Re: On Mozilla-* updates
* Geoff Crompton:
>>
>> For these packages, help and/or advice is appreciated.
>>
>
> Can we try to get a DD involved in the mozilla security team? Presumably
> when they become aware of a security issue, there is some discussion
> about the problem and how to fix it. Access at this level may make it
> possible to identify in the code where the problems are.
Maybe the Mozilla Foundation doesn't *want* isolated patches to be
published because they make it easier to understand the bug and write
exploits? Do we know for sure that they don't publish separate
patches because of lack of time or interest?
(This is not as crazy as it sounds. Microsoft pushes out additional
code changes along with security updates to make the task for BinDiff
harder.)
Reply to: