4 ms·

Is it possible to query the mozilla bugtracker to see how many security issues was fixed in the pre-rust MP4 parser before it was replaced?

• cpeterso 11y ago
  Most security bugs are private. Even after the bug has been fixed, users running older versions of Firefox may still be affected so Mozilla doesn't want to expose too much information about how to exploit the bug. The fix, of course, is open source for everyone to examine.
  • irishcoffee 11y ago
    Mozilla doesn't opensource their bug metadata?! Ah its cool, they're rational actors who don't crucify people for private interests.
    • bzbarsky 11y ago
      Mozilla security bugs do get opened up eventually. Specifically, once not only Mozilla but also various downstream distributors (linux distributions, etc) have shipped a fix for it. Release cycles there vary, so there is typically a gap of a month to a bit over a year (depending on whether the fix could be backported to the previous ESR) between the fix shipping in Firefox and the bug being fully disclosed. That said, even after a security bug is open some information in it may remain hidden. For example, weaponized exploits attached to bugs are generally kept hidden even after the bug is opened.
    • ossreality 11y ago
      GIVE IT A FUCKING BREAK. Jesus, find something that actually matters in ANY POSSIBLE WAY to whine about. Do you know how god damn pathetic it is to drag that bullshit into every single thread that relates to Rust or Mozilla. It makes you look pathetic and doesn't garner any sympathy or cause anyone to shed tears for poor ole Brendan. Just let it go for Christ's sake.