Browser Security News

At the O’Reilly Open Source Convention in Portland, Ore., last week, I had the opportunity to sit down for a few minutes with Mozilla Corp.’s Mike Schroepfer to talk about Firefox development, security, updates to JavaScript, and cooperation with Linux vendors and other downstream providers of Firefox.

By adding an automatic update feature to Firefox, its developers have made huge progress towards ensuring that security updates are pushed out quickly to all users of the browser. However, the automatic update feature is useful only for users who get the browser directly from Mozilla; users who get Firefox packaged with their Linux distribution have to rely on their vendor to push out a release, and these often trail the official Mozilla release by up to a week.

It’s likely that there will always be some lag time between the official Firefox release and the update from Linux distributors, but Schroepfer says that the developers are doing what they can to narrow the gap.

In particular, Schroepfer says that they’re now publishing source tarballs "in lockstep" with release candidates to provide wider access for testing, and to make it easier for vendors to apply the changes. In the past, the source tarballs would trail the release candidates, tying the hands of package maintainers for projects like Debian, Ubuntu, and Fedora. NewsForge | The state of Firefox