Re: MFSA 2009-63

[Reed Loden <reed () reedloden com>]

On Thu, 29 Oct 2009 21:49:39 +0100
Florian Weimer <fw () deneb enyo de> wrote:

> We've got a rather strict backported-security-fixes-only policy
> because we've got a very interdependent code base, so we usually can't
> switch upstream versions for libraries because most developers have a
> rather lax attitude towards ABI compatibility (and even if they don't,
> we're usually trailing behind a major version or two 8-/).

Yeah, we really don't like taking full library upgrades on maintenance
branches either (it makes our QA team very unhappy, for one thing). Our
developers tried very hard to find the smallest fixes possible that
could be backported to fix all the issues that were found, but it just
wasn't really feasible in various cases due to a good number of the
fixes being dependent on unrelated changes that had been done upstream
since the last time we did a full library upgrade. We would have had to
backport those changes, too, and even then, we weren't sure if we
wouldn't be opening some other security holes because of something we
missed in the backport. So, the decision was made to do full library
upgrades for those libraries that we couldn't realistically backport
fixes for. I know it sucks, but it's what happened. :(

~reed
Mozilla Security Group

-- 
Reed Loden - <reed () reedloden com>

Attachment: _bin
Description: