4 ms·

Bug Report 949446: “i can see all source code of all projects”

88 points by asaddhamani 12y ago

dredmorbius 12y ago
"I've seen everything!" http://fixyt.com/watch?v=IURfntimnlA http://fixyt.com/watch?v=IURfntimnlA
- fdej 12y ago
  "This video contains content from BBC Worldwide, who has blocked it in your country on copyright gounds." How worldwide.
  - dredmorbius 12y ago
    It's a Patrick Stewart sketch, not sure from exactly what. Quite humorous though.
Ronsenshi 12y ago
Even though it is quite funny and a little cringy to know that some people don't know what Open Source is - it is not a new ticket - been posted in December 2013.
merrua 12y ago
Newbie questions are good. Let there always be a lot of them.
- cm2187 12y ago
  Well, my turn for a newbie question. Surely they don't share 0day vulnerability fixes until after they are released? So they don't really share everything?
  - lucb1e 12y ago
    I don't know, but I would find it extremely weird if they announced how to hack Firefox (or any other product) before widely releasing a fix. From that fix you can often find the vulnerability (the changed code is visible) to keeping it a secret afterwards is pointless, but beforehand I don't see any good reason to publish it.
  - nnethercote 12y ago
    There is a "security sensitive" flag that can be set on a bug, and then only certain privileged users can see it. Such a bug will be made publicly visible once it is fixed and the fix makes it into a released version of Firefox and a certain amount of time passes. Full details here: https://www.mozilla.org/en-US/about/governance/policies/security-group/bugs/ https://www.mozilla.org/en-US/about/governance/policies/secu...
rplnt 12y ago
Of course the only stupid comment is less than two hours old now that it's at top of /r/linux (over at reddit).
WestCoastJustin 12y ago
They have a wide open wiki too, lots of interesting bits in there, check it out https://wiki.mozilla.org/ https://wiki.mozilla.org/. Some highlights -- Release Engineering [1], Meeting Minutes [2], Security [3], Reference Platforms [4], etc. Want to check out their puppet configuration management code base, well you can do that too [5]. Personally, I love how large organizations open up their configuration management code, as it serves as a nice example to learn from, Wikimedia does the same thing [6]. I have spent hours looking through these repos to see how they implement various puppet features. [1] https://wiki.mozilla.org/ReleaseEngineering https://wiki.mozilla.org/ReleaseEngineering [2] https://wiki.mozilla.org/Community_Calendar https://wiki.mozilla.org/Community_Calendar [3] https://wiki.mozilla.org/Security/ https://wiki.mozilla.org/Security/ [4] https://wiki.mozilla.org/ReferencePlatforms https://wiki.mozilla.org/ReferencePlatforms [5] http://hg.mozilla.org/build/puppet http://hg.mozilla.org/build/puppet [6] https://gerrit.wikimedia.org/r/#/q/status%3Aopen+project%3Aoperations/puppet,n,z https://gerrit.wikimedia.org/r/#/q/status%3Aopen+project%3Ao...
scotty79 12y ago
I hope in a decade or so, someone will come to Microsoft forums and informs that the source code of windows doesn't seem to be visible on their github account and asks if they could fix this.
- necrodawg 12y ago
  I think it's more likely that Windows source code will be available on GitHub in 10 years.
  - vog 12y ago
    Maybe they'll release old sources for historical / nostalgic reasons - the same reasons for id Software to open source Doom and other classic games.
    - lucb1e 12y ago
      They did with MS-DOS. I don't understand why not most old software (OSes, programs, games) aren't commonly made open source though, it's not as if anyone is making money with Windows 95 these days.
      - TylerH 12y ago
        I gave the same argument, and was met with things like "because unfettered access to old OS source code might reveal new vulnerabilities in our later OS source code." To which I responded "good, then you can fix them and have better source code"
      - Excavator 12y ago
        Most cited reason I've seen is the patents/copyright mess. Just look at how System Shock 2 is handled for example. Patches being anonymously contributed by a group/person that is said to have access to the source. There's also the situation with the lost source code. For example, as I've understood it, the only reason the Dark Engine source code became available were due to someone finding it in an old Dreamcast SDK.
raverbashing 12y ago
I love those "White Knight" bug reporters, on par with the "Think of the children" crowd Maybe you should think for 2 seconds before opening a bug report? Too hard?
_lce0 12y ago
actually not "all" projects .. where's the DRM thingy source code? that's something I'd like to see
- Excavator 12y ago
  You mean EME? http://mxr.mozilla.org/mozilla-central/search?string=MOZ_EME http://mxr.mozilla.org/mozilla-central/search?string=MOZ_EME
  - _lce0 12y ago
    well, that's just Mozilla's response to the closed-source DRM mandatory regulation.. not the DRM thingy per-se In Cory Doctorow words... > Mozilla says it isn’t providing DRM; it’s providing a fully open utility that automatically fetches and installs DRM from Adobe’s servers. I am unconvinced that there is a meaningful distinction between “installing DRM” and “installing code that installs DRM”. By using this technique they provide DRM capabilities, without an actual implementation, or worst including blobs; but that doesn't mean that firefox does not have that "thingy" inside.. it's not there at compile-time. http://www.theguardian.com/technology/2014/may/14/firefox-closed-source-drm-video-browser-cory-doctorow http://www.theguardian.com/technology/2014/may/14/firefox-cl...

88 points by asaddhamani 12y ago

dredmorbius 12y ago

"I've seen everything!" http://fixyt.com/watch?v=IURfntimnlA http://fixyt.com/watch?v=IURfntimnlA

fdej 12y ago
"This video contains content from BBC Worldwide, who has blocked it in your country on copyright gounds." How worldwide.
- dredmorbius 12y ago
  It's a Patrick Stewart sketch, not sure from exactly what. Quite humorous though.

Ronsenshi 12y ago

Even though it is quite funny and a little cringy to know that some people don't know what Open Source is - it is not a new ticket - been posted in December 2013.

merrua 12y ago

Newbie questions are good. Let there always be a lot of them.

cm2187 12y ago
Well, my turn for a newbie question. Surely they don't share 0day vulnerability fixes until after they are released? So they don't really share everything?
- lucb1e 12y ago
  I don't know, but I would find it extremely weird if they announced how to hack Firefox (or any other product) before widely releasing a fix. From that fix you can often find the vulnerability (the changed code is visible) to keeping it a secret afterwards is pointless, but beforehand I don't see any good reason to publish it.
- nnethercote 12y ago
  There is a "security sensitive" flag that can be set on a bug, and then only certain privileged users can see it. Such a bug will be made publicly visible once it is fixed and the fix makes it into a released version of Firefox and a certain amount of time passes. Full details here: https://www.mozilla.org/en-US/about/governance/policies/security-group/bugs/ https://www.mozilla.org/en-US/about/governance/policies/secu...

rplnt 12y ago

Of course the only stupid comment is less than two hours old now that it's at top of /r/linux (over at reddit).

WestCoastJustin 12y ago

They have a wide open wiki too, lots of interesting bits in there, check it out https://wiki.mozilla.org/ https://wiki.mozilla.org/. Some highlights -- Release Engineering [1], Meeting Minutes [2], Security [3], Reference Platforms [4], etc. Want to check out their puppet configuration management code base, well you can do that too [5]. Personally, I love how large organizations open up their configuration management code, as it serves as a nice example to learn from, Wikimedia does the same thing [6]. I have spent hours looking through these repos to see how they implement various puppet features. [1] https://wiki.mozilla.org/ReleaseEngineering https://wiki.mozilla.org/ReleaseEngineering [2] https://wiki.mozilla.org/Community_Calendar https://wiki.mozilla.org/Community_Calendar [3] https://wiki.mozilla.org/Security/ https://wiki.mozilla.org/Security/ [4] https://wiki.mozilla.org/ReferencePlatforms https://wiki.mozilla.org/ReferencePlatforms [5] http://hg.mozilla.org/build/puppet http://hg.mozilla.org/build/puppet [6] https://gerrit.wikimedia.org/r/#/q/status%3Aopen+project%3Aoperations/puppet,n,z https://gerrit.wikimedia.org/r/#/q/status%3Aopen+project%3Ao...

scotty79 12y ago

I hope in a decade or so, someone will come to Microsoft forums and informs that the source code of windows doesn't seem to be visible on their github account and asks if they could fix this.

necrodawg 12y ago
I think it's more likely that Windows source code will be available on GitHub in 10 years.
- vog 12y ago
  Maybe they'll release old sources for historical / nostalgic reasons - the same reasons for id Software to open source Doom and other classic games.
  - lucb1e 12y ago
    They did with MS-DOS. I don't understand why not most old software (OSes, programs, games) aren't commonly made open source though, it's not as if anyone is making money with Windows 95 these days.
    - TylerH 12y ago
      I gave the same argument, and was met with things like "because unfettered access to old OS source code might reveal new vulnerabilities in our later OS source code." To which I responded "good, then you can fix them and have better source code"
    - Excavator 12y ago
      Most cited reason I've seen is the patents/copyright mess. Just look at how System Shock 2 is handled for example. Patches being anonymously contributed by a group/person that is said to have access to the source. There's also the situation with the lost source code. For example, as I've understood it, the only reason the Dark Engine source code became available were due to someone finding it in an old Dreamcast SDK.

raverbashing 12y ago

I love those "White Knight" bug reporters, on par with the "Think of the children" crowd Maybe you should think for 2 seconds before opening a bug report? Too hard?

_lce0 12y ago

actually not "all" projects .. where's the DRM thingy source code? that's something I'd like to see

Excavator 12y ago
You mean EME? http://mxr.mozilla.org/mozilla-central/search?string=MOZ_EME http://mxr.mozilla.org/mozilla-central/search?string=MOZ_EME
- _lce0 12y ago
  well, that's just Mozilla's response to the closed-source DRM mandatory regulation.. not the DRM thingy per-se In Cory Doctorow words... > Mozilla says it isn’t providing DRM; it’s providing a fully open utility that automatically fetches and installs DRM from Adobe’s servers. I am unconvinced that there is a meaningful distinction between “installing DRM” and “installing code that installs DRM”. By using this technique they provide DRM capabilities, without an actual implementation, or worst including blobs; but that doesn't mean that firefox does not have that "thingy" inside.. it's not there at compile-time. http://www.theguardian.com/technology/2014/may/14/firefox-closed-source-drm-video-browser-cory-doctorow http://www.theguardian.com/technology/2014/may/14/firefox-cl...