663139 - Paypal: Outdated Browser With Known Security Issues.

Status: RESOLVED INVALID

(Camino Graveyard :: Security, defect)

Description

[Muata Belton]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.19) Gecko/2011032020 Camino/2.0.7 (like Firefox/3.0.19)
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en; rv:1.9.0.19) Gecko/2011032020 Camino/2.0.7 (like Firefox/3.0.19)

The following message was received by PayPal:
It looks like you may be using an outdated browser with known security issues. Help keep your computer and your PayPal account protected by updating your browser today.
Version 2.0.7 (1.9.0.19 2011032020)
No new updates are available. 

Reproducible: Always

Steps to Reproduce:
1.Fix security issues
2.
3.

Actual Results:  
N/A

Expected Results:  
N/S

N/A

Comment 1

[Samuel Sidler (:ss)]

Note that this was sent via email and is not present on their website (afaict). (I received this email as well.)

Comment 2

[Stuart Morgan]

This basically boils down to "ship Camino 2.1" which we are working on; we don't need a bug tracking that, so closing.

Comment 3

[Muata Belton]

Since this bug is not fixed, then this Bug Report should not be closed. Close this Bug Report after the new Camion 2.1 version is released. Thanks.

Comment 4

[Stuart Morgan]

We close bugs when issues are resolved in the development version, not when fixes are shipped in releases, because the purpose of our bug system is for us to track fixes we need to make. This bug doesn't apply to the development version, so there's no point in keeping it open.

Please don't tell us how our own bug system is supposed to work.

Comment 5

[Muata Belton]

Well, thank you addressing the vulnerability in your current development version, but this doesn't help users using the latest version of Camino. By closing this Bug Report before the development version is released, you are giving your users a false-reality that this vulnerability is fixed and/or non-important. So, what is the date the Camino 2.1 version will be released? Thanks.

Comment 6

[Stuart Morgan]

(In reply to comment #5)
> By closing this Bug Report before the development version is released, you are
> giving your users a false-reality that this vulnerability is fixed

The bug system is a tool for us to track and fix bugs, not a product announcement or user support channel. If someone who doesn't understand the bug system comes here, doesn't actually read anything that's written here, and then comes to the conclusion that 2.0.7 has no security vulnerabilities despite nothing here saying anything even remotely like that, there's nothing we can do about that.

> So, what is the date the Camino 2.1 version will be released?

When it's done; Camino is built entirely by a handful of volunteers in their spare time, which means it's impossible for us to commit to specific dates.