Re:“Land initial Rust MP4 parser and unit tests”
by molsson on Thursday June 18, 2015 @03:58PM
(#9741243)
Is it possible to query the mozilla bugtracker to see how many security issues was fixed in the pre-rust MP4 parser before it was replaced?
[ Parent
| on HN ]
Re:“Land initial Rust MP4 parser and unit tests”
by cpeterso on Thursday June 18, 2015 @05:41PM
(#9741782)
Most security bugs are private. Even after the bug has been fixed, users running older versions of Firefox may still be affected so Mozilla doesn't want to expose too much information about how to exploit the bug. The fix, of course, is open source for everyone to examine.
Re:“Land initial Rust MP4 parser and unit tests”
by irishcoffee on Thursday June 18, 2015 @11:08PM
(#9742808)
Mozilla doesn't opensource their bug metadata?!
Ah its cool, they're rational actors who don't crucify people for private interests.
Re:“Land initial Rust MP4 parser and unit tests”
by bzbarsky on Thursday June 18, 2015 @11:58PM
(#9742942)
Mozilla security bugs do get opened up eventually. Specifically, once not only Mozilla but also various downstream distributors (linux distributions, etc) have shipped a fix for it. Release cycles there vary, so there is typically a gap of a month to a bit over a year (depending on whether the fix could be backported to the previous ESR) between the fix shipping in Firefox and the bug being fully disclosed.
That said, even after a security bug is open some information in it may remain hidden. For example, weaponized exploits attached to bugs are generally kept hidden even after the bug is opened.