Opera Screeches at Mozilla Over Security Disclosure

The Register is reporting that Mozilla's handling of a recent security exploit that affected both browsers has drawn an unhappy response from the Opera team. "Claudio Santambrogio, an Opera desktop developer, said the Mozilla team notified it of a security issue only a day before publishing an advisory. This gave the Norwegian software developers insufficient time to make an evaluation. [...] Santambrogio goes on to attack Mozilla's handling of the issue, arguing that it places Opera users at unnecessary risk."

Comments

All Things Considered...

[neonmonk]

At least Mozilla told them of the issue. I personally don't think it's their ultimate responsibility. Definitely obligated to do something... but imagine the kind of action Opera would have if Microsoft found the security flaw.

Re:All Things Considered...

[allcar]

I agree that they probably fulfilled their minimum obligation, but it would be great to see a much higher degree of co-operation between the vendors of minority browsers. By all means attack MS in this way, but play nice amongst the good guys.

Re:All Things Considered...

[moderatorrater]

I don't see it as an attack. It sounds like Opera didn't respond to Mozilla's notification at all. In addition, it's not Mozilla's obligation to make sure that Opera's secure, and it is their obligation to be open with the community to the extent that they can be while still being secure. Sometimes waiting to disclose can bite you in the end like it did with php a few months back. Add to that the bullshit excuse that you can't evaluate a security risk in one day and I think that Opera's just lashing out because they're embarrassed that they have a security flaw.

Re:All Things Considered...

[pthisis]

I agree that they probably fulfilled their minimum obligation, but it would be great to see a much higher degree of co-operation between the vendors of minority browsers. By all means attack MS in this way, but play nice amongst the good guys.

Full public disclosure of security bugs is generally considered the best way to get rapid fixes, and was the entire reason that places like BugTraq were founded. Following standard protocol is not an "attack". Vendors like to assume that you're just maliciously publishing things that would be no problem for their users until you did so. That's untrue.

Many bugs are well-known by black hats before they are found by the good guys. The safest thing for users is to assume that all severe bugs are well-known by the bad guys; when you disclose publically, you give the users a chance to protect themselves even if the software is not yet fixed. I'm not sure of the details of this exploit, but they may be able to protect themselves by limiting their surfing to well-known trusted sites, using an alternate browser, or turning off javascript or whatever. In other cases, some sort of external wrapper or proxy, tighter firewall rules, limiting access to DMZs, or other external steps can help prevent big security problems even without a full vendor fix available yet. It may even be worth it to some users just to forgo using an application for a few days until it's fixed.

Keeping silent until the vendor fixes things might just hurt the user's security situation, and certainly doesn't give the user the option of evaluating the risk and determining whether it's worth ignoring it or not--it forces them to make their usage decision without good information.

Re:All Things Considered...

[nigelo]

Am I missing something?

The problem was reported in November and fixed in early February.

Clearly, this is longer than one day.
Following the links in other posts to the mozilla issue tracking, it apparently took a while to fix.

The Opera guys would have liked a little more heads-up than one day, that's all, and that doesn't seem unreasonable to me.

Why all the high-and-mighty whining about 'if they really cared they would have fixed it'?

Re:I must be missing something here...

[sholden]

So mozilla should have left their users open to the big for longer, by delaying the fix so that Opera can catch up?

Or are you saying they should have released the fix and not mention what it was fixing - making it less likely people would apply the fix (plus it's open source not saying what it's fixing doesn't really keep it secret)?

Note that mozilla never mentioned Opera in the advisory anyway.

So what you're really saying is that Mozilla should pass all it's security fixes past Opera and IE and Safari and Konqueror and etc and not release them until all of those competitors have said "OK we've fixed it too".

Re:Sheesh...

[NMagic]

You know, looking at Mozilla's release, they didn't seem to mention anything to anybody about Opera having a problem too. Looks more like Opera screwed themselves.

Re:I must be missing something here...

[saltydog56]

You know, maybe I am blind, or perhaps just a little slow today, but I looked at the actual advisory (did you?) and I see no mention of the fact that the same bug impacted the Opera browser.

What I seem to get from the article is that a problem was found with Firefox, a fix was developed, and sometime prior to wrapping things up and deploying the fix, someone at Mozilla cared enough about the Internet environment we all share to do a quick regression test of Opera and when a problem was discovered, they PRIVATELY notified the Opera team.

What more could you ask for in the way of good citizenship?

Re:Sheesh...

[pthisis]

But never hiding bugs is silly. For example, if you provide an strace of ssh crashing, you'd want to mark that private at least.

Maybe, maybe not. You never know what the black hats already know; as a _user_ of ssh, if you disclose then I can take steps to limit damage--e.g. if I'm allowing full ssh access from outside my network (so that employees can work on the go), I may decide that the small benefit of doing so doesn't merit the risk. I'd rather turn off external ssh access for a few days until there's a fix.

When you hide the bug, you're hiding the ability for the users to take steps to protect themselves. You're forcing me to run with exposed systems for several days, and hoping that nobody "bad" knows about the bug. And you're making that judgement for your users rather than giving them the ability to make that call themselves; that's almost impossible given that the judgement might hinge heavily on whether I'm a large financial institute or a personal blog site that backs up daily. Just guessing that most users are happy with your security through obscurity is bound to be wrong in some cases, and those cases are likely to be some of the more financially significant ones.

(That's on top of the pressure to issue a real fix that full disclosure brings. Before things like BugTraq, it was common for people to sit on severe security bugs for literally _years_.)

But you've missed the point...

[Half-pint HAL]

That obligation is trumped by Mozilla's moral obligation to make sure that people who use Mozilla are not vulnerable to an exploit.

No one is suggesting that Mozilla should have delayed the fix (in order to hold back disclosure).

No, it would have been open and responsible and good if someone at Mozilla had thought to send an email to the Opera dev team a week or two ago saying:

Roses are red, violets are blue
We're fixing this exploit and think you should too.
Lots of Love,
Your secret big red monster Valentine.

No need to coordinate releases, but given that it took them a while to patch it, they should assume it'll take Opera a wee while to, and in the meantime they're leaving members of the public open to exploit.

Members of the public that used to use Firefox, but had to stop because Mozilla never fixed the memory leak and these users were using old machines (NT4, 32 meg RAM) and Open Source was supposed to mean never being obsolete, but it was only the non-open, free Opera browser that offered me a fully-patched, fully working browser.

HAL.