Re: Removing Firefox Version Number

Martin Jungowski wrote:
> On Aug 17, 10:28 pm, Asa Dotzler<[email protected]>  wrote:
>> Firefox also gives you the ability to turn off updates and continue to
>> run an insecure version of Firefox for as long as you want. I don't
>> recommend it, but it's available.
>
> You keep saying that but I don't necessarily agree with the "insecure"
> part of that statement.

Maybe you don't realize that a short while after we release a new 
version, we also publicly describe flaws we've fixed and then we open up 
the bug reports for those issues. That gives the bad guys a big easy 
target for exploits. In some cases, our bugs even include testcases 
which could also be called "exploits" if you're a bad guy.

You *are* insecure when using an unsupported version of Firefox. This is 
not some pro/con debate. Bad guys know your flaws and are deploying 
exploits against them. Firefox may have introduced some new flaws, but 
that's a lot less severe of a problem than bad guys knowing about all 
the holes Mozilla just patched and being able to go after and exploit 
people who don't update.

If you're using a version of Firefox without those patches for very 
long, you're very insecure. *very* *insecure*.

This isn't debatable. This isn't up to interpretation. This isn't a 
weighting the trade-offs. You are very much more insecure on an 
unsupported version of Firefox than on a current and up to date version.

- A