10-Day Patch Guarantee Not Mozilla's Policy

narramissic writes "Mozilla has officially backpedaled from a pledge made at Black Hat by the company's director of ecosystem development, Mike Schaver, to fix any critical security bugs in the browser within 'Ten ****ing Days.' On Friday, Mozilla security chief Window Snyder wrote in a blog posting that the 10-day pledge is not Mozilla's policy, saying 'We do not think security is a game, nor do we issue challenges or ultimatums.' And today, the open source browser maker issued a statement retracting the pledge."

Comments

It's Shaver

[Anonymous Coward]

And he's already explained how his comment got out of hand and what he really meant by it.

Clarification

[nacturation]

On this blog entry Mike Shaver clarifies:

(I thought I commented here on Friday, but I was working from my Blackberry, which is not especially web-friendly. Bleh.)

Glad you enjoyed the party, Robert. To clarify, I was making a personal commitment, not a Mozilla one, that you could redeem that card if there was a vulnerability that you believed needed to be turned around in 10 days. I didn't consider at the time that it would be taken as a Mozilla policy statement -- even *I* don't make new policy announcements at late-night parties in Vegas :) -- but it seems to have been read that way, which I can understand in hindsight. I'm sure I'll be answering for my potty mouth and apparent lack of clarity for a while... Also spelled out on his own blog.

Re:So... eleven days?

[RobertM1968]

If your post isnt a troll, perhaps it is a poor attempt at humor.

Mozilla welcomes vulnerability information so that it can address them

Mozilla is pretty quick to address vulnerabilities

MS wont even admit to a vulnerability unless enough of a stink has been made that the world already knows about it.

MS has often ignored serious vulnerabilities until they deemed it necessary to resolve them (see previous point for definition of "necessary")

Dont worry, Mozilla has a long way to go before they slip as far as MS...

Re:Mozilla Corporation becoming truly corporate?

[Kjella]

The Debian thing is not a strike against Mozilla. Their stance is correct and clear. You can't have someone else using your trademark to cover something that they are supporting.

That wasn't really the problem, I think there were a few disagreements on some defaults Debian had set, but in general I don't think Mozilla would have any problem rubbing-stamping it like they do with other distros' versions. Where it really broke down wasn't really a practical problem, it was more policy vs policy.

Mozilla's policy is that they must approve anything using the trademarked name and logo, so that they can stop bad versions with spyware, adware and such.
Debian's policy is that they must be able to apply security parches immidiately without approval from any third parties.

In themselves, both admirable policies but the road to hell is paved with good intentions. In practise there wouldn't have been any problem getting security patches into Debian's version in a timely fashion with Mozilla's blessing, but one of the policies would have to make an exception. Neither Mozilla nor Debian were willing to bend on their principles, and so Iceweasel was born. Yes, it's a policy aberration but I don't feel one side was being more unreasonable than the other.