Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
Mozilla The Internet Security

Mozilla Uncooperative With OSS Groups on Security? 239

Posted by CmdrTaco from the working-the-bugs-out dept.
An anonymous reader writes "In response to Firefox lead developer Ben Goodger's claim that "redistributions of the official Mozilla releases are never going to give you security updates as quickly as Mozilla", Christopher Aillon of Red Hat says that this is only because Mozilla doesn't play by the same rules as other OSS projects. He says that while other OSS projects work with vendors to achieve simeltaneous releases of patched software, Mozilla does no such thing unless compelled to do so."
This discussion has been archived. No new comments can be posted.

Mozilla Uncooperative With OSS Groups on Security? More

Mozilla Uncooperative With OSS Groups on Security?

Comments Filter:

  • Secrecy? (Score:5, Insightful)

    by lachlan76 ( 770870 ) on Sunday May 22, 2005 @10:00AM (#12604613)
    Sounds like the alleged rules involve keeping bugs secret until users of the code have updated it and/or changing their release cycle to accomodate this.

    • Re:Secrecy? (Score:5, Insightful)

      by gclef ( 96311 ) on Sunday May 22, 2005 @10:35AM (#12604780)
      Honestly, Mozilla is in a lose/lose situation here.

      If they hold on to fixes until all the distros are ready, they get beat up for slow patch times compared to MS. If they release immediately, they get beat up by the distros for not coordinating with them.

      I think this is coming up because Moz is one of the first high-profile OSS projects to support both Linux/BSD and Windows. If this were (like most other Linux/BSD apps) an OSS-OS only app, then the lack of coordination would be a real issue. But, for the Windows folks, there isn't a distro to coordinate with, so Moz has to release as soon as possible. I'm with Moz on this, honestly.

      • Re:Secrecy? (Score:3, Insightful)

        by SpaghettiPattern ( 609814 )
        If they hold on to fixes until all the distros are ready, they get beat up for slow patch times compared to MS. If they release immediately, they get beat up by the distros for not coordinating with them.

        NO! Mozilla is responsible for its own releases and security updates and not for the distros'. Mozilla isn't there to make the life of Linux distros easy. The Linux distros must make security patches available ASAP.

        • Re:Secrecy? (Score:5, Insightful)

          by gclef ( 96311 ) on Sunday May 22, 2005 @12:38PM (#12605331)
          I disagree. Completely. It's in the general interest of everyone for the app writers and the distros to work together...the goal, after all, is for the end user to get patches quickly, effectively, and *before* there's an exploit. A lot of the distros have central patch distribution systems...these systems are the best way to get patches to the end user for that distro.

          If an app releases a bug fix without working with the distro, it leaves the end user there to get screwed...either they wait for their distro to get the patch put together (running vulnerable code the whole time), or they break their use of the patch distribution system (meaning they have to either re-patch once the vendor releases, or never follow the vendor patch system for that app again). This isn't a choice we want to be giving the users. The best result is *absolutely* a coordinated response, where the authors, the distros and the original reporter of the problem all release simultaneously.

          That isn't possible in this case, since there's no distro to work with for Windows. Mozilla is, in this situation, choosing to minimize the risk for their Windows users (who likely far outnumber their OSS users), at the expense of the distro coordination. It's not a fun choice to make, but a sensible one, given their situation.

          • Re:Secrecy? (Score:2, Insightful)

            by Kagenin ( 19124 )
            That was very well put. The Mozilla team has to put the Needs of the Many (their windows users) against the Needs of the Few (their OSS-OS users). There are a lot more Firefox/Windows users than Firefox/Linux.

            Why should the Windows users have to wait for the latest distros to get released before they get to patch up a security hole? And how selfish do Linux distributers have to be to force the windows users to wait like that? Meanwhile, exploits abound, and all users get screwed.

            Fuck the distros. Its
            • There is plenty of time between the finalized X+0.0.1 code and the official release of it to work with the distros within the time table. Furhtermore it wouldn't be that hard to send out an impending security release notice to the distros as they are finalizing the release code.
              • Why do you assume that they don't notify? They have forums and discussion groups and the like for the various developers to talk to each other, so if the distros are involved in that part of the process then they should have a fairly clear understanding of the timetable of the next update.

                In some distributions like Debian, individual package maintainers or small teams of maintainers contribute new patches to 'stable' and new versions to 'unstable'. With individual people responsible for such it shouldn

          • Re:Secrecy? (Score:3, Insightful)

            by Hatta ( 162192 )
            If an app releases a bug fix without working with the distro, it leaves the end user there to get screwed...either they wait for their distro to get the patch put together (running vulnerable code the whole time), or they break their use of the patch distribution system

            Lets break this down:

            If:
            • App releases bug fix without waiting for distros, users can:
              • Install the vendors version early
              • Wait for the distro patch
            • App waits for distros before releasing bug fix, users can:
              • Wait for the distro patch

            • Re:Secrecy? (Score:3, Informative)

              by gclef ( 96311 )
              You left out a variable: time. Releasing early widens the amount of time that the users relying on the distro for the patch are vulnerable. There is tons of evidence that vulnerabilities are attacked more after release of a patch, or announcement of a vulnerability. (Not to say it doesn't happen before, just that it happens *more* afterwards.)

              So, it's in the general interest to get as many people patched *quickly* once the public announcement is made. Vendor patch systems are the best way to do that.

              • Re:Secrecy? (Score:3, Insightful)

                by psyon1 ( 572136 )
                You're assuming the security hole is announced at the same time as the fix. This isnt always the case. In a case where an exploit is already known and possibly in use, it is always best to make a fixed version available, without waiting for the distros.

          • Re:Secrecy? (Score:3, Insightful)

            by psyon1 ( 572136 )

            How do you pick what distros to work with? There are so many to choose from, do you just choose those who give you financial backing? Should the release time of distro A be forced to coincide with distro B? Should Red Hat and commercial vendors be in control?

            I think they should release fixes as soon as a stable fix is available. Alot of people just use a distro for a base install, and then build apps from source, some even choose to do Linux From Scratch, its their choice. No one should be locked in

    • Re:Secrecy? (Score:2, Interesting)

      by Chris Snook ( 872473 )
      Sounds like the alleged rules involve keeping bugs secret until users of the code have updated it and/or changing their release cycle to accomodate this.

      Nope. What happens is that everyone agrees to make full disclosure and a patch available at exactly the same time. Sure, this delays the patch slightly, but it keeps everyone on a level playing field for security, since it means that attentive sysadmins can read the advisory, determine if it applies to their systems, and have their machines patched with

  • Why is this a bad things? (Score:5, Interesting)

    by afd8856 ( 700296 ) on Sunday May 22, 2005 @10:03AM (#12604627) Homepage
    They may want to release the updates earlier, without waiting for whatever linux/bsd distro to updated their packages.

    And it seems fair to me. If I run fedora, for example, if I'm concerned about security, I can always download and install their binary package. Because, for example, I couldn't find an updated rpm for firefox 1.0.4 (only a spec file)

  • Nor should it have to. (Score:5, Insightful)

    by Trillan ( 597339 ) on Sunday May 22, 2005 @10:03AM (#12604628) Homepage Journal

    Priorities are not the same all over, and Mozilla should be focused on supporting their users. Those several days of warning are extra days of end-user vulnerability. As a Firefox user, I would feel my trust was misplaced if they did something else..

    One other comment:

    indirectly -- it still displays their branding

    Correct me if I'm wrong, but other builds are not supposed to use Mozilla's branding anyway. The PowerPC G4-optimized build of Firefox contains only compiler/linker changes, and apparently can not use the same icon.

    • I agree that Mozilla should support their users and not wait to supply updates just so that other Mozilla based browsers can update simultaneously. Although, it would certainly be great to let these other projects know about the vulnerability and make the update available to them, but waiting to update their own product is bad for their own users.
      • it would certainly be great to let these other projects know about the vulnerability and make the update available to them

        If its a 0day vulnerability letting other distros know in advance would be putting the vulnerability into the wild for any script kiddie to play with.

        waiting to update their own product is bad for their own users

        Exactly. If someone forks or uses open source code its a lot to ask the people who made the original trunk to take care for all. Share knowledge yes, but to do the j

      • Well, first, I expect people who fork get several emails even if there is a security issue. Even if the emails are not from Mozilla. Secondly, how much effort does it take to watch Mozilla's RSS feed?

        Sorry, but this seems an awful lot like whining to me.

    • Correct me if I'm wrong, but other builds are not supposed to use Mozilla's branding anyway.

      You are more or less correct ... it depends on how close the compile flags a distro uses are to those used by the mozilla project. They don't need to match one by one, they just need to be close enough (so I can imagine that a simple i686 optimized build with -O will pass - see this email [freebsd.org].)

  • I'm not sure I agree with this... (Score:5, Interesting)

    by Rantastic ( 583764 ) on Sunday May 22, 2005 @10:04AM (#12604636) Journal
    Other projects make sure that the vendors know of a security vulnerability, supply the patch and new tarball (if applicable, which it is in mozilla.org's case), give a brief period of time for the vendors to catch up, and then do a synchronous release with them at a planned time.

    Ok, I do agree that OSS projects should supply security patches when they have them, and new releases as well, but what good does it do to let the vendors at them first?

    Why should end users not be offered the same patches as soon as they are ready? If it takes a vendor 24 hours to get a new package out, that sounds reason able to me, but again, why limit access to the update for that 24 hours?

    • Re:I'm not sure I agree with this... (Score:5, Insightful)

      by Rantastic ( 583764 ) on Sunday May 22, 2005 @10:09AM (#12604658) Journal
      Just to clarify:

      I am saying that if Red Hat expects OSS projects to sit on security updates until Red Hat has a new package ready, that is just plain rude.

      Are all users not equal in the eyes of Free software? We should all be able to have a crack at the security update as soon as it is ready. Some of us do in fact maintain our own packages. Why should we be forced to wait?

    • Re:I'm not sure I agree with this... (Score:5, Interesting)

      by Husgaard ( 858362 ) on Sunday May 22, 2005 @10:19AM (#12604705)
      I understand why Mozilla does not want to delay security updates. Of course Redhat would like that at it would look like they are less behind on security updates.

      Unfortunately it looks like Redhat has persuaded other Open Source projects to delay their security updates.

      And now Redhat is using these other Open Source projects to attempt to pressure Mozilla into also delaying their security updates by claiming that Mozilla doesn't play by the rules.

      Shame on Redhat.

      • so if you think a project will unreasonablly delay responding to a security bug just cc Full-Disclosure@lists.netsys.com when you report it.
      • Actually, coordinated releases are fairly common in the security world. It's not RedHat, it's everyone. These days, it's seen as irresponsible to release a security-related bug without giving the automated patching systems a chance to prepare (or the vendor a chance to respond). The idea is to minimize the time between the announcement of a bug, and the end-users getting patched.

        The problem here isn't that practice. The problem is, a huge chunk of Moz's users are not using a distro's central patch syst
      • Err... actually this whole everyone releases together is a common thing in OSS and it keeps the projects happy with each other. Red Hat writes a lot of code that gets put back into the official firefox build as well as alot of other OSS projects, including security fixes. Red Hat doesn't just release their security patches and then let the other projects know about them (thus putting firefox behind). They make sure that everyone is caught up, all of which can usually be achieved in about a 12-24 hour period
        • The difference is one of responsibility.

          Mozilla is responsible for their project. They code it so you don't have to, they fix it so you don't have to. They've assumed that responsibility.

          Red Hat is responsible for building a compilation different projects so you don't have to. If they unload that responsibility on the users or the individual projects in their distro, they have dropped the ball, and have no reason to exist.

          Considering that the Moz project is a volunteer project, and that Red Hat is bei
          • See and that is where you are wrong.

            Red Hat doesn't just patch up other's work. Red Hat codes most of the stuff in the linux desktop and they pay alot of programmers to do it. Red Hat has coded most of Gnome (ximian also did alot), Red Hat hosts Gnome.org. They've done a hell of a lot of work for making OpenOffice.org integrate well with the linux desktop including using native widgets and Red Hat has coded and still currently develops GCJ allowing them to compile all of OpenOffice's java stuff natively.

            T

    • Re:I'm not sure I agree with this... (Score:4, Insightful)

      by ProfaneBaby ( 821276 ) on Sunday May 22, 2005 @10:24AM (#12604726)
      Why should end users not be offered the same patches as soon as they are ready? If it takes a vendor 24 hours to get a new package out, that sounds reason able to me, but again, why limit access to the update for that 24 hours?

      Just speaking to the theory here, once the 'end users' are notified of the hole, it's reasonable to assume that 'someone' is going to reverse engineer an exploit out of the patch.

      On very large holes, the coordinated release allows the largest possible user base to have an upgrade path by the time the hole is made public. If all users were notified as soon as a source patch was released, but the source patch didn't apply directly to distribution X because of local changes to the codebase, a malicious user could (and will) create and circulate an exploit before that group can create a patch.

      Note that the security community does not agree here. When OpenSSH had a massive hole, Theo went mailing-list to mailing-list telling people a workaround, and coordinated a very large release of information on a specific day. When DJB's students come out with their list of new exploits every year, they release them all on a webpage with zero notice to ANYONE, including the software vendors involved.

      It's a matter of philosophy - are you in the game to protect the most people, or are you managing your software and letting other people worry about their users? I personally don't have a problem with Mozilla's practices - they still beat some other vendors, even if they're not as 'responsible' as the OpenSSH crowd.
    • Once the source code for the patch is out there, any script kiddie will have an exploit. This leaves distribution users who don't want to install an upgrade from source (which will lose their support) high and dry. If you save releasing the exploit publicly until every vendor has a patch ready, then people can patch before the vulnerability becomes widely known. Real crackers can reverse engineer the vendor patches, or have someone on the inside - but then real crackers probably found the vulnerability befo

  • The question is "WHY?" (Score:4, Insightful)

    by bogaboga ( 793279 ) on Sunday May 22, 2005 @10:04AM (#12604638)
    Quote: "redistributions of the official Mozilla releases are never going to give you security updates as quickly as Mozilla".

    I read the above quote may times over and the person from RedHat's response. I kept asking myself over and over again...WHY? Because if Mozilla operated the same way other OSS projects do by default, I can only see good things out of this. I wonder why they choose to do things this way.

    • Re:The question is "WHY?" (Score:5, Interesting)

      by ProfaneBaby ( 821276 ) on Sunday May 22, 2005 @10:33AM (#12604770)
      There's really two scenarios here:

      1) A hole is made known to Mozilla before it's made known to the public.

      2) A hole is made known to Mozilla and the public at the same time.

      In (1), it's reasonable to ask that the software developer at least make a token notification to various vendor's security contacts. Most of the vendors are reasonably private - they won't post the matter to a mailing list - and responsible. The software developer certainly doesn't HAVE to do this, but it would benefit a larger portion of its end users.

      In (2), it doesn't make any sense to notify each distribution, because the whole world already knows, and each hour wasted on notification could mean people who are damaged by the hole.

      I think the difference between (1) and (2) is significant, and it's important to realize that the case we're talking about here is (2). The hole was made public in Bugzilla, and Mozilla had to rush to create a patch. Holding that patch to give the distributions time to update is silly - people already knew there was a hole, and users were already waiting on the fix. If the initial bug was private, this would be an entirely different story.

  • What's worse (Score:5, Interesting)

    by keesh ( 202812 ) on Sunday May 22, 2005 @10:06AM (#12604643) Homepage
    What's worse is the way the mozilla projects rarely seem to manage to put out an actual working source tarball. For the past dozen or so releases they've always released incomplete or unworking sources. Screwing up once is understandable, but to repeatedly omit things strongly implies that they're not interested in anyone using anything except their official binaries.
    • and their CVS server is always available to the public. Just pull that instead of a tarball. Get the tag you want if you'd like a build corresponding to their release. It's really quite a bit easier than the tarball anyway. I've never had a problem with a tagged release from CVS not working.
  • Where's the article?? It's just two short blog entries between two guys arguing over an issue. How is that news or "stuff that matters"? It's almost like reading two headlines. This has a feel of high school.

    High school girl A: So Ben Goodger's claim that "redistributions of the official Mozilla releases are never going to give you security updates as quickly as Mozilla"
    High school girl B: "Christopher Aillon of Red Hat says that this is only because Mozilla doesn't play by the same rules as other OSS

  • Making a story that isn't there. (Score:5, Insightful)

    by Anonymous Coward on Sunday May 22, 2005 @10:10AM (#12604666)
    Those links seemed almost like the biggest non-articles ever to hit Slashdot. I asked myself... "is that it?" Links to some petty blog nonsense, basically.

    Mozilla's problems aside, Aillon's point is stupid. Stupid as that picture of him imitating the Matrix, or whatever the hell he is doing. Basically, there doesn't seem to be any meat here, any story. Good work saving Slashdotters the time of RTFA-ing, because in this case, reading the article wouldn't have made any difference.

  • Whiny RedHat, or lazy Mozilla? (Score:5, Insightful)

    by lheal ( 86013 ) <lheal1999@@@yahoo...com> on Sunday May 22, 2005 @10:18AM (#12604696) Journal
    This may sound like the tail whinning that the dog doesn't wag, but the vendors may have a legitimate complaint.

    The potential for harm is if Mozilla releases a security fix, and the distros don't right away. There's a period of time in which Mozilla version x.y is vulnerable on FooDistLinux, and there's no reasonable expectation for the fix to happen for some period. Since the fix has been released, attackers are on notice that there is are vulnerable systems out there, and they're running Mozilla x.y on FooDistLinux.

    Now, mind you, I don't think that's such a big fat hairy deal. But the situation does put minor distros (anything not supported by the official Mozilla site) at a disadvantage. The perception is that the major players are "more secure", since you can get your fix straight from Mozilla.org.

    • Neither... (Score:3, Insightful)

      by Stradivarius ( 7490 )
      The real problem here is not that Mozilla is releasing security fixes too quickly, or that the distros aren't keeping up.

      The real problem is that a Linux application needs to be modified in some way by the operating system vendor before end-users of that operating system can use it. Think about that for a minute. When's the last time you had to go through Microsoft to download the latest copy of a 3rd-party application?

      One of the selling points of OSS development has always been its decentralized nature.

  • But Mozilla IS the vendor for most people (Score:5, Insightful)

    by Curmudgeonlyoldbloke ( 850482 ) on Sunday May 22, 2005 @10:22AM (#12604715)
    I suspect that the vast majority of Firefox users are on Windows (simply because the majority of computer users are). They don't have the luxury of up2date or an apt-get repository and have to go to each non-Windows vendor to obtain updates. Why should Mozilla wait for someone maintaining a repository for a minority of their users before releasing an update for the majority?

    I'm sure that's the offical position, anyway. And of course they want to drive traffic to their site, and make a big deal about counting downloads.

  • fuck off (Score:3, Insightful)

    by Turn-X Alphonse ( 789240 ) on Sunday May 22, 2005 @10:27AM (#12604739) Journal
    "simeltaneous releases of patched software"

    This is OSS took to the extreme. One for all and all for one doesn't apply when people are at risk. If you don't release a fix ASAP then you're knowingly risking the security of peoples computers. Like it or not this is a ridiclous idea from the ground up.

    Work together for the greater good, don't force others to work together so you all look good.

    • Depends (Score:5, Insightful)

      by zerbot ( 882848 ) on Sunday May 22, 2005 @10:37AM (#12604790)
      If the exploit is public knowledge, or is known as being used to exploit by blackhats, then releasing the fix as soon as it is finished is best. If the exploit is not publically known, and there are no signs it is being used, then a coordinated release is best. Not coordinating ends up leaving a window for blackhats to find out about the exploit and use the vulnerability on those systems that are not yet patched.

    • Re:fuck off (Score:2, Informative)

      by six ( 1673 )
      This is OSS took to the extreme. One for all and all for one doesn't apply when people are at risk. If you don't release a fix ASAP then you're knowingly risking the security of peoples computers. Like it or not this is a ridiclous idea from the ground up.

      In this case it is a bit more complicated because releasing early patches is putting the distro-using people at risk. The fact is inherent to OSS, when a fix is released you just have to diff the source code to easily find the vulnerability of the old ve

  • How is this Mozilla's problem? (Score:3, Insightful)

    by Emetophobe ( 878584 ) on Sunday May 22, 2005 @10:32AM (#12604767)
    I don't see how Mozilla is in the wrong. It is upto the various linux distributions to manage said distribution, not mozilla.

    I want Firefox security updates as soon as they are available on my Micro$oft box, why should I have to wait for distribution X to play catchup. It is said distributions job to maintain that distribution, not Mozilla.

    Should I, the user, have to wait for important security updates because some distribution wants to repackage them? The answer is no.
    • It's the project's problem if they want the continued support of the vendors. A completely plausible example of how a vendor could be justifiably furious:

      1) Vendor gets bug reports from their customers.
      2) Vendor examines the code and discovers that the bug is exploitable.
      3) Vendor's developers write a patch and send it to the project's security team.
      4) Project security team realizes that they do a similar bad thing in other parts of their code, and the fix will need to be a much larger patch.
      5) Project pu
    • They should wait a known period after contacting distribution people. That way red hat etc. have a known time to test the fix. They don't want to release an untested product, even if that means leaving their systems vulnerable.

  • Why is latency such a problem? (Score:4, Interesting)

    by vagabond_gr ( 762469 ) on Sunday May 22, 2005 @11:15AM (#12604951)
    I don't understand why a 1-2 days latency is such a problem for a distro. It's like someone complaining that cvs users get the fixes before they appear on mozilla.org.

    Summary:
    - you're paranoid about security, get cvs updates every hour.
    - you're seriously concerned about security, get the new binary as soon as you read it on /.
    - you're lazy and you like it: apt-get install, 1-2 days after.

  • Becuase (Score:3, Insightful)

    by Bruha ( 412869 ) on Sunday May 22, 2005 @11:25AM (#12604987) Homepage Journal
    Redhat makes it's own modificatoins to Mozilla and Firefox maybe.

    Linspire surely does but they at least work with the company to get them into the main tree so it's not so much of a problem.

    Along with any number of big distros that do something to the original package.

    All which could of been avoided if said companies just used the plugin infrastructure to make their modifications and repackaged it that way.

  • Honestly (Score:3, Insightful)

    by rbanffy ( 584143 ) on Sunday May 22, 2005 @11:37AM (#12605029) Homepage Journal
    How long can it take for package maintainers to update the source and run the package-assembly scripts.

    I mean, it is automated, isn't it?

    Mozilla guys are not obligated to wait until the slowest of the crowd gets its job done. And they shouldn't treat any OS/distro differently from one another.

    If Red Hat feels having up-to-the-minute RPMs is all that important, they should compensate Mozilla Foundation for the additional hassle. If not, they should wait in line just like everyone else.
    • They have to test it. Unlike many people redhat believes in their product being absolutely stable, and won't release a patch, even a security one, until they have made sure that it doesn't break anything.

  • Context... Context... Context... (Score:5, Insightful)

    by TigerX ( 859482 ) on Sunday May 22, 2005 @11:37AM (#12605033) Homepage
    This article rips Ben Gooder's words so far out of context that it is not even funny...

    Here's the original sentence with the quoted portion bolded:
    If security is important to you, this demonstration should show that browsers that are redistributions of the official Mozilla releases are never going to give you security updates as quickly as Mozilla will itself for its supported products.

    The context of Ben's blog post was the final release of the Netscape 8.0 browser which was based on top of the Firefox 1.0.3 source code. Ben was merely pointing out that this left the Netscape users open to attack. Netscape promptly released 8.0.1 built on the Firefox 1.0.4 code.

    Mozilla is fulfilling its obligation to its users by producing quality secure products, not pandering to an OSS "community" which seem more intent on arguing about every minute detail rather than change the way things are done.

    To that end, Go Mozilla!
    • but again, "Netscape" is the AOL branded release...it has nothing to do with mozilla anymore execpt they always get the changes for their proprietary product. Netscape != Mozilla anymore. It's just another cheap rebranding scheme... AOL cut the Moz team loose a while ago... they've got no "responsibility" to Netscape anymore either.

  • To me the project management of Mozilla looks messy if not broken. They make it extremely hard for people to contribute because their policies resemble those of a closed source company much more than those of open source projects. Just look at the patch review debacle that happened a while ago. If it's that hard to get code in there why would a developer even bother to waste his free time on this?

    Now if that kind of tight control would allow Mozilla to keep their deadlines it would at least be explainable

    • ... their policies resemble those of a closed source company much more than those of open source projects.


      Open Source and Bazaar development (where Bazaar is interpreted as "accepting patches from many outside sources") are not equivalent concepts. Many FLOSS projects are managed as Cathedrals, including (IIRC) most of the core FSF/GNU projects.

  • Firefox updates (Score:2, Interesting)

    by ChrisJones ( 23624 )
    Something that has irked me is that I can no longer use the official firefox extension type pages.
    I'm running ubuntu with firefox 1.0.2 and the later security patches are applied, but their pages still tell me I should be running 1.0.4.
    Pretty stupid imo.
  • Open-source companies will sometimes play games and be uncooperative.

    But Mozilla is a foundation, so why should it care whether users get its code directly from it, or through Netscape, RedHat, etc., as long the user's code is properly patched.

    So, instead of encouraging users to only get the code from them, they should work with others to setup good patch processes that work for everybody.
  • For Mozilla to wait to release security updates would increase the amount of time it takes to deliver security fixes. Mozilla's advantage is that it doesn't wait to deliver updates, so security holes can be filled quickly, unlike the competition.

  • Windows User Here (Score:3, Insightful)

    by Hangtime ( 19526 ) on Sunday May 22, 2005 @12:07PM (#12605190) Homepage
    I have used Mozilla for over a year now and have been VERY satisfied with the release schedule especially as it comes to security releases. I get alerted with the little icon, I press icon, I download update, restart Mozilla, done. When it comes to security updates I do not want to see the release hampered because the distros haven't built it yet because quite frankly most of the exploits out there are for Windows anyway. No, I will not be transitioning to Linux anytime soon but I do support it where I can :).

  • Why? (Score:2)

    by EdMcMan ( 70171 )
    I see the need for everyone to release server type updates at the same time, but not client things like web browsers. If there is a bug for Mozilla announced and your distribution doesn't have an immediate fix, don't use it. Ta-da! Use one of the many other browsers in the meanwhile.

    • Re:Why? (Score:2)

      by calc ( 1463 )
      You must not mean epiphany or galeon since they both use gecko. Opera isn't free software and Konqueror pulls in hundreds of MB of dependencies if you don't use KDE. So there really isn't that much choice out there. So, just use links/lynx. :)
  • Bwaaaaa they're uncooperative... Mozilla doesn't wait those extra days to release their patches so we can have them first... bwaaaaaaaaaaaaaa mommy!!!!
  • Red Hat is basically a collection of several hundred separate OSS projects flying in close formation, each maintained by a separate team and integrated into an RPM for the installer to slide into place. Some of them are basically straight copies of the original, some of them are specially configured by Red Hat, some are more or less heavily modified. They are all different versions, and by no means are they all tracking the absolute latest release.

    There are three or four major Linux releases like this, alo
    • This is a really good summary of OSS projects.

      Lots of minor projects get reincorporated into distro, without any clue what changes were made, and yet are still expected to field bugreps against them.

      At the same time, distros need to identify projects that are significant, and get involved in the dev list/planning, if only to get some kind of presence in the project.

      For example, the Apache Ant project took input from the eclipse and netbeans teams over their release schedules, and once we'd determined tha

Slashdot Top Deals

To be or not to be, that is the bottom line.

Close