Hacker News Reader

Is it possible to query the mozilla bugtracker to see how many security issues was fixed in the pre-rust MP4 parser before it was replaced?

View on HN

Most security bugs are private. Even after the bug has been fixed, users running older versions of Firefox may still be affected so Mozilla doesn't want to expose too much information about how to exploit the bug. The fix, of course, is open source for everyone to examine.

Mozilla doesn't opensource their bug metadata?!

Ah its cool, they're rational actors who don't crucify people for private interests.

Mozilla security bugs do get opened up eventually. Specifically, once not only Mozilla but also various downstream distributors (linux distributions, etc) have shipped a fix for it. Release cycles there vary, so there is typically a gap of a month to a bit over a year (depending on whether the fix could be backported to the previous ESR) between the fix shipping in Firefox and the bug being fully disclosed.

That said, even after a security bug is open some information in it may remain hidden. For example, weaponized exploits attached to bugs are generally kept hidden even after the bug is opened.

Reply on news.ycombinator.com