4 ms·
I think the release managers usually unlock security bugs for a release once most of the population has been updated. So check back in a few days to a week.
by aboodman 15y ago
I think the release managers usually unlock security bugs for a release once most of the population has been updated. So check back in a few days to a week.
- simonbrown 15y agoThe blog posts mention that the bugs are only kept private until most people are up to date, but some never seem to be made public. For example: http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html http://googlechromereleases.blogspot.com/2011/01/chrome-stab... Some of the bugs (e.g. 66560) still give me a 403 (although some are accessible).
- aboodman 15y agoOf the 15 bugs there, 9 are open now. I'll poke someone more knowledgable and ask them to explain why the others have not been opened. I could imagine that it's that the process for unlocking them is manual and easy to forget, or it could be that other instances of those bugs were uncovered so it still isn't safe to open them.
- aboodman 15y agoaayra (who replied to great-grandparent) works on Chrome security team. It looks like all the bugs that are still closed are WebKit bugs (css, svg, etc), and we don't open them until the other WebKit clients are updated.
- aarya 15y ago66560 is a webkit issue. Webkit is an open source project. Webkit vulnerabilities are not disclosed until all the other consumers like Safari are updated.