Slashdot Mirror
10-Day Patch Guarantee Not Mozilla's Policy
narramissic writes "Mozilla has officially backpedaled from a pledge made at Black Hat by the company's director of ecosystem development, Mike Schaver, to fix any critical security bugs in the browser within 'Ten ****ing Days.' On Friday, Mozilla security chief Window Snyder wrote in a blog posting that the 10-day pledge is not Mozilla's policy, saying 'We do not think security is a game, nor do we issue challenges or ultimatums.' And today, the open source browser maker issued a statement retracting the pledge."
And he's already explained how his comment got out of hand and what he really meant by it.
For me, I always thought that Mozilla was a small and nice open source company. These days, it feels to me as if Mozilla is starting to blend into the corporation scene just like any other evil corporation. The whole Firefox naming debacle on Debian, and now this. Now that they're controlling a big market of the web browsers space, should we continue trusting them? Would it be time to look at Konqueror or other browsers?
The hip way to get your IP. No ads, ever.
Upon hearing the news of this "flip-flopping," President Bush confidently stepped in for the Mozilla group and challenged the black hats to "bring it on."
Your ad here. Ask me how!
Making that sort of pledge is rather rash. I am not saying it can't be done, but I don't see it as simple to fix anything anytime.
Questions you have to ask are;
Is it really a bug?
Can it really be reproduced?
etc etc
Being timely in bugs is good. But not all crashes are the result of bad software. You have to be sure your fix doesn't turn another thing into a bug. They would soon end up chasing after every little bit of dust and lose sight of their real work.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Glad you enjoyed the party, Robert. To clarify, I was making a personal commitment, not a Mozilla one, that you could redeem that card if there was a vulnerability that you believed needed to be turned around in 10 days. I didn't consider at the time that it would be taken as a Mozilla policy statement -- even *I* don't make new policy announcements at late-night parties in Vegas
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
My mayor ran on the promising of "fixing any pothole within 24 hours of discovery." Of course the roads are still filled with potholes. Turns out, it was 24 hours of any confirmed pothole, which is trivially easy as the pothole confirmation team is as slow/backed up as the pothole filling team.
Your ad here. Ask me how!
...we still have companies like Google that can set good examples.
If your post isnt a troll, perhaps it is a poor attempt at humor.
Mozilla welcomes vulnerability information so that it can address them
Mozilla is pretty quick to address vulnerabilities
MS wont even admit to a vulnerability unless enough of a stink has been made that the world already knows about it.
MS has often ignored serious vulnerabilities until they deemed it necessary to resolve them (see previous point for definition of "necessary")
Dont worry, Mozilla has a long way to go before they slip as far as MS...
StarTrekPhase2 - The Five Year Mission Continues!
Most Geeks feel very lucky if they get laid once a month or so. Therefore ten fucking days is about ten months or so. Should be able to roll out a patch in that time, especially since we get so many days to work on software rather than having sex.
Engineering is the art of compromise.
to hold up to the 10-day pledge but in the end, if something major holds back a fix, are we all going to bash them for missing the 10-day pledge? I doubt it. After all, we are not talking about Microsoft. These people are trying to do the best job possible and don't have to consider how the browser fix would interfere with some feak'n gumball machine driver that has IE code in it.
But she's right in that they really shouldn't be making statements like that without having discussed this with their team and doing so could be considered a challenge to others. Not something you want to do with a company willing to pay billions just to purchase marketshare let alone how much they'd be willing to put into ads and other FUD should a fix take 241 hours.
LoB
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
Are the censored four letters "work"?
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
Yes, like Microsoft, the Mozilla security chief will resort to insulting the competition. I expect he'll make many snyde remarks about Windows.
I hate printers.
As an aside, it always seems the network and hardware geeks are the ones who smoke pot, and the database and BSD guys who like their vodka. The C/C++/Java programmers (this is my category, usually) are chain smokers - Marlboro Reds in a soft pack style, and caffeine junkies. How many of you have a Mountain Dew can that you're drinking next to an empty Mountain Dew can - and both are still cold to the touch? Yeah - all the programmers.
And the Mac guys generally seem to be clean cut replicas of Jeff Goldblum, for the most part. They're health conscience, and probably taking on a good number of sunshine units from those freakin' 45 inch MacBook Pro screens as they tend to be fans of irony. Mac guys also probably currently have a half gallon of water, in a jogging harness, on their desks right now... probably the cleanest desks on
Oh, and I think the Amiga guys are in to acid or something - that's why they've been in their garages for the last 15 years hacking away. Poor guys don't even know their wife unplugged the monitor 3 years ago.
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.
They might have a long way to go, but every journey begins with that one little step and this definitely looks like that step...
Me failed English...
FreeBSD over Linux. If my comments seem odd, this may explain...
The stupid thing is it is a statement of policy, it's just that it's not in marketing speak.
If your brother says something like that you know you'll get either that or a good excuse. The good excuse is always an unwritten option, it's just with professional liars that you have to tie them to the every single written word because trying to pin them to a statment is like trying to pin live eels!
This is a step in the right direction, though. Guaranteeing to fix a future bug that you know nothing about in ten days is just plain insanity. While it's a nice pledge from a marketing viewpoint, developers realise that it's just a lie.
++ Say to Elrond "Hello.".
Elrond says "No.". Elrond gives you some lunch.