my plate so that I have more time to be kind to myself and to focus on my own needs, which includes being able to focus even on my professional things without having to worry about a project I wrote more than a decade ago. The business school speak here is give away your lego and it's an important thing to remember to do, none of us have to carry projects forever, letting go is an important part of the process.

Why this post now?

Well the new maintainers aren't quite ready, and won't be until maybe March / April, but I have started cleaning up other things such as migrating all of the other repos out of https://github.com/microcosm-cc/ and off of GitHub, and so if people notice and this causes concern... do not be concerned, the new maintainers are good people and excellent engineers, if you're well connected to the Go community you likely already know them.

FAQ stuff:

  • License will not change
  • CLA still will not be required
  • It'll be multiple (2 or 3) very well known Go OSS engineers and these have already been selected
  • Will there be updates / releases before the handover? Yes if there are CVEs, maybe if not (just to tidy things up)
commented

Added @empijei and @FiloSottile to a new team, and set them as admins to the repo.

Note: There is zero expectation for them to do anything in the next several months, but this is just laying the ground for a handover. The repo will be gently neglected for the interim, but I (@buro9) will take CVEs very seriously if they arise before the handover.