Waterfox: [Classic] 2020.05 changelog is missing details about security fixes
All 6 comments
Classic 2020.06 changelog, same thing.
@MrAlex94
Could you give us a comment on this matter? Does it mean security fixes are no longer ported to the full extent from upstream?
reallyuniquename
on 4 Jun 2020
Sorry, I used an asterisk and so it got added as a bullet point, fixed so it's now using †. It says:
As the differences between Classic and later Firefox versions grow, we are doing our best to patch the security advisories as we think apply to Classic.
MrAlex94
on 4 Jun 2020
@MrAlex94
How critical is this? Does Waterfox Classic remain vulnerable to some of the recent CVEs if enough effort is applied?
reallyuniquename
on 5 Jun 2020
Not that I’ve seen. A lot of vulnerabilities target features that Waterfox doesn’t even support at all. And I’ve kept the biggest attack surfaces (such as Skia and ANGLE up to date and patched). This was more a precautionary measure. Will have to do a big review once ESR68 is EOL.
MrAlex94
on 5 Jun 2020
@MrAlex94
I know you probably would not want to disclose too much details here but can you elaborate?
Is there something with low severity that remains unnpatched then? Or recent fixes can't cover some edge cases?
reallyuniquename
on 5 Jun 2020
So far, everything that I’ve seen that could be possibly related to Waterfox Classic, I will apply. Of course I’m not perfect, so I just put it there as a disclaimer. I do also check other forks (such as TenFourFox) to see what patches they use as well, to make sure I’m on the right track and haven’t missed anything. (Just a note TFF is for PowerPC Macintosh so not all patches apply for them either.)
I’m sure a lot of the security patches will be applicable for time to come, but it’s more preparing for a time where that _may_ not be possible. But looking at some forks they’ve been keeping up to date with security advisories for years.
Hope that helps clarify things a bit :-)
MrAlex94
on 6 Jun 2020
Related issues
fghsgh
·
4Comments
RaitaroH
·
3Comments
Kallinteris-Andreas
·
3Comments
ghost
·
4Comments
aquaspy
·
3Comments
Most helpful comment
So far, everything that I’ve seen that could be possibly related to Waterfox Classic, I will apply. Of course I’m not perfect, so I just put it there as a disclaimer. I do also check other forks (such as TenFourFox) to see what patches they use as well, to make sure I’m on the right track and haven’t missed anything. (Just a note TFF is for PowerPC Macintosh so not all patches apply for them either.)
I’m sure a lot of the security patches will be applicable for time to come, but it’s more preparing for a time where that _may_ not be possible. But looking at some forks they’ve been keeping up to date with security advisories for years.
Hope that helps clarify things a bit :-)