News Firefox releases security patch

[Bj]

Update your Firefox people :thumbup:


http://news.bbc.co.uk/2/hi/technology/8580716.stm

"Mozilla is aware of the BergerCERT recommendation to avoid using Firefox 3.6, and encourage users to download... Firefox 3.6.2."

 

[Loru]

I've got "auto update" on so it's done already.

 

[Izack]

How is an open-source browser project releasing a patch newsworthy?

 

[Urwumpe]

How is an open-source browser project releasing a patch newsworthy?

Open-source is not different to closed source in significance or releases more small patches instead of few bigger ones. Open-source is only a difference in license, the differences in work are minimal. Instead of many responsible coders, you have few maintainers in open-source, who decide which code additions are becoming mainstream.

 

[fort]

And, but it's another subject, if you are behind the Great firewall, among many others solutions, an addon : Gladder.

https://addons.mozilla.org/en-US/firefox/addon/2864

 

[Izack]

Open-source is not different to closed source in significance or releases more small patches instead of few bigger ones. Open-source is only a difference in license, the differences in work are minimal. Instead of many responsible coders, you have few maintainers in open-source, who decide which code additions are becoming mainstream.

I didn't mean to place significance on the fact that it was open source. I just meant it's not exactly important news to know that Firefox released a patch. Like normal, the people who use it will find it, download it and get on with it. Maybe it will save some users from a security threat. Nothing new or significant there.

 

[Urwumpe]

Nothing new or significant there.

It is because it fixes a significant bug, that is worth being in the news.

 

[Izack]

It is because it fixes a significant bug, that is worth being in the news.

I digress it is an important patch, especially in light of Internet Explorer's recent failings, and thus should be posted on various software/computer-related boards, but the BBC?

 

[Urwumpe]

I digress it is an important patch, especially in light of Internet Explorer's recent failings, and thus should be posted on various software/computer-related boards, but the BBC?

If Toyota can't build a proper pedal into their cars, it is reason enough for being on the first page.

 

[Izack]

If Toyota can't build a proper pedal into their cars, it is reason enough for being on the first page.

You can't run a guy over with a web browser.

 

[Urwumpe]

You can't run a guy over with a web browser.

If you lost 50,000 € due to a phisher, being run over by a car doesn't hurt so much.

 

[Bj]

being run over by a car doesn't hurt so much.

and you have experienced this?


Anyway security is important, you always always always have to keep updated.

 

[Izack]

and you have experienced this?


Anyway security is important, you always always always have to keep updated.

I got squashed against a wall by the back of a van once. I've never been phished, though, so I can't give you an accurate comparison. :lol:

But yeah, I did grab the 3.6.2 patch as soon as it came out. I'm not arguing against the usefulness of security patches by any stretch.

 

[Orbinaut Pete]

I've just updated!

 

[MeDiCS]

Anyway security is important, you always always always have to keep updated.

It's interesting to note that it's not always true. There is an OSS OS, called OpenBSD which is advertised as the most secure OS today, and they distribute it with 'outdated' software (for example, Apache V1), but with their own set of patches. It's more like a fork actually, but it's interesting to note that a higher version number does not always guarantee a more secure app...

 

[Urwumpe]

It's interesting to note that it's not always true. There is an OSS OS, called OpenBSD which is advertised as the most secure OS today, and they distribute it with 'outdated' software (for example, Apache V1), but with their own set of patches. It's more like a fork actually, but it's interesting to note that a higher version number does not always guarantee a more secure app...

Yes, just like clock rate does not say anything about speed. But generally, there is a relation between version number and security.

 

[cjp]

I'm running Firefox 3.5.8 in Linux. Would that be a problem? Some websites say that only 3.6.x is affected.

It would be a real inconvenience to update to a 3.6 version, because in Ubuntu (and most other Linuxes), updating of software is done automatically by the update manager of the distribution, and the Ubuntu repositories still contain version 3.5.8. Updating manually could make the whole system very messy, with all sort of potential problems as a result.

---------- Post added at 07:59 PM ---------- Previous post was at 07:52 PM ----------

It's interesting to note that it's not always true. There is an OSS OS, called OpenBSD which is advertised as the most secure OS today, and they distribute it with 'outdated' software (for example, Apache V1), but with their own set of patches. It's more like a fork actually, but it's interesting to note that a higher version number does not always guarantee a more secure app...

If it turns out to be true what I asked in my previous post, then 3.5.8 is currently more secure than 3.6.0.

As long as security holes are still actively being fixed, it could be beneficial to have an older version. Newer versions tend to have newer features, so they have more 'new code' that has not yet been exposed to security experts for very long.

 

[Hielor]

It's interesting to note that it's not always true. There is an OSS OS, called OpenBSD which is advertised as the most secure OS today, and they distribute it with 'outdated' software (for example, Apache V1), but with their own set of patches. It's more like a fork actually, but it's interesting to note that a higher version number does not always guarantee a more secure app...

But they are patching the vulnerabilities in the original app, which is the point. Going up a version number, in addition to introducing fixes for the old bugs, also introduces new features which may contain other bugs. If you don't add new features and only fix old bugs, you'll obviously end up with a more secure system.