Re: On Mozilla-* updates
On Wed, Aug 03, 2005 at 01:01:40PM +0100, antgel wrote:
> Matt Zimmerman wrote:
> > You're welcome to attempt to convince the Mozilla project to change
> > the way that they work for the benefit of distribution security teams. If I
> > recall correctly, others have unsuccessfully attempted this in the past, but
> > since you are interested in this issue, perhaps you will try again and
> > report back to us.
>
> If it comes to that then I will. I'd like to see how this thread pans
> out. From what I gather so far, there are three issues:
It has come to that. There is clearly a communication gap.
However, last night we learned that a Mozilla security representative will
be present at OSCon, as will Debian and Ubuntu representatives who are
willing to talk with him about this issue, so we'll see what comes of that.
> 1) There is no visibility of some Mozilla security patches due to the
> embargo.
>
> We do have visibility of these via mdz.
I have only heard this issue from the testing security team. I am happy to
relay patches to them on request, but it would probably be more effective
for them to request access directly from Mozilla.
> 2) Mozilla security patches are not easy to find and isolate.
>
> Ben has disputed this, saying that we should be able to extract all
> necessary patches. Public ones from
> http://www.mozilla.org/projects/security/known-vulnerabilities.html then
> bugzilla, and embargoed ones via mdz.
Ben has now explained that this is in fact not sufficient.
--
- mdz
Reply to: