You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@openoffice.apache.org by Andrea Pescetti <pe...@apache.org> on 2014/04/23 09:03:56 UTC
OpenOffice bugs and confidential documents
When someone complained that OpenOffice crashed on their company
documents, I've always answered that either they made the documents
available in Bugzilla or we couldn't do anything about it. Now it
happened to me and I realize that my suggestion is easier said than done!
I received a DOCX document that OpenOffice Writer cannot open (crash).
The company that sent it to me cannot make it public: it's a
confidential work document.
In general how can we handle this? It's very important for the project
to have a good reputation in companies, so if we crash on company
templates we should be able to know it and fix it.
What options do we have available? Do we accept private attachments in
Bugzilla? Can a properly obtained stack trace replace the need for the
actual document, maybe? Other options?
Note: in my case I already asked for, and received, a working ODT
version. I'm interested in the generic discussion.
Regards,
Andrea.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Rob Weir <ro...@apache.org>.
On Wed, Apr 23, 2014 at 3:03 AM, Andrea Pescetti <pe...@apache.org> wrote:
> When someone complained that OpenOffice crashed on their company documents,
> I've always answered that either they made the documents available in
> Bugzilla or we couldn't do anything about it. Now it happened to me and I
> realize that my suggestion is easier said than done!
>
> I received a DOCX document that OpenOffice Writer cannot open (crash). The
> company that sent it to me cannot make it public: it's a confidential work
> document.
>
> In general how can we handle this? It's very important for the project to
> have a good reputation in companies, so if we crash on company templates we
> should be able to know it and fix it.
>
> What options do we have available? Do we accept private attachments in
> Bugzilla? Can a properly obtained stack trace replace the need for the
> actual document, maybe? Other options?
>
We have the technical ability to do this in Bugzilla. We do that with
security-related bugs, for example. They are only visible to those on
the security team. The entire bug report is restricted, not just the
attachment.
But I don't think this is a good practice to do in general. I don't
think we want volunteers to consider themselves responsible for the
handling of their confidential documents.
-Rob
> Note: in my case I already asked for, and received, a working ODT version.
> I'm interested in the generic discussion.
>
> Regards,
> Andrea.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Oliver-Rainer Wittmann <or...@googlemail.com>.
Hi,
On 03.05.2014 13:46, Andrea Pescetti wrote:
> Jürgen Schmidt wrote:
>> On 4/23/14 9:03 AM, Andrea Pescetti wrote:
>>> I received a DOCX document that OpenOffice Writer cannot open (crash).
>>> The company that sent it to me cannot make it public ...
>> I understand the problem and we know this situation. I believe it is
>> not easy to address in an open source project. Either the documents can
>> be cleaned up and confidential data get removed or the company contacted
>> another company where special agreements can be done.
>
> In the case of a crash, you are always on the "receiver" side, meaning
> that the DOCX document causing the crash is something that people sent
> you. And these people may be uninterested in problems with OpenOffice.
>
> Besides the various options for anonymizing a document either on the
> "sender" or "receiver" side, already discussed in the thread and quite
> interesting in themselves, are there other options involving only the
> document and (a specially configured version of) OpenOffice?
>
> I mean, if the first thing a developer does on a crash is to obtain a
> meaningful stacktrace and analyze it, and the document becomes mostly
> irrelevant at that point, then a stacktrace could be enough to improve
> the quality of OpenOffice without needing to access confidential data.
> Or is that not enough to work with?
>
A stacktrace might be enough.
But from my experience at least half of the crashes I had fixed are
sympthoms on errors which occur much earlier in the processing. Thus, in
most cases a sample document is needed to fix a crash. But a stacktrace
could be the first information which should be share - in the one or the
other case this might be enough to fix the crash.
Best regards, Oliver.
> Regards,
> Andrea.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Andrea Pescetti <pe...@apache.org>.
Jürgen Schmidt wrote:
> On 4/23/14 9:03 AM, Andrea Pescetti wrote:
>> I received a DOCX document that OpenOffice Writer cannot open (crash).
>> The company that sent it to me cannot make it public ...
> I understand the problem and we know this situation. I believe it is
> not easy to address in an open source project. Either the documents can
> be cleaned up and confidential data get removed or the company contacted
> another company where special agreements can be done.
In the case of a crash, you are always on the "receiver" side, meaning
that the DOCX document causing the crash is something that people sent
you. And these people may be uninterested in problems with OpenOffice.
Besides the various options for anonymizing a document either on the
"sender" or "receiver" side, already discussed in the thread and quite
interesting in themselves, are there other options involving only the
document and (a specially configured version of) OpenOffice?
I mean, if the first thing a developer does on a crash is to obtain a
meaningful stacktrace and analyze it, and the document becomes mostly
irrelevant at that point, then a stacktrace could be enough to improve
the quality of OpenOffice without needing to access confidential data.
Or is that not enough to work with?
Regards,
Andrea.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Alexandro Colorado <jz...@oooes.org>.
I think this need to be handle by a real company that can provide NDA
documentation for this and should be a for-pay serrvice. IMHO.
That said, they could also try to scrap the data from the document in
order to replicate the issue.
On 4/23/14, Jürgen Schmidt <jo...@gmail.com> wrote:
> On 4/23/14 9:03 AM, Andrea Pescetti wrote:
>> When someone complained that OpenOffice crashed on their company
>> documents, I've always answered that either they made the documents
>> available in Bugzilla or we couldn't do anything about it. Now it
>> happened to me and I realize that my suggestion is easier said than done!
>>
>> I received a DOCX document that OpenOffice Writer cannot open (crash).
>> The company that sent it to me cannot make it public: it's a
>> confidential work document.
>>
>> In general how can we handle this? It's very important for the project
>> to have a good reputation in companies, so if we crash on company
>> templates we should be able to know it and fix it.
>>
>> What options do we have available? Do we accept private attachments in
>> Bugzilla? Can a properly obtained stack trace replace the need for the
>> actual document, maybe? Other options?
>>
>> Note: in my case I already asked for, and received, a working ODT
>> version. I'm interested in the generic discussion.
>
> I understand the problem and we know this situation. I believe it is
> not easy to address in an open source project. Either the documents can
> be cleaned up and confidential data get removed or the company contacted
> another company where special agreements can be done.
>
> If you need more than the community project can provide it is possible
> to buy professional help and support. Not everything is for free and
> that has nothing to do with good or bad reputation. It's up to the
> company, either they can provide a clean document containing the problem
> or buy professional support/service.
>
> I personally don't want to deal with confidential data/documents in
> public or in the bugtracker.
>
> Juergen
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
>
--
Alexandro Colorado
Apache OpenOffice Contributor
http://www.openoffice.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Jürgen Schmidt <jo...@gmail.com>.
On 4/23/14 9:03 AM, Andrea Pescetti wrote:
> When someone complained that OpenOffice crashed on their company
> documents, I've always answered that either they made the documents
> available in Bugzilla or we couldn't do anything about it. Now it
> happened to me and I realize that my suggestion is easier said than done!
>
> I received a DOCX document that OpenOffice Writer cannot open (crash).
> The company that sent it to me cannot make it public: it's a
> confidential work document.
>
> In general how can we handle this? It's very important for the project
> to have a good reputation in companies, so if we crash on company
> templates we should be able to know it and fix it.
>
> What options do we have available? Do we accept private attachments in
> Bugzilla? Can a properly obtained stack trace replace the need for the
> actual document, maybe? Other options?
>
> Note: in my case I already asked for, and received, a working ODT
> version. I'm interested in the generic discussion.
I understand the problem and we know this situation. I believe it is
not easy to address in an open source project. Either the documents can
be cleaned up and confidential data get removed or the company contacted
another company where special agreements can be done.
If you need more than the community project can provide it is possible
to buy professional help and support. Not everything is for free and
that has nothing to do with good or bad reputation. It's up to the
company, either they can provide a clean document containing the problem
or buy professional support/service.
I personally don't want to deal with confidential data/documents in
public or in the bugtracker.
Juergen
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Oliver-Rainer Wittmann <or...@googlemail.com>.
Hi,
On 23.04.2014 09:03, Andrea Pescetti wrote:
> When someone complained that OpenOffice crashed on their company
> documents, I've always answered that either they made the documents
> available in Bugzilla or we couldn't do anything about it. Now it
> happened to me and I realize that my suggestion is easier said than done!
>
> I received a DOCX document that OpenOffice Writer cannot open (crash).
> The company that sent it to me cannot make it public: it's a
> confidential work document.
>
> In general how can we handle this? It's very important for the project
> to have a good reputation in companies, so if we crash on company
> templates we should be able to know it and fix it.
>
> What options do we have available? Do we accept private attachments in
> Bugzilla? Can a properly obtained stack trace replace the need for the
> actual document, maybe? Other options?
>
> Note: in my case I already asked for, and received, a working ODT
> version. I'm interested in the generic discussion.
>
Yes, such use cases are hard to handle in a public and transparent
working open-source community.
The already made suggestion to consult a professional in our OpenOffice
eco-system and secure the document by a corresponding contract is one way.
Another one would be to simply trust a certain community member who is
able and willing to solve the problem and share the document with this
community member.
I do not think that we as an open-source project at Apache are in the
position to provide a service for such business-making use cases. That
is of course the area of the professional eco-system around OpenOffice
as stated above.
Best regards, Oliver.
> Regards,
> Andrea.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Rob Weir <ro...@apache.org>.
On Wed, Apr 23, 2014 at 9:27 AM, Alexandro Colorado <jz...@oooes.org> wrote:
> On 4/23/14, Rob Weir <ro...@apache.org> wrote:
>> On Wed, Apr 23, 2014 at 6:53 AM, Rory O'Farrell <of...@iol.ie> wrote:
>>> On Wed, 23 Apr 2014 12:34:33 +0200
>>> davide@flossconsulting.it wrote:
>>>
>>>>
>>>> > What options do we have available? Do we accept private attachments in
>>>> > Bugzilla? Can a properly obtained stack trace replace the need for the
>>>> > actual document, maybe? Other options?
>>>>
>>>> What about anonymize the DOCX by searching and replacing any simple char
>>>> with X char?
>>>> With MS Office of course....
>>>>
>>>> Davide
>>>>
>>>>
>>>> >
>>>> > Note: in my case I already asked for, and received, a working ODT
>>>> > version. I'm interested in the generic discussion.
>>>> >
>>>> > Regards,
>>>> > Andrea.
>>>
>>> One can't anonymize an unopenable file! It would have to be done using the
>>> generating application.
>>>
>>
>> But it is possible, in theory to do something like this with the
>> Apache ODF Toolkit (incubating).
>
> Isnt the ODF Toolkit for ODF only?? What would that help on a DOCX document?
>
True, but you could use Apache POI for DocX files. It is a similar library.
-Rob
>>
>> But it is tricky, especially if the document has embedded documents,
>> OLE embeddings, images with confidential information, etc. You could
>
> Probably some binary blob is causing the file to be unable to be open by AOO.
>
>> need to replace it all. But the stuff you replace might be the source
>> of the crash.
>>
>> A safer way is for the person who edited the document to do a binary
>> search for the issue, e.g., creating test documents containing the
>> first half of the document and another with the 2nd half. See which
>
> Agree.
>
>> one crashes. Then divide that test document. And so on, until you've
>> narrowed down what is causing the crash. Of course, not all crashes
>> can be narrowed down that way, but many can.
>>
>> -Rob
>>
>>>
>>> --
>>> Rory O'Farrell <of...@iol.ie>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>
>>
>
>
> --
> Alexandro Colorado
> Apache OpenOffice Contributor
> http://www.openoffice.org
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Alexandro Colorado <jz...@oooes.org>.
On 4/23/14, Rob Weir <ro...@apache.org> wrote:
> On Wed, Apr 23, 2014 at 6:53 AM, Rory O'Farrell <of...@iol.ie> wrote:
>> On Wed, 23 Apr 2014 12:34:33 +0200
>> davide@flossconsulting.it wrote:
>>
>>>
>>> > What options do we have available? Do we accept private attachments in
>>> > Bugzilla? Can a properly obtained stack trace replace the need for the
>>> > actual document, maybe? Other options?
>>>
>>> What about anonymize the DOCX by searching and replacing any simple char
>>> with X char?
>>> With MS Office of course....
>>>
>>> Davide
>>>
>>>
>>> >
>>> > Note: in my case I already asked for, and received, a working ODT
>>> > version. I'm interested in the generic discussion.
>>> >
>>> > Regards,
>>> > Andrea.
>>
>> One can't anonymize an unopenable file! It would have to be done using the
>> generating application.
>>
>
> But it is possible, in theory to do something like this with the
> Apache ODF Toolkit (incubating).
Isnt the ODF Toolkit for ODF only?? What would that help on a DOCX document?
>
> But it is tricky, especially if the document has embedded documents,
> OLE embeddings, images with confidential information, etc. You could
Probably some binary blob is causing the file to be unable to be open by AOO.
> need to replace it all. But the stuff you replace might be the source
> of the crash.
>
> A safer way is for the person who edited the document to do a binary
> search for the issue, e.g., creating test documents containing the
> first half of the document and another with the 2nd half. See which
Agree.
> one crashes. Then divide that test document. And so on, until you've
> narrowed down what is causing the crash. Of course, not all crashes
> can be narrowed down that way, but many can.
>
> -Rob
>
>>
>> --
>> Rory O'Farrell <of...@iol.ie>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
>
--
Alexandro Colorado
Apache OpenOffice Contributor
http://www.openoffice.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Rory O'Farrell <of...@iol.ie>.
On Wed, 23 Apr 2014 08:35:25 -0400
Rob Weir <ro...@apache.org> wrote:
> On Wed, Apr 23, 2014 at 6:53 AM, Rory O'Farrell <of...@iol.ie> wrote:
> > On Wed, 23 Apr 2014 12:34:33 +0200
> > davide@flossconsulting.it wrote:
> >
> >>
> >> > What options do we have available? Do we accept private attachments in
> >> > Bugzilla? Can a properly obtained stack trace replace the need for the
> >> > actual document, maybe? Other options?
> >>
> >> What about anonymize the DOCX by searching and replacing any simple char
> >> with X char?
> >> With MS Office of course....
> >>
> >> Davide
> >>
> >>
> >> >
> >> > Note: in my case I already asked for, and received, a working ODT
> >> > version. I'm interested in the generic discussion.
> >> >
> >> > Regards,
> >> > Andrea.
> >
> > One can't anonymize an unopenable file! It would have to be done using the generating application.
> >
>
> But it is possible, in theory to do something like this with the
> Apache ODF Toolkit (incubating).
>
> But it is tricky, especially if the document has embedded documents,
> OLE embeddings, images with confidential information, etc. You could
> need to replace it all. But the stuff you replace might be the source
> of the crash.
>
> A safer way is for the person who edited the document to do a binary
> search for the issue, e.g., creating test documents containing the
> first half of the document and another with the 2nd half. See which
> one crashes. Then divide that test document. And so on, until you've
> narrowed down what is causing the crash. Of course, not all crashes
> can be narrowed down that way, but many can.
>
> -Rob
>
For what it's worth, I have come across a few cases of files that crash when OpenOffice attempts to open them, but which can open correctly if /Insert /File into a blank OpenOffice document of the correct type.
--
Rory O'Farrell <of...@iol.ie>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Rob Weir <ro...@apache.org>.
On Wed, Apr 23, 2014 at 6:53 AM, Rory O'Farrell <of...@iol.ie> wrote:
> On Wed, 23 Apr 2014 12:34:33 +0200
> davide@flossconsulting.it wrote:
>
>>
>> > What options do we have available? Do we accept private attachments in
>> > Bugzilla? Can a properly obtained stack trace replace the need for the
>> > actual document, maybe? Other options?
>>
>> What about anonymize the DOCX by searching and replacing any simple char
>> with X char?
>> With MS Office of course....
>>
>> Davide
>>
>>
>> >
>> > Note: in my case I already asked for, and received, a working ODT
>> > version. I'm interested in the generic discussion.
>> >
>> > Regards,
>> > Andrea.
>
> One can't anonymize an unopenable file! It would have to be done using the generating application.
>
But it is possible, in theory to do something like this with the
Apache ODF Toolkit (incubating).
But it is tricky, especially if the document has embedded documents,
OLE embeddings, images with confidential information, etc. You could
need to replace it all. But the stuff you replace might be the source
of the crash.
A safer way is for the person who edited the document to do a binary
search for the issue, e.g., creating test documents containing the
first half of the document and another with the 2nd half. See which
one crashes. Then divide that test document. And so on, until you've
narrowed down what is causing the crash. Of course, not all crashes
can be narrowed down that way, but many can.
-Rob
>
> --
> Rory O'Farrell <of...@iol.ie>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Alexandro Colorado <jz...@oooes.org>.
On 4/23/14, Rory O'Farrell <of...@iol.ie> wrote:
> On Wed, 23 Apr 2014 12:34:33 +0200
> davide@flossconsulting.it wrote:
>
>>
>> > What options do we have available? Do we accept private attachments in
>> > Bugzilla? Can a properly obtained stack trace replace the need for the
>> > actual document, maybe? Other options?
>>
>> What about anonymize the DOCX by searching and replacing any simple char
>> with X char?
>> With MS Office of course....
>>
>> Davide
>>
>>
>> >
>> > Note: in my case I already asked for, and received, a working ODT
>> > version. I'm interested in the generic discussion.
>> >
>> > Regards,
>> > Andrea.
>
> One can't anonymize an unopenable file! It would have to be done using the
> generating application.
DOCX is also a Zip-XML fileformat, so you can do some ASCII procssing
and parsing script there are scripts that could (or could not) open
it.
You have this for example: https://pypi.python.org/pypi/ooxml/0.2
>
>
> --
> Rory O'Farrell <of...@iol.ie>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
>
--
Alexandro Colorado
Apache OpenOffice Contributor
http://www.openoffice.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by Rory O'Farrell <of...@iol.ie>.
On Wed, 23 Apr 2014 12:34:33 +0200
davide@flossconsulting.it wrote:
>
> > What options do we have available? Do we accept private attachments in
> > Bugzilla? Can a properly obtained stack trace replace the need for the
> > actual document, maybe? Other options?
>
> What about anonymize the DOCX by searching and replacing any simple char
> with X char?
> With MS Office of course....
>
> Davide
>
>
> >
> > Note: in my case I already asked for, and received, a working ODT
> > version. I'm interested in the generic discussion.
> >
> > Regards,
> > Andrea.
One can't anonymize an unopenable file! It would have to be done using the generating application.
--
Rory O'Farrell <of...@iol.ie>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: OpenOffice bugs and confidential documents
Posted by da...@flossconsulting.it.
> What options do we have available? Do we accept private attachments in
> Bugzilla? Can a properly obtained stack trace replace the need for the
> actual document, maybe? Other options?
What about anonymize the DOCX by searching and replacing any simple char
with X char?
With MS Office of course....
Davide
>
> Note: in my case I already asked for, and received, a working ODT
> version. I'm interested in the generic discussion.
>
> Regards,
> Andrea.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org