[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 29 Oct 2009 16:08:31 -0500
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com
Subject: Re: MFSA 2009-63
On Thu, 29 Oct 2009 21:49:39 +0100
Florian Weimer <fw@...eb.enyo.de> wrote:
> We've got a rather strict backported-security-fixes-only policy
> because we've got a very interdependent code base, so we usually can't
> switch upstream versions for libraries because most developers have a
> rather lax attitude towards ABI compatibility (and even if they don't,
> we're usually trailing behind a major version or two 8-/).
Yeah, we really don't like taking full library upgrades on maintenance
branches either (it makes our QA team very unhappy, for one thing). Our
developers tried very hard to find the smallest fixes possible that
could be backported to fix all the issues that were found, but it just
wasn't really feasible in various cases due to a good number of the
fixes being dependent on unrelated changes that had been done upstream
since the last time we did a full library upgrade. We would have had to
backport those changes, too, and even then, we weren't sure if we
wouldn't be opening some other security holes because of something we
missed in the backport. So, the decision was made to do full library
upgrades for those libraries that we couldn't realistically backport
fixes for. I know it sucks, but it's what happened. :(
~reed
Mozilla Security Group
--
Reed Loden - <reed@...dloden.com>
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
