Forgot your password?
typodupeerror
Mozilla The Internet Security

Opera Screeches at Mozilla Over Security Disclosure 208

Posted by ScuttleMonkey
from the did-too-did-too dept.
The Register is reporting that Mozilla's handling of a recent security exploit that affected both browsers has drawn an unhappy response from the Opera team. "Claudio Santambrogio, an Opera desktop developer, said the Mozilla team notified it of a security issue only a day before publishing an advisory. This gave the Norwegian software developers insufficient time to make an evaluation. [...] Santambrogio goes on to attack Mozilla's handling of the issue, arguing that it places Opera users at unnecessary risk."
This discussion has been archived. No new comments can be posted.

Opera Screeches at Mozilla Over Security Disclosure

Comments Filter:
  • by neonmonk (467567) on Monday February 18, 2008 @06:35PM (#22468448)
    At least Mozilla told them of the issue. I personally don't think it's their ultimate responsibility. Definitely obligated to do something... but imagine the kind of action Opera would have if Microsoft found the security flaw.
    • by allcar (1111567) on Monday February 18, 2008 @06:39PM (#22468502)
      I agree that they probably fulfilled their minimum obligation, but it would be great to see a much higher degree of co-operation between the vendors of minority browsers. By all means attack MS in this way, but play nice amongst the good guys.
      • by moderatorrater (1095745) on Monday February 18, 2008 @06:59PM (#22468698)
        I don't see it as an attack. It sounds like Opera didn't respond to Mozilla's notification at all. In addition, it's not Mozilla's obligation to make sure that Opera's secure, and it is their obligation to be open with the community to the extent that they can be while still being secure. Sometimes waiting to disclose can bite you in the end like it did with php a few months back. Add to that the bullshit excuse that you can't evaluate a security risk in one day and I think that Opera's just lashing out because they're embarrassed that they have a security flaw.
        • by Anonymous Coward on Monday February 18, 2008 @07:40PM (#22469086)
          > it's not Mozilla's obligation to make sure that Opera's secure

          True, but surely Mozilla has a moral obligation to ensure that other browsers (and ultimately, users) have as much time as possible to prepare for when the exploit becomes public domain?
          • by SETIGuy (33768) on Monday February 18, 2008 @09:49PM (#22470246) Homepage

            > it's not Mozilla's obligation to make sure that Opera's secure

            True, but surely Mozilla has a moral obligation to ensure that other browsers (and ultimately, users) have as much time as possible to prepare for when the exploit becomes public domain?
            That obligation is trumped by Mozilla's moral obligation to make sure that people who use Mozilla are not vulnerable to an exploit.
            • Re: (Score:3, Insightful)

              by aussie_a (778472)
              So you think Mozilla told Opera within 24 hours of finding out themselves? If not, then how is Mozilla's users made vulnerable by telling Opera earlier?
            • by Half-pint HAL (718102) on Tuesday February 19, 2008 @06:47AM (#22473032)

              That obligation is trumped by Mozilla's moral obligation to make sure that people who use Mozilla are not vulnerable to an exploit.

              No one is suggesting that Mozilla should have delayed the fix (in order to hold back disclosure).

              No, it would have been open and responsible and good if someone at Mozilla had thought to send an email to the Opera dev team a week or two ago saying:

              Roses are red, violets are blue
              We're fixing this exploit and think you should too.
              Lots of Love,
              Your secret big red monster Valentine.

              No need to coordinate releases, but given that it took them a while to patch it, they should assume it'll take Opera a wee while to, and in the meantime they're leaving members of the public open to exploit.

              Members of the public that used to use Firefox, but had to stop because Mozilla never fixed the memory leak and these users were using old machines (NT4, 32 meg RAM) and Open Source was supposed to mean never being obsolete, but it was only the non-open, free Opera browser that offered me a fully-patched, fully working browser.

              HAL.

            • Re: (Score:2, Insightful)

              by olehenning (1090423)
              I don't see how that obligation stands in the way of responsible disclosure. How would it take Mozilla any longer to fix the problem if they tell Opera about it in good time? Don't get me wrong. I'm not saying that Mozilla has done something extremely wrong here. I'm just saying they could have done it better, followed responsible disclosure properly and given Opera developers time to fix it before they went for full disclosure.
            • Re: (Score:2, Flamebait)

              by AmiMoJo (196126)

              That obligation is trumped by Mozilla's moral obligation to make sure that people who use Mozilla are not vulnerable to an exploit.


              That's what it boils down to. Mozilla had a simple choice: fix the vulnerability and publish (since FF is open source), or leave it unpatched until Opera fix it too (i.e. indefinitely). If Opera can't keep up, too bad, because they can't expect FF to remain vulnerable while they get their act together.
        • by bigdavesmith (928732) on Monday February 18, 2008 @08:08PM (#22469332)
          Agreed, and I think it's a very poor way to handle the situation, from Opera's side. If I were Mozilla, and got this kind of junk after reporting the bug to them, next time around I wouldn't even bother. Someone at Opera owes someone at Mozilla an apology.
      • by pthisis (27352) on Monday February 18, 2008 @07:08PM (#22468792) Homepage Journal
        I agree that they probably fulfilled their minimum obligation, but it would be great to see a much higher degree of co-operation between the vendors of minority browsers. By all means attack MS in this way, but play nice amongst the good guys.

        Full public disclosure of security bugs is generally considered the best way to get rapid fixes, and was the entire reason that places like BugTraq were founded. Following standard protocol is not an "attack". Vendors like to assume that you're just maliciously publishing things that would be no problem for their users until you did so. That's untrue.

        Many bugs are well-known by black hats before they are found by the good guys. The safest thing for users is to assume that all severe bugs are well-known by the bad guys; when you disclose publically, you give the users a chance to protect themselves even if the software is not yet fixed. I'm not sure of the details of this exploit, but they may be able to protect themselves by limiting their surfing to well-known trusted sites, using an alternate browser, or turning off javascript or whatever. In other cases, some sort of external wrapper or proxy, tighter firewall rules, limiting access to DMZs, or other external steps can help prevent big security problems even without a full vendor fix available yet. It may even be worth it to some users just to forgo using an application for a few days until it's fixed.

        Keeping silent until the vendor fixes things might just hurt the user's security situation, and certainly doesn't give the user the option of evaluating the risk and determining whether it's worth ignoring it or not--it forces them to make their usage decision without good information.
        • by kesuki (321456)
          The single best thing you can do for web exploits is to get a list based firewall, such as Peerguardian, iplist.sourceforge.net , or moblock the latter 2 are linux based, peer guardian 1 was released for mac os, and peer guardian 2 is for windows still, so no matter what os you use, there is a peer guardian application, if you just want the 'web exploit' sites blocked they have a separate list for that, i realize they were started as a 'blacklist' against people making p2p applications not work (seeding bad
      • Re: (Score:3, Insightful)

        by saltydog56 (1135213)
        Attack? How did any of the Mozilla devs attack Opera - from what I can see no public mention was ever made about Opera having the same issue.

        Further, why would you encourage others to "attack MS in this way?" - that is stupid and unprofessional. I am a committed Linux user, in my free time I build and test each kernel snapshot as it is released. Why, because I love to get into the guts of the system.

        Am I a Windows lover? Not really, but I do bring up an XP image from time to time as a guest on my Linux s
      • By all means attack MS in this way, but play nice amongst the good guys.

        Mozilla have historically played nice with everybody, including Microsoft [informationweek.com].

        Opera Software found and patched what it's calling a "highly severe" bug in its flagship browser, using a security tool released by its competitor, Mozilla.

        Mozilla worked with Microsoft, Apple, and Opera before making the JavaScript fuzzer widely available in order to reduce the possibility that the tool might be used to expose vulnerabilities in those browsers.

        Strangely enough, the actual advisory [mozilla.org] by Mozilla which was linked to by Opera's Claudio Santambrogio in his complaint doesn't mention Opera at all. Given Mozilla's history of cooperation with other browser teams, you'd have to guess any failure in early notification was through oversight rather than intention.

      • Re: (Score:3, Insightful)

        by Ilgaz (86384) *

        I agree that they probably fulfilled their minimum obligation, but it would be great to see a much higher degree of co-operation between the vendors of minority browsers. By all means attack MS in this way, but play nice amongst the good guys.

        There are very advanced developers at Opera too, remember these guys manage to code a 90 KB J2ME single binary which may work in hundreds of millions of mobile phones (Opera Mini) or a browser small enough to run on various kinds of Symbian smart phones.

        Also these guys are browser developers, same job...

        I am near sure they see some potential issues on Mozilla source sometimes and silently inform them about them. If this happened, I can understand their frustration about a hit from "nice guys".

        Of course, t

    • by RonnyJ (651856)
      The best thing to do here would be to compare how both Opera and Mozilla notify each other about exploits they find in other browsers.
  • First... (Score:5, Funny)

    by hsdpa (1049926) * on Monday February 18, 2008 @06:35PM (#22468452)
    to fix the exploit wins!
  • by Enuratique (993250) on Monday February 18, 2008 @06:36PM (#22468464)
    Listen, would you rather they give you no advanced warning? Like chivalry, professional courtesy is all but dead these days. What are they supposed to do? Wait until you get your ass in gear to address the issue? Perhaps letting the weakness be known might actually give you the incentive to make it a top priority bug fix - which is good for everyone.
    • Re: (Score:3, Funny)

      s/bitch/advertise/
  • Sheesh... (Score:3, Interesting)

    by TripMaster Monkey (862126) on Monday February 18, 2008 @06:36PM (#22468470)
    From TFA:

    Claudio Santambrogio, an Opera desktop developer, said the Mozilla team notified it of a security issue only a day before publishing an advisory. This gave the Norwegian software developers insufficient time to make an evaluation. "They did not wait for us to come back with an ETA for a fix: they kept their bug reports containing the details of the exploits closed to the public for a few days, and now opened most of them to everybody," Santambrogio writes.

    I'm finding it a bit difficult to feel bad for Opera. Exactly how long does it take to "evaluate" a security issue, especially when someone else goes to the trouble of finding it in the first place, and then notifies you of the issue?

    Opera had ample opportunity to roll out a fix...but they dragged their feet (as is their habit). This time, their habit got them burned. Perhaps next time they'll take a notification of a security issue more seriously.
    • Re:Sheesh... (Score:5, Informative)

      by xactoguy (555443) on Monday February 18, 2008 @06:47PM (#22468580)
      From the Opera developers' description [opera.com] it appears that the Mozilla foundation could have handled things more professionally - Opera was only notified the day before a public advisory was published, and since that time the Mozilla foundation have opened most of the bug reports containing exploitation details to the general public. Judging from the emoticons on Opera's blog, the latter action by the Mozilla foundation is the primary issue here, not that they published the advisory.
      • Re:Sheesh... (Score:5, Insightful)

        by drinkypoo (153816) <martin.espinoza@gmail.com> on Monday February 18, 2008 @06:53PM (#22468620) Homepage Journal

        Opera was only notified the day before a public advisory was published, and since that time the Mozilla foundation have opened most of the bug reports containing exploitation details to the general public. Judging from the emoticons on Opera's blog, the latter action by the Mozilla foundation is the primary issue here, not that they published the advisory.

        I think we all know already that disclosing the exploit is what brings the motivation to fix the hole.

        The fact that they hid the bug reports at all should be enough to make the Opera kids grateful. After all, the Mozilla foundation operates in a pretty open and transparent fashion. The most honest (and destructive) way to go would be to never hide the bug reports.

        But just to cover that old ground once again; when code changes, diffs happen automatically, and people know just precisely what changed. You can be sure that some of those people are malicious hackers looking for new ways to screw us all; there's good money in it. So by hiding the details of the exploit, you make sure that only the more skillful and malicious hackers have the exploit. Does that sound like a good idea to you?

        • Re:Sheesh... (Score:5, Insightful)

          by NMagic (982573) on Monday February 18, 2008 @07:03PM (#22468750)
          You know, looking at Mozilla's release, they didn't seem to mention anything to anybody about Opera having a problem too. Looks more like Opera screwed themselves.
        • by xenocide2 (231786)
          Mozilla takes security seriously, so, like many other systems, allows people to mark things as security vuln's, so that intelligent disclosure techniques can be applied. They will publish things in due time, and maybe not on a schedule that Opera deems acceptable. But never hiding bugs is silly. For example, if you provide an strace of ssh crashing, you'd want to mark that private at least.
          • Re:Sheesh... (Score:5, Insightful)

            by pthisis (27352) on Monday February 18, 2008 @07:17PM (#22468872) Homepage Journal
            But never hiding bugs is silly. For example, if you provide an strace of ssh crashing, you'd want to mark that private at least.

            Maybe, maybe not. You never know what the black hats already know; as a _user_ of ssh, if you disclose then I can take steps to limit damage--e.g. if I'm allowing full ssh access from outside my network (so that employees can work on the go), I may decide that the small benefit of doing so doesn't merit the risk. I'd rather turn off external ssh access for a few days until there's a fix.

            When you hide the bug, you're hiding the ability for the users to take steps to protect themselves. You're forcing me to run with exposed systems for several days, and hoping that nobody "bad" knows about the bug. And you're making that judgement for your users rather than giving them the ability to make that call themselves; that's almost impossible given that the judgement might hinge heavily on whether I'm a large financial institute or a personal blog site that backs up daily. Just guessing that most users are happy with your security through obscurity is bound to be wrong in some cases, and those cases are likely to be some of the more financially significant ones.

            (That's on top of the pressure to issue a real fix that full disclosure brings. Before things like BugTraq, it was common for people to sit on severe security bugs for literally _years_.)
            • Re: (Score:3, Insightful)

              by Jugalator (259273)

              When you hide the bug, you're hiding the ability for the users to take steps to protect themselves.
              Yes, it's definitely a case of finding an equilibrium when being curteous in giving software developers around the world affected by the same vulnerability a reasonable time to adapt.
        • Re: (Score:3, Insightful)

          by Jeff DeMaagd (2015)
          But allowing only one day is excessive. Can you track down and fix security problems in your software within one day of notification?

          I think we all know already that disclosing the exploit is what brings the motivation to fix the hole.

          You haven't given a specific example of Opera needlessly hiding an exploit.
          • Re:Sheesh... (Score:5, Interesting)

            by drinkypoo (153816) <martin.espinoza@gmail.com> on Monday February 18, 2008 @07:24PM (#22468950) Homepage Journal

            But allowing only one day is excessive. Can you track down and fix security problems in your software within one day of notification?

            Now, wait a second. If I am developing software package "A", and you develop competing package "B", and I find a hole in A and fix it, then just for laughs test to see if your product has the same hole and then I am kind enough to let you know that it does, then I announce that there is a hole in A, how am I responsible for the security of B at all? I've done you a favor by performing the test and giving you a heads up in the first place! I don't owe you anything.

            I think we all know already that disclosing the exploit is what brings the motivation to fix the hole.
            You haven't given a specific example of Opera needlessly hiding an exploit.

            I'm not sure what you think that has to do with anything. The Mozilla foundation didn't even announce to the public that there was a hole in Opera. The announcement is that there is a hole in Firefox. Why not try reading the advisory [mozilla.org]? There is NOTHING in there about Opera's susceptibility. You can't even view the bug report [mozilla.org] without a Mozilla bugzilla account with the proper access - I just logged into my account, and that doesn't include me, so it's not like even the report is generally available. Also, as per the advisory:

            These bugs are variations on earlier problems reported by Charles McAuley and Michal Zalewski which were fixed in Firefox 2.0.0.4, as well as an issue reported by hong which was fixed in Firefox 2.0.0.8.

            So it seems as though the Opera team has had some warning about problems similar to these in the past - along with the rest of the world.

            Could I find and fix a bug in one of my pieces of software in a day? Probably, because all of them are very simple. If I had a development team and a security response team (they do have one of those, don't they?) then I bet "I" could find and fix known security problems in larger software products in a day, too.

            Actually, a number of security holes in the Linux kernel have been found, announced, and fixed on the same day, now that I think of it.

            • by Jugalator (259273)

              I've done you a favor by performing the test and giving you a heads up in the first place! I don't owe you anything.
              Opera was never claiming Mozilla was bound by law and did anything wrong per se; they just wished to have seen it handled a bit differently because apparently it usually is in this business, even for being Mozilla.
            • You can't even view the bug report without a Mozilla bugzilla account with the proper access - I just logged into my account, and that doesn't include me, so it's not like even the report is generally available
              Just because it's locked now doesn't mean it always has been. Perhaps it was locked again after the Opera complaint?
              • Re: (Score:3, Informative)

                by BZ (40346)
                I just checked, for what it's worth. This bug has never had the security flag removed.
            • by joebp (528430)

              I don't owe you anything.
              "Responsible disclosure."

              Mozilla would've been better off keeping their mouths shut. As it is, they've irresponsibly disclosed a vulnerability in a competitor's product.
        • by Jugalator (259273)

          So by hiding the details of the exploit, you make sure that only the more skillful and malicious hackers have the exploit. Does that sound like a good idea to you?
          No, of course the details should be revealed in time. This is just a discussion of how long said time should be out of courtesy.
      • Re:Sheesh... (Score:5, Insightful)

        by moderatorrater (1095745) on Monday February 18, 2008 @07:09PM (#22468816)
        Unless for some reason they use the same engines, what's the problem with this practice? Opera's security isn't Firefox's responsibility. The fact that they notified opera at all went above and beyond what they needed to do, and asking firefox to be less open with their community is asking them to risk their image for the sake of opera and its users. Unless I'm missing something here, Firefox was being polite and Opera's throwing a world class hissy fit.
    • What I'm hoping is that a helpful Slashdot reader who actually patches security holes in widely-used software on the clock can opine as to the practicality of having a one day turnaround. Otherwise, the rest of us are just guessing about what is and isn't reasonable.

      So, is having one day to evaluate and fix a security hole reasonable? And also, is having the source code open and available to others advantageous at all in meeting so short of a deadline?
      • by Allador (537449) on Monday February 18, 2008 @07:32PM (#22469012)
        The problem usually isnt coding time. It's organizational response and resource allocation issues.

        For example, Opera is on a very differen timezone from the US, so initial publication may happen overnight from the POV of the Opera staff.

        So then a day starts. When people start their day, they have a pile of things to respond to. The incoming messsages have to be triaged. Someone has to make a decision that this is important enough to escalate or take action on.

        Then you have to find people with the capability to test whether its a real problem. This may take a couple hours. People go on vacation, get sick, etc.

        Then you have to take the time to do the research, test whether this is a real problem, what versions it affects, etc. This takes a couple hours.

        Then yuou have to stop a coder from working on something else, bring them up to speed on the problem (if its not the same person doing the testing), and get them started on the fix.

        Then even with a fix you have to do regression tests. Not sure about Opera, but many mature apps have full test suites that can take a couple hours.

        Then you have to write release notes, update the web page, do a new deploy package, and update your update servers to notify Opera that there is a new update.

        As you can see, very little of the time here is coding.

        Many large orgs have taken steps to create a 'short path of decision making' to streamline this process, always have one coder on call who can do this work, etc. But even then if anything is out of whack or the wrong person is sick or on vacation or on another urgent item, a whole day could pass without response.
        • Re: (Score:3, Insightful)

          by PlusFiveTroll (754249)
          Yep, it sucks to be big. If the person that found the exploit logs on to IRC and posts it, instead of mailing the authors of the code, how much time do you think they have before a new trojan or malicious attack websites are setup. I'd make a guess it's under an hour. As the application developer you have to take what you're given. Your enemy is not going to give you any quarter. They are not going to wait around for you to patch your apps and distribute them. The ball is in the blackhats hand, all you can
        • by SnowZero (92219)

          The problem usually isnt coding time. It's organizational response and resource allocation issues.

          Opera should probably use this as an opportunity to review those practices.

          For example, Opera is on a very differen timezone from the US, so initial publication may happen overnight from the POV of the Opera staff. So then a day starts. When people start their day, they have a pile of things to respond to. The incoming messsages have to be triaged. Someone has to make a decision that this is important enough to escalate or take action on.

          Opera has a lot of paying corporate customers and can afford to do better; Their customers also deserve as much. After all, what happens if a 0-day comes out in the US? "I was asleep" is not an excuse for supported software. Where I work, others would not hesitate to call me at 2am if something really needs to be fixed, and that's something I accept as part of my job. For Opera, this could be as simple as hiring a few people ar

  • by moderatorrater (1095745) on Monday February 18, 2008 @06:38PM (#22468492)
    As far as I can tell, Firefox had a flaw, they fixed it and notified Opera that they had the same flaw the day before Firefox's fix was announced. Sounds to me like the only thing that Firefox did wrong was notice that it affected Opera at all, because if they hadn't Opera would have been left with egg on their face and nothing to bitch about.
    • by Jester998 (156179) on Monday February 18, 2008 @06:43PM (#22468546) Homepage
      Clearly, the Mozilla team should be performing full regression testing on every bug they fix against every browser known to man. What if the bug affects NCSA Mosaic?

      Hmm, there's something wrong with my sarcasmeter, it seems to be off the scale...
      • Re: (Score:3, Funny)

        (Sorry, I couldn't resist) His sarcasmeter- it's OVER 9000!!!!!!!!!
      • by Otter (3800) on Monday February 18, 2008 @06:59PM (#22468702) Journal
        Clearly, the Mozilla team should be performing full regression testing on every bug they fix against every browser known to man.

        I think the point is that they *did* know that this particular vulnerability affected Opera and took their time about telling them.

        It still doesn't seem like a huge deal, but on the other hand if you read what the Opera guy actually wrote, it also doesn't seem like a huge deal. "Screeches" seems a bit excessive.

        • by BeeBeard (999187)

          It still doesn't seem like a huge deal, but on the other hand if you read what the Opera guy actually wrote, it also doesn't seem like a huge deal. "Screeches" seems a bit excessive.

          Agreed, but if minor quibbles between software groups weren't overplayed and sensationalized, then what exactly would we be reading on Slashdot? Plus, you must be new here, because what business do you have reading the article anyway? You're supposed to just read the inaccurate summary and then "wing it."

          Anyways, here, the use of the word "screeches" is not descriptive of the communication that took place, it just means that somebody needs to have their Roget's confiscated. I'm inclined not to think that S

      • Re: (Score:3, Funny)

        by Sentry21 (8183)
        Oh, a sarcasm detector. That's useful.
  • overreaction (Score:2, Insightful)

    by kongit (758125)
    While I do not know all of the details behind this I suspect that Mozilla did not have to notify Opera of any bug, in other words they did it as a heads up but were not obligated, I could be wrong though. The article is rather short and does not explain anything. For all I know Mozilla gave Opera the info as soon as they knew it, I highly doubt this, but just from the article it is hard to tell. While Mozilla could have waited, I would bet that people with malevolent intent are not overly concerned with
    • Re:overreaction (Score:5, Interesting)

      by Fweeky (41046) on Monday February 18, 2008 @06:56PM (#22468674) Homepage
      I don't see how expressing dipleasure at something on a blog is an overreaction. "Screeching" is stretching it pretty fucking far, since it's basically saying what happened. Where in the blog entry is there screeching, perhaps the bold on "responsible", or maybe the ":("? Wouldn't it be better to link to the blog entry directly and not some dumb opinionated elreg article? Really, did you even read the original source before deciding "the developer needs a chill pill"?

      At the end of the day, Mozilla would have acted better by keeping the exploits closed for a few more days, as they would hope anyone else would do for them. By not doing so, they upset people, and others expressing that upset is perfectly understandable. There's no mass outcry at Opera, no press release or open letter saying the Mozilla team are dicks, there's a few words saying what happened and a couple of emoticons on a developer blog entry.
  • See this? (Score:4, Funny)

    by imipak (254310) on Monday February 18, 2008 @06:40PM (#22468520) Journal
    >>>>> . It's the world's smallest violin...
  • by rsw (70577) on Monday February 18, 2008 @06:44PM (#22468550) Homepage
    Let's imagine that the Mozilla developers had modified the release notes for 2.0.0.12 so that it wasn't obvious what they'd fixed. Would that have been any better? Of course not. I can grab the code, diff against 2.0.0.11, take note of the changes, and presumably figure out why they were made. Now I can craft a working exploit against 2.0.0.11. After testing it on Firefox, what's the first thing I might try? How about... see if other browsers have the same problem?

    So keeping in the fix but not mentioning it in the release notes is out. What, then... not patch the flaw? Yeah. Right.

    Opera might be a nifty browser, but apparently its authors are whiny bitches.

    -=rsw
    • by Otter (3800)
      the alternative being...?

      The alternative being to inform Opera as soon as they realized it was affected, not at the last minute before public disclosure. (Presuming they didn't first test in in Opera right before public disclosure, which might have been the case.)

  • Apologies! (Score:4, Funny)

    by Jester998 (156179) on Monday February 18, 2008 @06:47PM (#22468574) Homepage
    As a Firefox user, I'd like to apologize to Opera users (both of you) for leaving you exposed.

    Next time we'll just let you figure it out on your own.
  • Streisand effect? (Score:5, Interesting)

    by Epsillon (608775) on Monday February 18, 2008 @06:49PM (#22468598) Homepage Journal
    Seems if they'd kept their whiny mouths shut, nobody would have realised from the vulnerability disclosure [mozilla.org] that the issue affects Opera. Now EVERYONE knows, from the kiddie scripting 'sploits to the IT manager planning the software deployment for the next few months, who is now seeing why closed-source Opera isn't really such a great choice after all. Even the CVE entry [mitre.org] doesn't disclose Opera's vulnerability to this bug. Still, it makes good comedy if nothing else...
    • Re: (Score:3, Insightful)

      by Hatta (162192)
      Exactly. Not only does this story bring to light the fact that there's a bug in Opera, but it illustrates how Opera prefers to handle security bugs: by covering them up.
  • Opera users (Score:2, Funny)

    by Tumbleweed (3706) *
    it places Opera users at unnecessary risk

    Yeah, both of them.
    • Re: (Score:2, Insightful)

      by bmartin (1181965)
      I don't see why this is so funny. Opera's not that bad, and it does offer some things that aren't available by default in Firefox. Sure, it doesn't have the 400 extensions that FF does, but you don't have to screw around with it much. Opera has some really nifty features enabled OOTB that most people would overlook otherwise. It's also fast and it does a really good job with adhering to web standards.

      Yours is really a flamebait comment, and if there were a considerable number of Opera users with moderation
      • by Tumbleweed (3706) *
        It's just a joke. There aren't many Opera users compared to Firefox users. If you can't tell the difference between a joke and flamebait, that's unfortunate. Are you from Norway?

        Opera has a lot of nifty features, but to my mind, it's crippled by an interface that makes it take forever to figure out how to configure the thing to do what you want. I'd _love_ for the Opera folks to take the Firefox code and rewrite it to their standards. FF would be SOOO much faster. I just don't want the Opera interface.
  • by jameskojiro (705701) on Monday February 18, 2008 @06:55PM (#22468646) Journal
    Best episode of Oprah ever!

  • Only on the series of tubes of the Interwebs does someone Piss and Whine when another person does them a favour.

    I hereby declare Opera a whiny bizznatch. [carcino.gen.nz]

  • Opera users? (Score:2, Flamebait)

    by BeeBeard (999187)
    Santambrogio goes on to attack Mozilla's handling of the issue, arguing that it places Opera users at unnecessary risk.

    In other words, it puts nobody at risk. ;)
  • by deadmongrel (621467) * <karthik@poobal.net> on Monday February 18, 2008 @07:01PM (#22468730) Homepage
    Why is Mozilla obligated to wait and release an advisory because Opera couldn't get off their asses fast enough to respond to something. Also, opera users were already at risk and not just because of the advisory.

    Offtopic: Did that opera guy ever swim from US to Norway? speak about obligations.
  • by KevMar (471257) on Monday February 18, 2008 @07:06PM (#22468772) Homepage Journal
    Whats the big deal. Just go fix it.

    I know you don't have any people committed to different projects.
    I know you have your code at a stable point so its easy to slip in a change
    I know this only takes one guy 5 min to go change a few lines of code
    I know its ready to ship the moment its changed
    I know you coded it right and didn't break anything else

    Remember this is open source. so you should be able to fix all security issues quickly. I bet someone else had already done it for you. Just ask someone for it.

    Whats the point of being open source if you don't do what the community expects of you.

    END RANT

    OK, i bet the underlying issue is they expected to have a Little time. Emails went out to a few people that would look at and identify how big of an issue it was. Once they reported back, only the resources needed would be pulled off other projects to fix this.

    The next day they see the advisory without warning and now they scramble to figure it out. Probably pulled a lot of people off other stuff that they didn't need to in order to rush out a minimally tested release.
  • by iamacat (583406) on Monday February 18, 2008 @07:08PM (#22468802)
    I would say it places Opera users at unnecessary risk of becoming Firefox users :-)
  • Everything that I've read on the topic of disclosure says wait at least a week. Hell, even some mail to the security focus lists have histories in them that go back a couple months! So, I can understand that Opera is rather pissed at the Mozilla people for not giving them ample time to respond. Quite frankly, I find the whole thing rather rude.

    That being said, "Opera's" response wasn't exactly professional either. At least it should have been better worded and cited industry standard ways of working to
  • "We had another fight over the inflatable bath pillow. I kept screeching and screeching at him, but..."
    -- Agnes Skinner, describing her latest fight with her son, Seymour

  • Crap article (Score:5, Insightful)

    by Tridus (79566) on Monday February 18, 2008 @07:26PM (#22468964) Homepage
    Somebody posting to Slashdot says that somebody at The Register says that an Opera blogger screeches about Mozilla. Even for Slashdot, this is a pretty weak title.

    What they actually say is that they only had a day between notification and public disclosure. He's actually happy that Mozilla told them at all (hence the :) ), but not happy that there was only a day before it was made public. Nobody is particularly happy when they only have a day from learning there's a security hole to everybody else learning about it, thats not enough time to get a fix rolled out, so this is hardly surprising.

    I know Mozilla can do no wrong around here, but come on. Even the Mozilla devs would be happier getting more then one day before public disclosure of a security hole.
    • Re: (Score:3, Insightful)

      The security hole has been there for a long time. It didn't just appear in a puff of smoke when the Mozilla devs discovered it.

      Not announcing it means that the black hats get to use it for longer, and that's bad for millions of users. By contrast, delaying the announcement merely saves two or three develpers some embarrassment, at the cost of increased damage to everybody else.

      However you look at it, the benefits of delayed announcements don't add up.

  • I agree with the opera dudes, avoiding users to find out about the browser's security issues is their business model after all...
  • screeches? (Score:4, Insightful)

    by sentientbrendan (316150) on Monday February 18, 2008 @11:29PM (#22470928)
    >Opera Screeches at Mozilla Over Security Disclosure

    Common, can we get article titles and summaries that don't *immediately* tell us about how we should feel about an article before even telling us the circumstances?

    I mean, give me a break, this is a lower standard of reporting than even fox news uses. For *once* I'd like to see a slashdot editor try to be objective, and let the reader make up our own mind instead of trying to spoon feed us our opinions.
    • by supun (613105)
      I thought it was about Opera sending Dustin Diamond to Mozilla to talk about security disclosure.
    • Re: (Score:2, Funny)

      by n6kuy (172098)
      > Common, can we get article titles and summaries
      > that don't *immediately* tell us about how we should
      > feel about an article before even telling us the circumstances?

      What?
      You want me to RTFA before drawing conclusions?
      You must be new here....

Time sharing: The use of many people by the computer.

Working...