Date: Thu, 29 Oct 2009 16:08:31 -0500 From: Reed Loden <reed@...dloden.com> To: oss-security@...ts.openwall.com Subject: Re: MFSA 2009-63 On Thu, 29 Oct 2009 21:49:39 +0100 Florian Weimer <fw@...eb.enyo.de> wrote: > We've got a rather strict backported-security-fixes-only policy > because we've got a very interdependent code base, so we usually can't > switch upstream versions for libraries because most developers have a > rather lax attitude towards ABI compatibility (and even if they don't, > we're usually trailing behind a major version or two 8-/). Yeah, we really don't like taking full library upgrades on maintenance branches either (it makes our QA team very unhappy, for one thing). Our developers tried very hard to find the smallest fixes possible that could be backported to fix all the issues that were found, but it just wasn't really feasible in various cases due to a good number of the fixes being dependent on unrelated changes that had been done upstream since the last time we did a full library upgrade. We would have had to backport those changes, too, and even then, we weren't sure if we wouldn't be opening some other security holes because of something we missed in the backport. So, the decision was made to do full library upgrades for those libraries that we couldn't realistically backport fixes for. I know it sucks, but it's what happened. :( ~reed Mozilla Security Group -- Reed Loden - <reed@...dloden.com> Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.