Hacker News new | ask | show | jobs
by mook 2561 days ago
Mozilla used to open up the security bugs after the fix is out for a while.

I say used to because I notice that the security issues fixed in Firefox 66.0 (released in March according to the release notes) still appear to be private. I suspect the internal people that cared about it have left, and their process is now broken. Somebody might read this thread and poke people to open access, but it would have to be done as an exceptional step (given that it hasn't been the first time I've noticed this happening).
1 comments
bzbarsky 2561 days ago
The same people who were in charge of opening up security bugs are still around and still in charge of it.

Security bugs are opened up once in-the-wild usage of affected versions is low enough, if I recall correctly. This usually takes a while after the fix is shipped. At no point were bugs opened up immediately after the Firefox release with the fix shipped. It's usually a year or so between the fix being shipped and the bug getting opened up, in my experience.

link
mook 2560 days ago
Ah, okay, thanks! My (very unreliable) memory thought it was sooner; that was why I picked 66 (released in March) rather than 67 (May).

The security issues in 60.0.2 (June 6 2018) is now public.

link