3 ms·

Mozilla keeps critical security bugs closed to a small-ish group of developers and testers until they are patched. Soon after a patched version of Firefox has b

• nwah1 11y ago
  With few enough eyes, all bugs are hidden.
  • geofft 11y ago
    Linus's law applies (if it's even true, which there's insufficient empirical evidence for) to code, not bug trackers. The kernel's reporting process for security bugs involves sending an email to security@kernel.org, a closed list with secret membership. It may also involve sending an email to the linux-distros@openwall mailing list, which is also closed but has public membership (and is run by a third party). If either of these groups has a bug tracker at all, they haven't told anyone else. And unlike Mozilla's policy, at no point is the history of discussions on either security@kernel.org or linux-distros@openwall ever opened up to the public. Fixes can, and are often intended to, show up in the kernel changelog without any mention of what security issue they fixed.