Mike Shaver (Director of Ecosystem Development at Mozilla) handed his business card to Robert Hansen (RSnake) on Wednesday night at Black Hat. On it he wrote “ten f—ing days.” When I asked him about it, he said he meant to communicate to Robert that since Mozilla got a recent security update out in only ten days, that there was no reason for Robert to post details of vulnerabilities publicly before a patch was available. Since we’re among the most responsive software vendors, security researchers do not have to resort to full disclosure to get us to patch bugs quickly.
Well, whatever he meant, his statement has taken on a life of its own. Robert posted on his blog, and a bunch of news articles picked it up as a challenge.
This is the official Mozilla word: This is not our policy. We do not think security is a game, nor do we issue challenges or ultimatums. We are proud of our track record of quickly releasing critical security patches, often in days. We work hard to ship fixes as fast as possible because it keeps people safe. We hope these comments do not overshadow the tremendous efforts of the Mozilla community to keep the Internet secure.
Ping from » Patches in ten f***ing days? Not really, says Mozilla | Ryan Naraine’s Zero Day | ZDNet.com on
Ping from about ten days at black hat · Get Latest Mozilla Firefox Browsers on
Ping from Mozilla says no guarantees of 10-day patch turnarounds — Security Bytes on
Ping from hackademix.net » Ten, they can! (if they want) on
Ping from Mozilla: 10-day patch guarantee ‘not our policy’ on
Ping from Techzi » Blog Archive » Mozilla: 10-day patch guarantee ‘not our policy’ on
Ping from Firefox Clarifies ‘Ten Day Policy’ at Catherine’s Flying Hamster Blog on
Ping from Mozilla: 10-Day Patch Guarantee ‘Not our Policy’ « TechTitans™ on
Greg K Nicholson wrote on
Ping from about ten days at black hat · Get Latest Mozilla Firefox Browsers on
Ping from Inside Firefox » Blog Archive » 10 days to a security fix on
Ping from Mozilla nie będzie łatać dziur w 10 dni « Blog nyax’a, czyli mój ;) on
Ping from TerminalDigit - Mozilla Officially Retracts “Ten Fucking Days” on
shaon wrote on