Re: On Mozilla-* updates

[Moritz Muehlenhoff <jmm@inutil.org>]

In gmane.linux.debian.devel.security, you wrote:
>>   Mozilla *appears* to have no interest in supply patches which 
>>  *only* fix security holes to distributors.  Their line is more
>>  "upgrade to the newest version".  Whilst the new versions do
>>  fix the holes, they traditionally also break things built against
>>  them, such as extensions, galeon, etc.
>
> I thought some member of the Debian security team has access to the
> hidden bug reports. Can't that member extract the relevant patches then?

If the isolated patches were pulled from Mozilla Bugzilla by Matt Zimmermann
(who appears to be Debian's Mozilla security delegate) and published as part
of a DSA this would point to the core of each vulnerability and make exploit
creation easier than reconstructing this information from the large interdiffs
between their stable releases. This tends towards security through obscurity,
but seems to be Mozilla's policy for bugs with their internal "Critical"
severity.

Cheers,
        Moritz