Hacker News Reader

Comment by wlesieutre | Hacker News Reader

Can anyone confirm if 73.0b3 includes the same fix?

Their "what's new" link in the beta's About window doesn't track with the beta release cycle. There's no revision listed, so I think the notes are for 73.0b1 still? At any rate, there's no mention of any security fixes.

https://www.mozilla.org/en-US/firefox/73.0beta/releasenotes/

View on HN

I don't know my way around Firefox's source control at all, but I tried to do some digging. My first thought was to look through the changelogs on recent release tags, but there's no mention of the CVE that I can find in any of them.

I did find these changes in 72 which look related to the bug:

https://hg.mozilla.org/releases/mozilla-release/rev/8260da04...

And poking at one of those referenced files in the beta channel looks like it has the same changes:

https://hg.mozilla.org/releases/mozilla-beta/file/tip/js/src...

So I think we're good on beta channel?

Even security fixes run the Nightly -> Beta -> Release gauntlet, so yes, Beta is fixed.

I asked on Twitter if 73.0b2 had the fix and was told that it did, so we should be good!

Thanks! I don't really do twitter, but maybe I should! Pretty quick turnaround there.

Looks like they've been updated now to mention that the fix was included in beta 2. I guess they're reading this thread :)

I sure hope so since 73.0b3 is the most recent available version of Developer Edition. It's odd to not have any messaging about the non-mainstream editions.

The 73.0b3 release tag is 18 hours ago, compared to that "What's new" page dated 1/7, so it does appear to be newer. See my reply to myself above; as far as I can tell the beta has the same changes (though I didn't manage to fumble my way to the specific commit that fixed it, or whatever the analogous term is for mercurial).

Their developer edition "What's new" page seems more about marketing upcoming changes before they land in the mainline release than anything else.

I'd like to assume they're always on top of getting the same fixes into developer versions at the same time, but since they don't actually tell us anywhere I always feel like I have to check.

Reply on news.ycombinator.com