Slashdot Mirror
10-Day Patch Guarantee Not Mozilla's Policy
narramissic writes "Mozilla has officially backpedaled from a pledge made at Black Hat by the company's director of ecosystem development, Mike Schaver, to fix any critical security bugs in the browser within 'Ten ****ing Days.' On Friday, Mozilla security chief Window Snyder wrote in a blog posting that the 10-day pledge is not Mozilla's policy, saying 'We do not think security is a game, nor do we issue challenges or ultimatums.' And today, the open source browser maker issued a statement retracting the pledge."
And he's already explained how his comment got out of hand and what he really meant by it.
Glad you enjoyed the party, Robert. To clarify, I was making a personal commitment, not a Mozilla one, that you could redeem that card if there was a vulnerability that you believed needed to be turned around in 10 days. I didn't consider at the time that it would be taken as a Mozilla policy statement -- even *I* don't make new policy announcements at late-night parties in Vegas
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
If your post isnt a troll, perhaps it is a poor attempt at humor.
Mozilla welcomes vulnerability information so that it can address them
Mozilla is pretty quick to address vulnerabilities
MS wont even admit to a vulnerability unless enough of a stink has been made that the world already knows about it.
MS has often ignored serious vulnerabilities until they deemed it necessary to resolve them (see previous point for definition of "necessary")
Dont worry, Mozilla has a long way to go before they slip as far as MS...
StarTrekPhase2 - The Five Year Mission Continues!
The Debian thing is not a strike against Mozilla. Their stance is correct and clear. You can't have someone else using your trademark to cover something that they are supporting.
That wasn't really the problem, I think there were a few disagreements on some defaults Debian had set, but in general I don't think Mozilla would have any problem rubbing-stamping it like they do with other distros' versions. Where it really broke down wasn't really a practical problem, it was more policy vs policy.
Mozilla's policy is that they must approve anything using the trademarked name and logo, so that they can stop bad versions with spyware, adware and such.
Debian's policy is that they must be able to apply security parches immidiately without approval from any third parties.
In themselves, both admirable policies but the road to hell is paved with good intentions. In practise there wouldn't have been any problem getting security patches into Debian's version in a timely fashion with Mozilla's blessing, but one of the policies would have to make an exception. Neither Mozilla nor Debian were willing to bend on their principles, and so Iceweasel was born. Yes, it's a policy aberration but I don't feel one side was being more unreasonable than the other.
Live today, because you never know what tomorrow brings
The real problem was that Debian was using the Firefox logo with modified Firefox code (as in: Debian patches not in official Firefox build), witch is against Mozilla policy.
That's where it started, not where it ended. It went something like:
Moz: "You're using some mods to Mozilla with the official logo, stop it."
Deb: "Ok, but some of these changes we want/need to do."
Moz: "Submit them to us and we'll approve them. Oh and those won't go through."
Deb: "Ok, we can drop those. We'll sumbit the rest."
Moz: "Good. And you must also submit any updates to us first."
Deb: "In general ok, but security patches we'll push immidiately."
Moz: "No, you must. Mozilla policy."
Deb: "Not acceptable. Debian policy."
I think my post was fairly accurate only I didn't include the backstory, there was dialog to fix the rest but the policies were the deal-breaker.
Live today, because you never know what tomorrow brings