Slashdot Mirror

← Back to Stories (view on slashdot.org)

A Security Bug In Mozilla - The Human Perspective

Posted by timothy on from the danger-of-success dept.

xslf writes "Alex Vincent, the reporter of the data-loss security bug 259708, writes about the behind the scene process of reporting it, casting light on the problems of dealing with security related bugs reported by the community, which isn't always aware of the security implications of the bugs reported. The issues with the FLOSS process shown in this bug might get worse, once more and more people use FLOSS and add to the process, without being full fledged coders, and rely on binary releases of software." (Note, you'll have to copy and paste that link to view the bug report, or click through from the linked story.)

78 of 321 comments (clear)

  1. Don't link to bugzilla!!! by AKAImBatman · · Score: 5, Informative

    What are you trying to do? Shut down the Mozilla project?!? If you absolutely NEED to see the bug, go to MirrorDot and look it up there.

    --
    Javascript + Nintendo DSi = DSiCade
    1. Re:Don't link to bugzilla!!! by Anonymous Coward · · Score: 5, Informative

      What's the difference? They block referrers from Slashdot anyway.

    2. Re:Don't link to bugzilla!!! by stratjakt · · Score: 4, Insightful

      timothy, IT's prodigal douchebag, is kind enough to tell all the slashbots to copy and paste the link to get past the referrer problem.

      The editors here truly don't care, even when someone goes out of the way to make it clear they don't appreciate the rubbernecker bandwidth.

      --
      I don't need no instructions to know how to rock!!!!
    3. Re:Don't link to bugzilla!!! by AbbyNormal · · Score: 5, Funny

      Thanks for the mirrodot link. After finishing my fifth epileptic seisure from the pinstripes, I was finally able to read the bug.

      --
      Sig it.
    4. Re:Don't link to bugzilla!!! by dotlively · · Score: 4, Informative

      Blocking access to a page based on the Referrer header doesn't affect user-agents that do not send a Referrer header, such as Opera with the "Enable Referrer Logging" option turned off. I didn't have any trouble with the link in the summary.

  2. Looking for blame in all the wrong places by thewldisntenuff · · Score: 3, Interesting

    "Well, some smarty-pants decided to repost my entire blog entry about bug 259708 as a comment on one of my entries, with an e-mail address of "fulldisclosure@netsys.com". Word for word, no changes, and no commentary either.
    This annoyed the hell out of me. On the one side, I could see this anonymous poster's point: the bug was already in the public domain when it disappeared very suddenly."

    What are you complaining about? Isn't this your fault for taking the entry down to begin with?

    I'm going to troll a bit here, but doesn't this essay/blog entry just bitch about how he feels things weren't handled in a manner to his liking? And shouldn't he be faulted for how he initially handled the bug? (Noted below-)

    "Losing data is horrendous, yes, but not as bad as losing it to someone else. That just wasn't happening here. So I decided not to ask for a security group review. That was my first mistake.

    Lesson Number One: The very instant you start to wonder if a bug might cause a security concern, stop wondering and ask the security group to review. Don't try to do the security group's job by trying to decide if it really is one or not."

    I think the bigger concern here was whether or not the bug got fixed, and once it was properly classified, it was indeed fixed. There probably could have been a faster fix for this bug, but I think most of what happened in this case can be directly faulted to him.....

    -thewldisntenuff

    --
    My MythTV HowTo
    1. Re:Looking for blame in all the wrong places by mobiusjava · · Score: 5, Insightful

      Um, that seemed to be the whole point. Again and again throughout the article he does a mea culpa. At the same time, I believe his general frustration with not knowing how to proceed comes through. We in FOSS need a more concrete process on how to handle bug through the system. And even very successful projects, like Mozilla/FireFox, can do a better job at communicating the way to handle these types of situations.

      --
      Gotta find my destiny, before it gets too late --Ian Curtis
      http://www.shadowpublications.com/blog
    2. Re:Looking for blame in all the wrong places by Tor · · Score: 4, Insightful

      As he tried to convey in the article, the issue is not whether he can be faulted or not (and indeed, he can; then again, you can expect that many/most bug submitters would make "mistakes" like these).

      The quote, however, deals with someone who submitted for his weblog a word-for-word copy of his original bug report, without any comments, return address, or source. That goes a bit beyond useless and unhelpful, IMHO; that borders on disrespectful. At the very least, as he is saying, if that person indeed wanted full disclosure, he should point to where he found the copy of the text, so that the Mozilla security team could be made aware of it.

      Overall a well written article, certainly a lot more thoughtful than your comment.

      -tor

  3. Re:I tried to RTFA by Kenja · · Score: 2, Insightful

    See that text at the top of the page? Now look at the last part of it. See the text that reads "(Note, you'll have to copy and paste that link to view the bug report, or click through from the linked story.)"? Now why do you think that a post about how you cant use the link would be redundant?

    --

    "Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
  4. 3.5-year-old information disclosure and DoS by Jeffrey+Baker · · Score: 5, Informative
    Speaking of existing security bugs in Firefox & Mozilla, here's a security bug that's been open for 3.5 years and really needs some hero to come in and fix it. (The bug is assigned to me but I'm not qualified and don't have the time to come up with a real solution).

    Bug 69070

    The bug was on bugtraq in 2001! It allows remote pages to open and use files on the local machine, and is also a denial of service on Linux, since Mozilla stupidly allows the opening of paths which are not regular files (/dev/tty).

    My experience with 69070 has been educational. I've learned if there's a security bug you care about, you had better fix it yourself. Unfortunately I can't but maybe someone in the audience has the spare time to step up.

    1. Re:3.5-year-old information disclosure and DoS by TrollBridge · · Score: 4, Insightful

      But I thought the very nature of OSS makes this sort of thing impossible. What did I miss?

      --
      There's a Mercedes gap too. I want one and can't afford one, but it's not government's job to do anything about it.
    2. Re:3.5-year-old information disclosure and DoS by The+Bungi · · Score: 5, Insightful
      Interesting. People around here bitch about Microsoft having these "dozens" of "unpatched vulnerabilities" in IE for "years" and "hiding, lying" and "sitting on security issues" and here's a three year old bug in the darling of open source development, who also has a "security classification" for certain bugs that "should not be disclosed" until they are fixed. But it's OK for some dude to publish an IE vuln without first contacting Microsoft and giving them a chance to fix it (which they have been doing very diligently for the past two years), in fact it's fantastic because it makes Microsoft (or "M$") look all the worse. But if it's Mozilla, it's perfectly acceptable. The recent GUI spoofing vuln (related to XUL, I believe) published a few months ago also had a "security classification" and was at least three years old, IIRC. But that's OK, because it's Mozilla.

      Fantastic. Talk about having your cake and eating it while telling everyone they can't have any.

    3. Re:3.5-year-old information disclosure and DoS by Anonymous Coward · · Score: 5, Informative

      "It allows remote pages to open and use files on the local machine"

      You make it sound like it allows remote servers to open and use files from the local machine. In fact what it allows is remote server to cause the local machine to open files locally, which is a different thing altogether.

      It still should be fixed, but it's only a DoS, not a remote-execute or a remote-data-access.

    4. Re:3.5-year-old information disclosure and DoS by daserver · · Score: 5, Funny

      You could just have written: hypocrite :-)

    5. Re:3.5-year-old information disclosure and DoS by julesh · · Score: 4, Insightful

      That Mozilla has a _huge_ number of bugs, many of which have existed for a number of years, a lot of which probably won't be fixed any time soon. Those working on the project don't generally care about them enough to fix them -- this is, after all, "only" a denial of service bug (note: I'm not condoning or excusing this behaviour, just saying that this is how a lot of people think).

    6. Re:3.5-year-old information disclosure and DoS by NullProg · · Score: 2, Insightful

      I agree with everything you said, but remember this.

      Any Mozilla/Firebird vulnerability will not ruin my system. It will not cause me to reformat and re-install linux. It will not cause suspect programs to be installed on my computer without my knowledge. I might lose my $HOME, but not the use of my computer or applications.

      Think about how IE is different in this manner.
      Enjoy,

      --
      It's just the normal noises in here.
    7. Re:3.5-year-old information disclosure and DoS by mdfst13 · · Score: 4, Insightful

      "not ... a remote-data-access."

      According to comment 58 in the bug report: "Given that this vulnerability actually allows sites to do useful things like steal passwords, I feel that we should address it ASAP."

      This bug allows the browser to open and access a local file. The information about the file can then be sent to a remote site with some basic javascript. How is it not a remote data access again? The DoS issue is not good, but the file opening is worse, particularly if someone figures out a way to get the contents of the file rather than just the characteristics.

    8. Re:3.5-year-old information disclosure and DoS by CaptainABAB · · Score: 5, Insightful

      "I might lose my $HOME"

      Please tell me why losing all the documents/files/data you personally created is better then reinstalling an OS/apps, which are available on CDs and the net?

      Hopefully, you have a good back-up plan, but my personal files are 100x more important then any 3rd party binaries.

      IMO - both situations are equally terrible.

    9. Re:3.5-year-old information disclosure and DoS by The+Bungi · · Score: 4, Insightful
      Think about how IE is different in this manner.

      It is not different. If more people stopped running under an administrator account the great majority of IE vulnerabilities would result in the same thing. Most email worms would as well.

      You can happily run under a non-privileged account in Windows NT4 and higher. The opearating system has supported it for at least eight years. That most applications break under such a scenario is Microsoft's fault to a certain extent, but not entirely so. Software vendors are just too lazy to code that way and they assume that they have the go of the entire machine.

      I would like to point another type of hypocrisy however - whenever there's a bug in a Microsoft product that is not "critical" in the sense you use, the slashbots come out of the woodwork claiming it's the end of the world yet again. But a bug in Mozilla that wipes out ~/ is OK, because it's "not critical". Do you really think it's "OK" for the average user to see their files wiped while /sbin is untouched? Tell you what: they would not. They'd rather have to wipe the machine and see it turned into a spam zombie than lose the vacation pics and whatever else they have under there.

      The problem with your assesment of this problem is that you say "user" and you're thinking about a developer or a sysadmin (in a corporate environment perhaps) with nightly backups and whatnot. In that scenario this bug is a nuisance. In reality it's a disaster.

    10. Re:3.5-year-old information disclosure and DoS by RWerp · · Score: 2, Interesting

      I might lose my $HOME, but not the use of my computer or applications.

      I know that you'll say "backups", but for me $HOME is the most precious part of my Linux system. I don't backups every hour, and sometimes the loss of an hour's worth of programming/writing hurts a lot.

      --
      "Long run is a misleading guide to current affairs. In the long run we are all dead." (John Maynard Keynes)
    11. Re:3.5-year-old information disclosure and DoS by RedWizzard · · Score: 2, Insightful

      One point you seem to have missed is that people pay Microsoft for their software and therefore have a right to expect Microsoft to correct security vulnerabilities in a timely manner. As we are not paying for Mozilla we really have no right to make demands. We do have the right to fix the bugs ourselves or pay someone else to fix them, of course.

    12. Re:3.5-year-old information disclosure and DoS by The+Bungi · · Score: 2, Insightful
      We have no problems with our problems. YOU, however, have major issues.

      How quickly does this descend into The Two-Step Plan for Denying All Problems With Open Source While Also Ignoring Them Because They Hurt

      Step 1: "Microsoft is worse" ...
      Step 2: "Fuck off" ...

      No profit here, of course.

      Enjoy,

    13. Re:3.5-year-old information disclosure and DoS by L0rdJedi · · Score: 3, Insightful

      But it's OK for some dude to publish an IE vuln without first contacting Microsoft and giving them a chance to fix it

      Maybe I'm in the minority here, but it's NOT ok for that to happen either. And if I'm not mistaken, the Bugtraq mailing list has very clear guidelines for handling disclosure of any bugs found in any programs. I believe one of those guidelines is that if you're having ongoing discussion with the vendor about a bug, there's no need to report it to Bugtraq. If, however, the vendor is ignoring you or has ignored you for months, post away. Sometimes posting in a public forum is the only way to get a vendors attention.

    14. Re:3.5-year-old information disclosure and DoS by geomon · · Score: 2, Interesting

      How quickly does this descend into The Two-Step Plan for Denying All Problems With Open Source While Also Ignoring Them Because They Hurt

      It doesn't have to. You just seem to have an anger management issue that needs attention.

      I used to be a rabid Microsoft advocate in the early 80's because they were freeing computer enthusiasts from terminal-based mini-computers. I was happy as hell to run my MSDOS-based applications and was freely describing the benefits of the Microsoft-Intel platform vs. Apple due primarily to the fact that the combination of the two companies meant most folks could get a PC on their desks cheaply.

      But then the bullshit began about "no bugs" and the Microsoft denials that they were crippling their competitors software in favor of their own until finally I couldn't stand to take one more marketing turd in my software.

      As far as Microsoft is concerned, I could care less whether they run tractor-trailer rig size security holes in their software. I don't use their stuff any longer. If they had been straight up and admitted their problems, I might have stayed in the Microsoft camp.

      What it comes down to is how you treat your customer. Microsoft was paid to give me good customer service. Instead they chose to lie to me. You may think this is Microsoft vs. open source when it is actually Microsoft vs. themseleves.

      --
      "Rocky Rococo, at your cervix!"
    15. Re:3.5-year-old information disclosure and DoS by Osty · · Score: 2, Interesting

      Open source software exists because of Microsoft.

      Way to revise history, pal! Neither RMS nor Linus had Microsoft as a target when they developed their free software and ideas. Apache wasn't created in response to Microsoft's IIS, nor was Sendmail created because of Exchange (and Postfix, Qmail, Exim, etc were developed in response to Sendmail, not Exchange). Of all of the highly successful and visible open source projects, I can only think of two that were started with Microsoft in mind: The Mozilla project, and OpenOffice.org. In both cases, the software itself started out as a proprietary product in direct competition with Microsoft that failed in the proprietary market for one reason or another. Are there any other successful, visible projects that were designed and developed in direct response to Microsoft? Linux wasn't, nor emacs, vim, apache, sendmail, XFree, gcc, etc. I could maybe see a case made for KDE and GNOME, but they're not direct competitors (can't run KDE or GNOME on Windows).


    16. Re:3.5-year-old information disclosure and DoS by aldoman · · Score: 2, Interesting

      Sadly, this is an issue of manpower (and money, obviously).

      At the moment there just isn't enough full time mozilla developers. Moz Foundation just doesn't have enough cash to stump up for a few dozen full time, good programmers.

      However, I do agree with you somewhat. I have seen too many bugs that have done the rollercoaster of being assigned to 'M18' (which is pre1.0), then go to '1.0', 1.2', '1.4', '1.5', '1.7', then finally '1.9alpha' (which is a mile off in itself)).

      I wonder how much time people spend triaging bugs compared to actually fixing them.

      Someone mentioned the XUL spoofing bug. Sadly, I wouldn't class that as a bug. It's a bit like saying a full screen flash movie that looked and acted like a windows desktop was a bug of internet explorer. I wouldn't agree with that.

      I think (sadly) that Mozilla Foundation is going to have real issues after the AOL money runs dry. Not sure if donations can keep it up. We haven't really noticed the effects because all the attention has been shifted to Firefox, which is just a rewrite of the UI, and doesn't require the sort of engineering that writing a browser core does.

      I'm going to be very interested to see if the foundation can fully implement a brand new, complex standard. I don't think they'll be able to with their current money situation, which sucks :(.

      --
      IntechHosting - Free domain, 2GB, PHP, £4.95/$8.95
    17. Re:3.5-year-old information disclosure and DoS by geomon · · Score: 2

      Way to revise history, pal! Neither RMS nor Linus..

      You mean only Linus and RMS use open source?

      Apache... Sendmail

      Would still be unix workstation projects without the support of thousands of former Microsoft customers who have now switched to open source projects because they are fed up with sub-par software at premium prices. ...projects that were designed and developed in direct response to Microsoft...

      There are thousands of projects on sourceforge that were written as replacement for Microsoft products.

      --
      "Rocky Rococo, at your cervix!"
    18. Re:3.5-year-old information disclosure and DoS by geomon · · Score: 2, Interesting

      The vast majority of people involved in free software do it because they like doing cool stuff, they like writing software, and they like doing as part of a community which appreciates what they do and gives them free reign to play and contribute.

      Just as I said: personal interest.

      Why do people use open source software?

      Because they are tired of the other stuff they've been using.

      No matter how many times I write that statement, someone will fire back that I just don't understand why people write open source software.

      --
      "Rocky Rococo, at your cervix!"
    19. Re:3.5-year-old information disclosure and DoS by sydb · · Score: 4, Informative
      It's a DoS on Linux, probably *n*x. A page has a
      <img src="file:///dev/tty">
      tag in it and it swallows your console, i.e. your keyboard stops working.

      Trust me, I just tried it and if I didn't have gtop (to kill Firefox with my mouse - exiting from the file menu didn't kill the process) I'd have had to hit the power switch.

      Ouch.
      --
      Yours Sincerely, Michael.
    20. Re:3.5-year-old information disclosure and DoS by geomon · · Score: 2

      Interestingly, neither of these de facto FOSS leaders started out with "Destroy Microsoft!"

      You are obviously reading too much into what I have written.

      When I write "open source wouldn't exist without Microsoft" I mean that the entire open source movement would probably comprise just those individuals who were already producing free software for themselves and others to use. The jihadist mentality that you ascribe to my comments is completely out of context and has nothing to do with this discussion.

      Again with the revisionist history.

      Really?

      You assume that Linux just sprang into the fore without some form of support from a user community. You see the server farms quietly being replaced as Linux slowly takes over other *nix products like some infectious organism zapping lowly Sparc-boxen.

      The fact are a bit different than just the replacement statistics alone. Without a userbase of hobbiests, academics, and advocates, Linux would still be at 1.0. The users are as important as the developers in the open source world. It was the users who begged for drivers to run their equipment. The developers obliged and everyone in the open source movement began to realize that community software could be more than the sum of its parts. But most of those users were disgruntled Microsoft users, like myself, who were exploring alternatives to crap products.

      If open source developers forget that they are working not only for themselves but for the users as well, then open source as a movement will fail. The article that is the subject of this discussion underscores my point.

      --
      "Rocky Rococo, at your cervix!"
    21. Re:3.5-year-old information disclosure and DoS by BZ · · Score: 2, Informative

      > We haven't really noticed the effects because all
      > the attention has been shifted to Firefox

      All the media and pr attention has shifted to firefox. The core developers are working on the core as they have been; just check out the list of layout checkins on the trunk in the 6 months since firefox branched.

  5. I will save this bugtrack for later reading.. by Tei · · Score: 5, Funny

    Opps.. where are ALL my precious precious downloaded files?

    --

    -Woof woof woof!

  6. Mirrored by Adam9 · · Score: 3, Informative

    If you don't want to copy & paste...

    Here is a rough mirror. (links are relative, so they won't work)

  7. Re:My experience reporting bugs.. by kmmatthews · · Score: 5, Insightful

    Wait a sec, you're bitching that they won't pay you to work for them, when you don't pay them for thier product?

    Holy hypocrisy...

    --
    feh. stuff.
  8. There's that FLOSS word again by h00pla · · Score: 5, Funny
    I really hate that acronym. FLOSS reminds me of brushing and FLOSSing (ie - picking the crap out from between your teeth). Is it really too much to ask to write out Free and Open Source software or how about Free/Open Source software? I can just see what's next - we'll be referrring to some development process as ENEMA.

    Acronym loving developer: I advocate the use of FLOSS and if it's with ENEMA, all the better.
    CIO: You're fired.

    --
    I've been swashdotted -- Elmer Fudd
  9. Re:My experience reporting bugs.. by Malor · · Score: 3, Insightful

    If you offered to pay them to fix the bug, it would probably be a shade more consistent with your "I don't work for free" stance. Or is it just other people who should work for free?

  10. What is FLOSS ? by babbage · · Score: 2, Insightful

    What the heck is FLOSS ?

    There was a 2002 paper published by the Mitre Corporation that used the term "FOSS", meaning "free and open-source software". As far as I know, this was the first use of the term, but it may go back a bit farther than this.

    I don't, however, have any idea what "FLOSS" is supposed to mean. Assuming that it isn't related to dental hygiene, what is it supposed to stand for ? "Free {Linux, liberty, low-cost} open-source software" ? Just a nonsense corruption of "FOSS" ?

    The closest explanation I can find is this blog entry by David Wheeler: "Free-Libre / Open Source Software". Is this really what people are trying to say ?

    --
    DO NOT LEAVE IT IS NOT REAL
    1. Re:What is FLOSS ? by caseih · · Score: 2, Informative

      Yes. See http://en.wikipedia.org/wiki/FLOSS.

    2. Re:What is FLOSS ? by Glenn+R-P · · Score: 2, Informative

      the F or the L is entirely redundant
      It's trying to deal with the notion that "free" and "libre"
      are different things, hard to express in English. "Free" as
      in free beer that you don't have to pay for; "Libre" as in you
      can have the recipe for the beer, make your own, improve the
      recipe, and distribute the improved recipe.

    3. Re:What is FLOSS ? by caseih · · Score: 2, Informative

      Haha. That's funny. The real link should be http://en.wikipedia.org/wiki/FOSS. If you search for FLOSS, you get redirected to FOSS, which is essentially the same thing, except that some people like to use "Libre" to help indentify the concept of "free as in speech."

      Way to go moderators!

  11. Re:My experience reporting bugs.. by CTho9305 · · Score: 3, Insightful

    is not very positive. If you ever dare to ask if any progress has been made, or for an ETA on a fix, you're bound to get a "well why don't you fix it yourself" indignant reply.
    If progress is made, you'll see patches added to the bug, or comments from developers discussing the fix. Parents get annoyed by incessant kids in the car asking "are we there yet?", and developers get annoyed by incessant users asking "is this fixed yet?". In both examples, the question's answer is obvious.

    Spamming a bug with comments like "why isn't this fixed?", "this bug still annoys me", "don't wontfix this bug" and "this bug is really old and annoying, you guys suck and don't care" doesn't help fix the bug - I can't speak for other developers, but getting many useless emails about a bug only makes me more likely to remove myself from the CC list and forget about it. Having to read through 150+ "why isn't this fixed" comments to find relevant information doesn't help anything either. If someone takes the time to figure out where a fix for a bug needs to go, or contributes something, it's different.

    I would be more than willing to contribute code under contract for this project. Unfortunately, my services do not come free.
    Mozilla is free. Many of the people who fix bugs (for example, me - you'll have to copy and paste that URL) aren't paid. Whining about volunteers not fixing a bug you care about doesn't do anything. Insulting them is even less productive. If you don't have anything constructive to say, don't bother people.

    --
    My server
  12. Re:My experience reporting bugs.. by Jeff+DeMaagd · · Score: 2, Insightful

    I would be more than willing to contribute code under contract for this project. Unfortunately, my services do not come free.

    I know this that was probably just an indignant reply, but I think you escalated it too much.

    Out of curiousity, why should one expect to be paid to contribute to a product they themselves get for free? Free software generally doesn't allow the users to control the priority of bug fixes, and it's not as if they have a big enough budget such that they can pay people to fix the bugs they themselves complain about.

    If you want a specific timeline for a particular project, rather than letting the (unpaid) developers perform their own opinion of how a bug triage should prioritize bugs, I suspect that you'd have to contribute.

  13. Re:My experience reporting bugs.. by mdfst13 · · Score: 2, Insightful

    "you're bitching that they won't pay you to work for them, when you don't pay them for their product?"

    And complaining about how slow they are to fix their free product.

    I knew a guy who participated in a church program to distribute donated furniture to the needy. They showed up at one house and the lady told them to take the couch back since it didn't match her drapes. For some reason, he stopped participating.

    FOSS means that you don't have to wait for someone to change program behavior if you do not want to do so; however, it also means that you don't have any leverage if you want them to change the behavior for you -- they will always be happy to refund your $0.

  14. Yes, you are... by Roadkills-R-Us · · Score: 5, Insightful

    Hmmm. That's a rather difficult conclusion to reach if you really read the article and think about it. Alex accepted the blame where he messed up, and noted other places he wasn't sure about.

    The fact is,the other person should not have reposted someone else's blog entry without permisison.

    The article was quite insightful. Hopefully it will lead to a better process.

    1. Re:Yes, you are... by ElvenMonkey · · Score: 2, Interesting

      In my opinion, if you put an entry up on a blog, you've made them public domain, effectively saying "Hey, world, I've got no secrets here, come and take a peek."
      How is that different from some other guy then having taken a peek, posted it on? Sure, the guy might have asked, but he didn't do anything particularly wrong. Its still the same access rights as before, only its in a different place. Frankly, if you don't want people to copy your comments / views, don't shove them onto the internet in an easily accessible format.

      Too many people put blogs up on the internet these days that contain information that if they thought about it for more than the a second they'd realise they didn't really want to tell the world, or they did but not quite in those words.

      --
      "Joy is not in things; it is in us." Richard Wagner
  15. IAAPST (I am a professional software tester) by Anonymous Coward · · Score: 5, Insightful

    This guy made the #1 mistake you can make when it comes to bug advocacy. He assumed his bug was more important than all the others. It had to be fixed now! Now! Now! Now!

    Which can be entirely correct, but you don't get anywhere by running around like chicken little trying to make everybody look at your bug. They heard you the first time. If you don't have any new substantive information to give them, sit back and relax. People never respond to selfish requests well. It can even discourage them from taking a look at it.

    1. Re:IAAPST (I am a professional software tester) by joey · · Score: 5, Insightful

      Bugzilla seems to encourage this with its system of various ways of voting on a bug, which encourages users to advocate their pet bug in order to get it fixed. I've seen this advocacy spill over into projects that don't use bugzilla recently, and IMHO it just causes a lot of distracting noise.

      --
      see shy jo
    2. Re:IAAPST (I am a professional software tester) by jesser · · Score: 4, Interesting

      Allowing votes might encourage "advocating" bugs, but at least the noise is in forums and in vote counts, not in bug comments. And since I seem to be the only person working on Firefox who looks at vote counts, noise in vote counts isn't a big deal. (I use vote counts to speed up searches for common/popular bugs, and sometimes to decide what to work on.)

      --
      The shareholder is always right.
  16. Re:My experience reporting bugs.. by GoofyBoy · · Score: 2, Insightful

    >Whining about volunteers not fixing a bug you care about doesn't do anything.

    Welcome to the real world. This is why companies have sales people/help desks/managers. The OSS model does away with it, and so now you see why they are needed.

    >Insulting them is even less productive. If you don't have anything constructive to say, don't bother people.

    Sort of like putting up your code for everyone to see and reviewing it (isn't this one of the strenghts of OSS?), people will look at your application. And they will critize on it. Don't want to hear what they have to say, don't listen.

    --
    The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
  17. smart defaults by osssmkatz · · Score: 5, Insightful

    This bug was a security bug in part because Firefox 1.0 changed the default download directory so that downloadable files were saved directly to the desktop.
    Microsoft is always criticized for having bad defaults. In this case, having the default download directory be the desktop was a bad default. I would argue that you wouldn't neccessarily do bad to create a folder for each downloadable file. No one would be annoyed by that, and it would provide protection in the file system for any future holes.

    You could also have a "recently downloaded files" directory on the desktop. Even a shortcut to "Location of downloaded files". Mozilla has been known for its innovation. Using the desktop is not innovative--the desktop should never be a permenant storage location. Everything Microsoft puts there is a shortcut.

    I also question whether it was wise to change or set defaults in a "1.0" milestone release.

  18. My impressions of the Mozilla project by jd · · Score: 4, Insightful
    I've honestly not heard too many good things about Mozilla. Oh, the team is certainly bright, and they have produced an excellent browser, but the politics are hairy and some of the coding quality isn't what I'd expect.


    First off, if someone reports a bug, it should be ASSUMED that there is a potential security issue there, until proven otherwise. Why? Because there are generally side-effects. Even if the bug doesn't directly do anything nasty, it may very well cause something unintended which, in turn, causes something else unintended, and so on. Programmers generally talk of such effects "cascading" or "snowballing", because the effects usually do build up over time. Sooner or later, this will result in a corruption of data, a program crash or an exploit due to insufficient value checking.


    There are two classes of bugs in a computer program. Those that cause the program to crash, and those that don't. The second type are much harder to track down (because you've no real indication of where the problem started), but they are generally much worse and much more prevelent.


    The "correct" way to handle bugs is to assume that (almost) any problem puts the software at risk of a non-fatal bug that could (eventually) destabilize the program or open an exploit. Spelling errors in text messages are probably OK, but even there, if you're placing them in fixed-length buffers, it is saner to check and be sure that the risks are low than to ignore apparently trivial "appearance" stuff that could be catastrophic. I've seen programmers give themselves buffer overflows, I've even seen programmers rely on certain OS quirks when an overflow occurs. The code may not be portable, and it sure as hell isn't safe, but it does work.


    (I've actually seen some code that won't run, unless the debug flag is present. The code will actually segfault if the extra padding the debug data creates is not there. Not from the Mozilla team, this was in a prior place of employment, but it does demonstrate that coding is not just about making something "work" it's about making it work for the right reasons.)


    Now, the Mozilla team is probably simply too small to regard every bug entered in their database as a potentially critical show-stopping security hazard. This, however, reflects more on the userbase than on the Mozilla folks. Open Source works if, and only if, the "lots of eyes" out there looking for problems also translate into "lots of hands" for fixing problems.


    Sure, not everybody is going to be a coder. So? If a mere 1 in every 100 users took the time to chase down not only the bug as seen, but at least some of the prior bugs that that bug depended upon to do anything at all... Mozilla would be in a lot better shape.


    Politics in projects don't help. GCC and Glibc suffer badly from a management style that can be diplomatically summed up as "Old-Style IBM without the money - or the justification". There's a lot of "Not Invented Here", "Somebody Else's Problem" and "It Works For Us", although the GCC team is apparently a lot better than it used to be.


    The moment any project suffers from any of those three things is the moment that it is under a self-imposed sentance of death, to be carried out the moment a better alternative arrives, where the only possible hope of a reprieve is to tackle those attitudes and eliminate them.


    9 out of every 10 security bugs are caused by a fault in attitues, at the time of coding or later, and not by any fundamental nature of computing.


    BTW, this is off-topic, but biologists and geneticists are mourning the passing of one of the three scientists who discovered the structure of DNA. The BBC is reporting the death of Professor Maurice Wilkins, aged 87. He died in hospital, no cause was given.

    --
    It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    1. Re:My impressions of the Mozilla project by 0x0d0a · · Score: 2, Interesting

      First off, if someone reports a bug, it should be ASSUMED that there is a potential security issue there, until proven otherwise.

      Okay, just a moment. Consider the feasibility of this. Even small FLOSS projects may have a hundred bugs open.

      I mean, you *could* consider it a "security hole", but if you take such a policy, you won't be able to actually do much about "security holes".

      --
      May we never see th
  19. Re:Where's the stable version?? by sweede · · Score: 2, Informative

    yes, but the but affected versions from 0.8 on also.

    the download link on the website now though, links to a fixed firefox

    --
    I follow the SDK and GDN principles.. Spelling Dont Kount, Grammer Dont Neither
  20. hiding previously public bugs does not work by joey · · Score: 4, Insightful

    I'm flabbergasted that the mozilla security people seem to think that "hiding" a previously public bug after it's noticed that it has security ramifications is an effective way to keep black hats from noticing it.

    I think it's safe to assume that black hats interested in finding 0-day security holes in mozilla have already, or soon will create a mirror of the bugzilla archive, with history. Then they can look for bugs that are suddenly removed from the public bugzilla archive, and have some very good candidates for fresh security holes.

    And there's no way the mozilla security people can effectively combat this. At best they get into a technology arms race with the black hats, trying to figure out what techniques they're using to spider and mirror the archive.

    Once a bug is posted to a public bug tracking system, even if it's only been there for an hour, you might as well give up and assume it's widely publically known.

    Oh and in my personal experience, the best way to get a security bug fixed once you discover it is to immediatly write an exploit, clearly flag the bug as a security hole, and post it to a public forum with a sifficuently broad readership that someone in a position to fix the bug will, be that the project's BTS or bugtraq.

    --
    see shy jo
    1. Re:hiding previously public bugs does not work by CTho9305 · · Score: 2, Insightful

      Oh and in my personal experience, the best way to get a security bug fixed once you discover it is to immediatly write an exploit, clearly flag the bug as a security hole, and post it to a public forum with a sifficuently broad readership that someone in a position to fix the bug will, be that the project's BTS or bugtraq.

      Great, and now while users are surfing the web between checks of [windows update | product's website], they're getting hacked. Good job.

      If you file a Mozilla bug and mark it as security sensitive, it will get looked at. Often, workarounds are publicized by the Mozilla Foundation before a fix becomes available, so users can sometimes protect themselves. If the bug doesn't get fixed immediately, there are a few possibilities:
      1. It's very very unlikely to be exploited, so long as the black hats don't know about it (e.g. this bug). By publicizing it, the black hats find the bug, and everyone gets hacked. As long as it stays quiet, users are most likely still safe, and developers can work on it (or even more dangerous bugs, if they happen to exist).
      2. The bug is very difficult to fix. The permanent-DoS bug with SSL certs that was fixed a couple releases ago was a good example of this - developers spent a LOT of time trying to track down the problem and fix it. If you go full-disclosure on them, what happens? Everybody gets hacked, and then some time later the developers figure out the problem and fix it.

      Don't take it as a personal insult that your pet bug isn't being fixed right away - there are dozens to hundreds of bugs filed every day, a limited group of people to do triaging (separating the real bugs from the duplicates / invalid bugs), and an even smaller group who know the code well enough to fix bugs.

      --
      My server
  21. Re:My experience reporting bugs.. by Politburo · · Score: 2, Interesting

    Not sure if anyone noticed.. but this post happens to support some of the anti-Linux talking points:

    Linux developers are lazy and/or fickle. They will work only on what they want to work on.

    "...only makes me more likely to remove myself from the CC list and forget about it."

    There is little/no money to be made from developing Open Source

    "Many of the people who fix bugs (for example, me) aren't paid."

  22. Give us CHROOT! by freelunch · · Score: 4, Interesting

    Running Mozilla or Firefox in a chroot environment would greatly enhance security.

    I recently tried to get this working but didn't have much luck (haven't given up yet). There isn't much info on the web.

    I currently run Firefox under a separate user ID, which is better than the default.

    Any suggestions to get chroot working with Firefox?

    1. Re:Give us CHROOT! by pe1chl · · Score: 4, Informative

      > Running Mozilla or Firefox in a chroot environment would greatly enhance security

      Of course it would not have helped in this case.

    2. Re:Give us CHROOT! by otis+wildflower · · Score: 2, Informative
      a few starting bits from a gentoo box (in bash):
      mkdir ffchroot && cd ffchroot;
      ldd /usr/lib/MozillaFirefox/firefox-bin|while read libname separator libfile hex; do echo $libfile|sed "s#$libname##g"; done|sort|uniq|grep "/"|while read x; do mkdir -p ./$x; done
      ldd /usr/lib/MozillaFirefox/firefox-bin|while read libname separator libfile hex; do echo $libfile; cp $libfile ./$libfile; done;
      cp -a /usr/lib/MozillaFirefox usr/lib
      mkdir -p etc usr/bin home/$USER
      cp /usr/bin/firefox usr/bin
      cp /etc/passwd etc
      Unfortunately IIRC you have to be user root to chroot, and theres lots of other dependencies on mozilla.. like /dev/null, xdpyinfo, awk, etc. But if you keep plugging away it should work.
  23. Not exactly redundant. by WebCowboy · · Score: 2, Informative

    The "Libre" is there to "thoroughly describe the movement in one acronym". This is becasue of the dual meaning of the word "free" in the English language. The French have two words that translate to "free": Libre and Gratis. The later refers to cost rather than freedom and "free-gratis" software such as Acrobat Reader, Yahoo Messenger or Bonzi Buddy have nothing to do with the movement.

    I agree that the acronym is unfortunately rather stupid. "Remember kids to use FLOSS daily"...whatever...

  24. Re:My experience reporting bugs.. by d_jedi · · Score: 5, Informative

    Wow.. one post, so much criticism. I honestly haven't experienced that on /.

    Guess it's not a good idea to criticize Mozilla developers ;p

    OK.. allow me to respond to all of the replies in one post.

    1) Bug reports = good. Insulting bug reporters = bad.

    As a developer, I'll tell you that having your customers report bugs to you is a GOOD THING. Something that you want to ENCOURAGE. There is no amount of alpha or beta testing that can substitute for real world use. However, I've been encouraged by this experience to very much just "shut up and take it or leave it" (paraphrasing from one of the more colourful indignant replies I alluded to). I'm not going to report more bugs if this is the response I'm going to get to them. Which is a BAD THING for the Mozilla project.

    2) Encouraging and reminding developers = good.

    Developers are human beings. They can forget, get distracted, etc. And like all people, sometimes it's a good thing to remind them of outstanding issues. Perhaps they forgot about it? Perhaps they've completed the task, but haven't checked it in? Perhaps the guy responsible for the bug has too much work on his plate, but is reluctant to say so without being prodded.

    Certainly, a post every few days asking if the bug's been fixed is just about as annoying as "are we there yet?" queries on car trips with children. But that was not the case here.

    3) There ARE paid developers working on Mozilla

    Most of them work for Netscape. I wouldn't doubt if there were contract workers as well. Personally, as an independant developer, I don't have the time or resources to program if I'm not being compensated for it. The question was asked why I don't fix it myself, and I gave a truthful answer. As a result (as here on /. ) I was flamed.

    I hope this clears up any confusion.

    --
    I am the maverick of Slashdot
  25. OSS Is Not A Magic Bullet by EXTomar · · Score: 3, Insightful

    Anyone who is claiming that FLOSS is the perfect software development model is either trying to sell you something or simply mistaken. One of the weaknesses is simply everything is subject to interptation.

    The people who find the bugs are often do not agree with the people fixing/writing the application. If you are using one of the "for profit" models, its easier to prioritorize bugs: you target the ones that are the most expensive first. With FLOSS it is the one that is most anoying. A bug might be the most anoying bug in the world but if the core team is not going to hit it they aren't inclined to fix it.

    What is implied in the FLOSS development model is that the reporter is savy enough to jump into the code and either fix it themselves or give enough inside help to someone who can to cut down the fix time. When this does not happen you have problems.

    In short, OSS is IMHO a better model for colaborative project development. However no one should ever believe it it is perfect. Everyone must remember that neither colaboration nor agreement are guarenteed with FLOSS.

    1. Re:OSS Is Not A Magic Bullet by DrMorris · · Score: 2, Insightful
      One of the weaknesses is simply everything is subject to interptation.
      [...]
      If you are using one of the "for profit" models, its easier to prioritorize bugs: you target the ones that are the most expensive first.

      What are "expensive" bugs? This too, depends on interpretation. If you are a software company which develops firewall solutions, security flaws are most likely the "expensive" bugs. If - in contrast - you develop so-called "end-user" software, the most expensive "bug" may be a new icon theme for your app or a nifty new button for <insert any useless feature here>.

  26. Re:Unconfirmed bugs by mcsmurf · · Score: 2, Informative

    No :), but people who are more experienced/skilled get more rights in Bugzilla. With those extended rights you can fill a bug as NEW (which doesn't necessarily mean your bug gets more attention).

  27. He got the bounty ... by Paul+Bolle · · Score: 2, Informative

    He seems to have gotten a bounty from the Mozilla Foundation for this.

  28. Re:Google always know.... by RWerp · · Score: 2, Funny

    What???? FRENCH words spoken on US soil? Change it to "FFOSS" = Freedom Fries Oopen Source Sofware.

    --
    "Long run is a misleading guide to current affairs. In the long run we are all dead." (John Maynard Keynes)
  29. Actually, things went really well. by dwheeler · · Score: 5, Insightful
    The author makes the process (from the user point of view) sound much worse than it really was. Was this a bad bug? Of course, all agree that dataloss is a terrible thing. But:
    1. this was immediately marked as a blocker, so the official (initial) release of Firefox was NOT going to go out with this bug, anyway, no matter what.
    2. once it was identified as a security issue, it was fixed within a half hour, even though it was an incredibly difficult bug to find (3 project developers had tried and failed).

    Yes, ideally all bugs are fixed even more rapidly. But originally this wasn't marked as a security bug, and nonsecurity bugs often take more time to fix than you'd wish in any development process:

    1. The bug appeared to be an extremely unlikely occurance, and thus while important to fix before release, it's not clear that the delays were in any way unusual for ANY development project. Although it had bad ramifications, it's also clear that triggering this accidentally is extremely difficult. None of the millions of users using Firefox had reported it before, and previous versions have been out for a while. The priority of a bug doesn't just depend on the severity of the problem, but on the likelihood. If a dataloss can happen 1/day, that's much more serious than one that happens 1/millenium. For extremely unlikely triggers, it's not at all unusual for those to take longer to correct in either proprietary or open source software. In part that's because of the difficulty of tracking down such uncommon problems to their source.
    2. This was obviously a hard bug to fix. Three people tried to find the bug, and couldn't do so. The author wishes that even more people would've worked on it in the early days, but all projects have a limited number of people and much to do. Heck, in most proprietary projects, you assign only one person to handle the bug, and that person has 100 other assignments too. He had three people directly working on it, with discussion by others... that's far more help than many projects get.

    What changed everything was marking it as a security requirement. Here I agree with the author - the author should have identified this as a security problem in the first place. And I'm really sympathetic to his sitatuation; we all make mistakes, and at least he reported the bug in the first place. Thankfully, a later reader DID realize this, and raised it to a security issue. As a security issue, suddenly the "unlikely" problem becomes "near certainty" since an attacker WANTS to cause trouble, and will work to cause the unlikely to happen.

    And once it was labelled as a security problem - look at the speedy response! It was fixed in less than a half hour - that's extraordinarily fast in any software development process, OSS/FS or proprietary. It's even more amazing because the problem was in a completely different place than 3 previous developers had thought... so this was clearly not an easy bug to find and fix (at least for most project developers).

    And Firefox is still at the "previous release" level, it's not even officially released! I routinely use Mozilla and Netscape, not Firefox, because Firefox THEMSELVES state that the product's not ready. When they say it's ready, I'll let other people try it out first; version 1.0s are often a little wet behind the ears (remember Windows 1.0? Probably not, and there's a reason for that). But once Firefox 1.0 is out for a little while, I'll probably switch to it; it looks really nice. Obviously a lot of people

    Getting ansy about taking a little extra time to find a non-security bug, when the product can't be released til it's fixed anyway, and it's hard to fix, seems a little excessive.

    The process issues he raises are interesting issues, and they're certainly worth addressing. E.G., how do you "make secret" that which is already public? But I'm sure there are many possible answers; discuss, pick one, and move on.

    --
    - David A. Wheeler (see my Secure Programming HOWTO)
  30. The headline makes me laugh by wazzzup · · Score: 5, Funny

    Today's Headline - A Security Bug In Mozilla - The Human Perspective

    Tomorrow's Headline - A Security Bug in IE - Sweet Jesus, Microsoft Fucking Sucks Yet Again

    Don't worry, I hate Microsoft too ;o)

  31. Dental Hygene by GoRK · · Score: 3, Funny

    FLOSSing by itself is not enough. You must also BRUSH to prevent tooth decay and maintain your health.

  32. Hypocrisy by wtrmute · · Score: 3, Insightful
    But it's OK for some dude to publish an IE vuln without first contacting Microsoft and giving them a chance to fix it

    It's certainly not all right for someone to publish a vulnerability without contacting MS; any responsible FOSS developer will agree. However, once a security vulnerability is in the wild, it's in the wild, and pretending it doesn't exist will not help matters any.

    The big beef most FOSS developers have with MS lies in the fact that the current rendering engine for MSIE, Trident, is obsolete, MS acknowledges it as such, and yet still refuses to overhaul it. I quote from Wikipedia (emphasis mine):

    In a May 7, 2003 Microsoft online chat, Brian Countryman, Internet Explorer Program Manager, declared that on Microsoft Windows, Internet Explorer will cease to be distributed separately from the operating system (IE 6 being the last standalone version); it will, however, be continued as a part of the evolution of the operating system, with IE updates coming bundled in OS upgrades. Thus, IE and Windows will be kept more in sync: it will be less likely that people will use a relatively old version of IE on a newer version of Windows, and newer versions of IE will not be usable without an OS upgrade.

    Now, this is a problem because many Windows users use versions of Windows which are obsolete: 98SE, ME, 2000. When Longhorn comes, this trend will of course hold true: people don't rush to the stores to buy the newest Operating System version. This means that people will be using still old versions of MSIE long after IE7 comes, which will, of course, be unsupported by MS because they don't want to trail support for 5 or 10 different versions of a single product.

    Finally, tying the web browser to the OS version ensures that a product that is upgraded for free today won't be in the future: remember, you may get the "newest" version of MSIE for free, but you must pay $50 or $60 (if memory still serves) for a new version of Windows, not counting the hardware upgrades which prove necessary. Most people will think that the old version works "well enough" and blissfully go on surfing the Web. Remember, security vulnerabilities are such because they're not obvious.

    In conclusion, FOSS developers do not criticize MS for keeping quiet about security vulnerabilities which do not yet have a fix; they criticize it for denying the need for a complete overhaul of their application even faced with massive evidence that their rendering engine has given what it had to give; instead, they concoct a scheme to force users to upgrade (spending money they might not have) in order to keep their data safe.

    1. Re:Hypocrisy by The+Bungi · · Score: 4, Interesting
      Now, this is a problem because many Windows users use versions of Windows which are obsolete: 98SE, ME, 2000. When Longhorn comes, this trend will of course hold true: people don't rush to the stores to buy the newest Operating System version. This means that people will be using still old versions of MSIE long after IE7 comes, which will, of course, be unsupported by MS because they don't want to trail support for 5 or 10 different versions of a single product

      I don't contest what you're saying, and personally I think it's a bad idea from Microsoft, assuming it actually happens. But I find this argument quite interesting.

      Let's assume for a second that Mozilla becomes the most widely used browser in the world (for whatever operating system). 100 million people download and install it. And then someone finds another serious vulnerability with it. The Mozilla folks patch it. Then what? 20 million people upgrade, and 80 million don't. What then? The exploits come. How does Mozilla handle this? Because they're going to have exactly the same type of problem Microsoft has today: people who just don't give a damn if their computers are turned into spam zombies or get bogged down with malware. These are the people from whose machines you and I still get those stupid mass-mailing worm messages, and of course spam.

      Mozilla can very well damn rewrite the entire Gecko codebase and it will do them absolutely no good. Just like Microsoft with IE. With the small distinction that Microsoft does still support three versions of IE, while Mozilla likely won't even go there.

      Today you can find thousands of Linux machines out there that have year-old holes in Sendmail, SSH and the kernel itself. It's just that very few of them are being run off Comcast cable modems and virus writers just don't see much value in taking them over. It's no different from Windows.

      Even if Microsoft decided to bite the bullet and support seven versions of IE, I doubt it would do much good. What they can do is "force" users to upgrade to minimize the problem, which is what people around here call "the upgrade train" and is exactly what RedHat started doing with their corporate customers because support costs are prohibitive. And that's what Mozilla will have to do ("we don't support version X anymore, sorry. Upgrade to Y now!") because there's no other way to approach it.

      And BTW, the fact that some obscure company decided to "support" older versions of RHEL means nothing in the desktop/home user space, so "having the source" is useless.

      The people who write free software seem to think they can engineer all these problems away by writing "cool code" and making it "absolutely secure" from the get-go. That's not going to happen. They're still finding bufer overflows in Sendmail, for crying out loud. No, they're going to be in the same situation as Microsoft is today and they're going to get the same beatings left and right. I really hope I get to see that, if only for the chuckles.

  33. Backing up every hour... by xeno-cat · · Score: 2, Interesting

    I use the following shell script to create hourly backups using rsync. It was taken from a very nice tutorial called something like "easy automated backups using rsync". Google should find it.

    Ad the script to an hourly cron cycle. All the backups will take only ORIGINAL_SIZE + CHANGED_FILES_SIZE. This script does 9 backups spanning nine hours into the past. Or days, or weeks or whatever you set your cron cycle to.

    You can restore from backups simply by copying the desired file from one of the bak.n dirs. Of course, subversion or CVS will give you nice backups as well but this is pretty easy to do.

    If anyone has any suggestions for improving the script, please reply! :)

    #!/bin/bash
    SOURCE=/home/someuser
    DEST=/some/o ther/dir/partition/or/system

    rm -rf $DEST/bak.9

    mv $DEST/bak.8 $DEST/bak.9
    mv $DEST/bak.7 $DEST/bak.8
    mv $DEST/bak.6 $DEST/bak.7
    mv $DEST/bak.5 $DEST/bak.6
    mv $DEST/bak.4 $DEST/bak.5
    mv $DEST/bak.3 $DEST/bak.4
    mv $DEST/bak.2 $DEST/bak.3
    mv $DEST/bak.1 $DEST/bak.2
    mv $DEST/bak.0 $DEST/bak.1

    rsync -a --delete --link-dest=$DEST/bak.1 $SOURCE $DEST/bak.0

    # End script

    --
    "A few great minds are enough to endow humanity with monstrous power, but a few great hearts are not enough to make us w
  34. Maybe I'm missing something by k12linux · · Score: 3, Insightful
    The bug was flagged as a security issue the same day it was added to bugzilla. A patch was released within a couple of weeks and it made it into the binaries pretty soon after that. At least that's the impression I get looking over the bug entries which run from 9/15 through 10/4.

    So.. please help me understand how this reflects so poorly on the Mozilla developers? Also, how does the way this was handled put them in the same crowd as MS? Especially after MS is caught sitting on serious security flaws for six months or more then sneaking the patches into a service pack without ever telling anyone the flaw existed?

  35. Re:My experience reporting bugs.. by MobyTurbo · · Score: 2, Informative
    3) There ARE paid developers working on Mozilla

    Most of them work for Netscape.

    Not anymore. Netscape spun off Mozilla (mysteriously after AOL, the parent company, recieved money from Microsoft to continue to use IE in the AOL browser) to the Mozilla Foundation. Most of the developers from Netscape who worked on Mozilla were laid off and some of them went on to work at the Mozilla Foundation.

    Somehow, however, the quality of the product hasn't suffered; lots of work continues on Firefox. In the past, before open source, such a thing would be a death nell to a software project.

  36. Anyone actually saying that by bogie · · Score: 3, Insightful

    That's what you missed, listening to anyone with any level of maturity and experience in the OSS community . Red Hat doesn't say that can NEVER happen with OSS. Linus doesn't say its IMPOSSIBLE for OSS software to ever have bugs or security issues that aren't found and fixed. The Debian developers don't claim they have fixed every single potential bug in every single package they put out.

    One of the most annoying things users do is pick one single instance and say "HA!!!, this proves OSS is whatever". Newsflash, one OSS project doesn't=every OSS project. There is well written and secured OSS code out there and there is shoddy insecure OSS code out there. Nobody ever claimed that OSS is a panacea for all security issues.

    Nice straw man though. Insightful my ass.

    --
    If you wanna get rich, you know that payback is a bitch
  37. Re:My experience reporting bugs.. by dvdeug · · Score: 2, Interesting

    Spamming a bug with comments like "why isn't this fixed?", "this bug still annoys me", "don't wontfix this bug" and "this bug is really old and annoying, you guys suck and don't care" doesn't help fix the bug

    On the flip side, each program has its own bug tracking system, with its own specialized demands for information that I have to hunt up and assemble in its own specialized manner. Furthermore, I have to localize the bug and provide a reasonable testcase. And after spending that time to help you find a bug in your program, to be told that "nobody uses that feature", or worse yet just ignored, isn't amusing and encourages me, in the future, to work around bugs instead of reporting them, since we know you aren't going to fix them.

  38. Not in business by brunes69 · · Score: 2, Insightful

    In business, if a virus sweeps your network and deletes 10-15 peoples home directories, no sweat. You tell them to keep working, and one at a time restore their files from the backup you did of those directories yesterday. (Any non-braindead company I would hope would be doing daily backups of user data). But if the virus takes out the *OS*, thats a whole other ball of wax. The sysadmin, who is a limited resource, has ot go around to N machines and re-install/re-image them. And for the hours this takes him, all the people involved cannot do any work. So you're basically throwing thousands of dollars of salary per hour down the toilet.

  39. How to earn canconfirm by tepples · · Score: 2, Interesting

    You're seeing the effect of bug 179944 ( http://bugzilla.mozilla.org/show_bug.cgi?id=179944 ). To learn how to apply for the "canconfirm" privilege on bugzilla.mozilla.org, which grants the ability to file NEW bugs or to change UNCONFIRMED bugs to NEW, read Bug Triagers' Guide and Before you mail Gerv. If you're good at reducing examples of Gecko misbehavior to test cases, you may want to apply for "editbugs" as well.