Rich Freeman posted on Wed, 21 Sep 2011 12:10:27 -0400 as excerpted:
> Plus at least with firefox the old versions don't suddenly stop
> working/etc, assuming they still get upstream security notices.
That's the thing. AFAIK, they don't. FF4 is still getting them I
believe, due to longer term commitments made there, but from FF5 onward,
no. The upstream policy is that with rare urgent (0-day) exceptions like
the recent bump for SSL certs invalidation that necessitate a mid-cycle
bump, updates will be to the next major version. Thus, once a new major
version is out, previous versions are already considered vulnerable by
definition and no further notices are given.
In fact, there has even been discussion of removing the numeric version
info from the about box, etc. It would say something like either "You
are running the latest version" or "Updates are available and you are
urged to upgrade", that's it. However, from the coverage I've read, the
current release manager, at least, decided that numeric version info
would remain available. (Partly, that was due to already getting push-
back on the 6-week-cycle and given that, someone having at least enough
sanity not to push it all the way to binary current/not-current.)
So yes, either current stable policy will need to change, or Gentoo might
as well give up on a stable firefox. It's as if they're deliberately
forcing the issue, strongly encouraging distros and their users to simply
give up on distro versions entirely, and go direct-upstream-sourced pre-
compiled binaries. I guess that's one way to solve the bundled library
and patches vs. trademarks issues! =:^( (Of course, firefox is more or
less being pushed into it since chrome with its extremely similar
policies, is eating their lunch ATM, thus all these chrome-clone policy
changes. Unfortunately, most of the world is still proprietary, and
that's SOP in the proprietary world.)
... And I don't have a clue when the scheduled cutoff is, but ff4 won't
be supported forever.
--
Duncan - List replies preferred. No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master." Richard Stallman
|