Re: Mozilla security bug policy

2004-03-25 Thread Brendan Eich
Ben Bucksch wrote: Daniel Veditz wrote: I don't think you've demonstrated problems with the policy but rather that we have to do a better job implementing it. I see. I guess we have differing viewpionts. Given that we ask for secrecy, I think that the policy should *ensure* for

Re: Mozilla security bug policy

2004-03-25 Thread Michael Lefevre
On 2004-03-24, Daniel Veditz [EMAIL PROTECTED] wrote: Ben Bucksch wrote: I forgot: * There are currently 36 fixed, hidden bugs. Some of them fixed a year ago. I will be updating the vulnerabilities page (and unhiding bugs) for the 1.7 release, I'll make sure to check the

Re: Mozilla security bug policy

2004-03-25 Thread Michael Lefevre
On 2004-03-25, Daniel Veditz [EMAIL PROTECTED] wrote: We will be including Firefox and Thunderbird information on the vulnerabilities page going forward and testing against them. Excellent. Thanks. -- Michael ___ Mozilla-security mailing list

Re: Mozilla security bug policy

2004-03-25 Thread Daniel Veditz
Ben Bucksch wrote: That's not fair. I wanted to issue warnings, but need the allowance of the security group, esp. its former owner, which I practically never got. I tried, IIRC, but ended up thinking that it's futile. Let's forget about the AOL-burdened past. I--and the Mozilla Foundation,

Re: Mozilla security bug policy

2004-03-25 Thread Ben Bucksch
Daniel Veditz wrote: Let's forget about the AOL-burdened past. I--and the Mozilla Foundation, I'm sure--want us to do the right thing now. Yes, I hoped so. That's exactly the reason why I posted this. Can we start over and give the existing policy (as written, not as executed) a try for a