<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body smarttemplateinserted="true" bgcolor="#FFFFFF" text="#000000">
<div id="smartTemplate4-template">I wonder how Postbox manages,
AFAIK they still use Gecko 9.0<br>
<br>
Did Mozilla ever consider splitting Gecko from M-C? I would
believe if it was in a separate branch it would be much easier to
stay in sync.<br>
<br>
Axel<br>
<br>
-- <br>
<style type="text/css">
.myName:hover, .myName a:hover { font-size:13pt; text-shadow: 3px 3px 4px rgba(200,250,200,0.7);}
.moz-signature {opacity: 1.0 !important;}
.myName a { cursor: pointer !important; transition:font-size 0.5s;}
.myLogo {
transition: all .4s ease-out;
}
.myLogo:hover {
transform: scale(3) translate(-30px,-5px);
}
</style>
<div id="mySignature" style="width: 65%; padding: 0.8em 1.2em;
font:x-small verdana; color: #444; box-shadow: 4px 4px 9px -2px
rgba(0,0,0,0.65); border-radius: 1em; padding: 0.4em 2em;
border: 1px dashed #444; background: rgb(230,240,163);
background: linear-gradient(to bottom, rgba(230,240,163,1)
0%,rgba(210,230,56,1) 50%,rgba(195,216,37,1)
51%,rgba(219,240,67,1) 100%);">
<b class="myName" style="text-shadow: 1px 1px 2px #DDD;
transition:font-size 0.5s;"><a
href="mailto:axel.grude@gmail.com">Axel Grude</a></b>
<br>
Software Developer
<br>
Thunderbird Add-ons Developer
<span style="color:#666666; font-size:xx-small">(QuickFolders,
quickFilters, QuickPasswords, Zombie Keys, SmartTemplate4)</span>
<br>
AMO Editor <img style="margin-top: 1em; float: right;
box-shadow: 1px 1px 2px rgba(20, 20, 20, 0.4);"
moz-do-not-send="false" class="myLogo"
src="cid:part2.04080904.07040102@gmail.com" alt="Get
Thunderbird!" height="15" width="94">
</div>
</div>
<div id="smartTemplate4-quoteHeader">
<style type="text/css" scoped="">
#newHeaderAG1 b { font-weight:bold; color: #990033; }
</style><br>
<blockquote type="cite" style="margin-bottom: -20px !important;
padding-bottom:20px !important;">
<div id="newHeaderAG1" style="font-size: x-small; padding:1em;
background-color:rgba(220,220,240,0.4); border-radius:3px;"> <b>Subject:</b>
Why we need Gecko updates (was: Future Planning: Thunderbird
as a Web App)<br>
<b>To:</b> Tb-planning, Gervase Markham <br>
<b>From: </b>Ben Bucksch<br>
<b>Sent: </b>Wednesday, 09/12/2015 00:40:09 00:40 GMT ST
+0000 [Week 49]<br>
</div>
</blockquote>
</div>
<blockquote class=" cite" id="mid_56677869_9070404_beonex_com"
cite="mid:56677869.9070404@beonex.com" type="cite">Gervase Markham
wrote on 18.09.2015 15:32:
<br>
<blockquote class=" cite" id="Cite_115422" type="cite">To put it
another way: "what would we have lost if we had forked m-c two
<br>
years ago"?
<br>
</blockquote>
<br>
Hey Gerv,
<br>
<br>
That's simple to answer: Security patches.
<br>
<br>
As you know from being at the Mozilla Security Group and the
public advisories, the Gecko rendering and JS engine has security
holes fairly regularly. Every month (or every few months), there's
a critical security hole, whereby "critical" means that any random
ad published via an ad server on a website you visit can read all
your files on your computer, install random malware, impersonate
as you, and generally can do whatever you can do on your own
computer.
<br>
<br>
In Thunderbird, the risk is even larger than in Firefox. In
Firefox, you need to actively go to a website, and that website
needs to attack you (possibly via an ad server). We still assume
that an attacker will manage to get you to his website somehow,
and we consider such a critical bug the end of the computing
world. In Thunderbird, the attacker has it even easier: He just
needs to send you an HTML email. You view it, and you're done.
Dead.
<br>
<br>
The default in Thunderbird is the HTML viewer.
<br>
<br>
Mitigation:
<br>
* JS is disabled by default
<br>
* "View | Message body as | Simple HTML", which tries to prevent
most security holes with HTML.
<br>
Neither is bullet-proof and some classes of bugs, e.g. in the
parser, or image decoders or - worse - in the complex native video
codecs, are still going to hit you with their full force.
<br>
<br>
Unfortunately, Mozilla gave up on supporting old Gecko versions
with security patches. Time's over once the ESR release is
unsupported, which is currently 6-8 months. Anything else was
considered not feasible for Firefox security team. There's no
chance that the Thunderbird team can keep up.
<br>
<br>
So, as much as I'd like that personally, forking Gecko is not an
option.
<br>
<br>
(These dreaded security holes and the lack of patches have crossed
many plans, in many different areas and products and companies.)
<br>
_______________________________________________
<br>
tb-planning mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:tb-planning@mozilla.org">tb-planning@mozilla.org</a>
<br>
<a class="moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/tb-planning">https://mail.mozilla.org/listinfo/tb-planning</a>
<br>
<br>
</blockquote>
<br>
<br>
</body>
</html>