Strengthening security at Mozilla
Published: 02 Oct 2006 18:05 BST
…to get a patch out to its customers? Then, once the patch is available, how long does it take to deploy it?
I think Mozilla has made the number of days between the time a vulnerability is identified and a patch is available incredibly small, and it is shrinking.
So the answer, in one word: is Firefox more secure than Internet Explorer?
I don't think there is a one-word answer for that question.
You can't say yes or no?
You have to look at the days of risk. You have to look at the overall process, how responsive and how transparent the processes are.
Are there any security challenges that face Mozilla or its products?
We have a tremendous opportunity, from our features perspective, to implement changes that will enhance the overall security of the product — for example, reducing the attack surface area by eliminating code that is either dead or infrequently used. There are some file-parsing engines or mechanisms that are present, but maybe for file formats that aren't widely in use.
If it does not add any benefit to the customers, it is probably only adding risks. If people aren't really using it, that code should go.
You dealt with security researchers at Microsoft and will deal with them at Mozilla. How do you see the community? There have been several cases where researchers have gone public with Firefox flaws.
The security research community I see as another part of the Mozilla community. There's an opportunity for these people, if they get excited about the Mozilla project, to really contribute. They can contribute to secure design, they can suggest features, they can help us identify vulnerabilities, and they can help us test it. They can help us build tools to find more vulnerabilities. The spectrum is much broader [than with commercial products] in ways the research community can contribute to this project.
Did you use Firefox already before you came here?
Oh yeah. I use everything. So at home, of course, I have Macs, I have PCs and machines running Linux. I have a broad range of platforms and software at home.
Are you working more hours now than you were working before?
Probably, but I am spending a lot of time getting up to speed, and assessing where we are. It is a brand-new job for me, so you've got to jump in and get started. That means spending a lot of time talking to people and reading all the old bugs.
Previous
Did you find this article useful?
320 out of 511 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
Full Talkback thread
1 comment
