Mozilla spreads malware rather than security

He should have added a question mark to the end of the title of his article. It turned out that the author of the language pack had an infected computer, hence the file he uploaded having a virus in the first place.

I disagree. This represents a serious slip in package release management for the Mozilla Project. One of their big selling points has always been "fewer holes and faster fixes" (than MSIE by implication). Three months is an outrageous amount of time for an undetected malware payload in an Open Source project.

Hopefully the project leads will put their heads together and implement a comprehensive policy for malware scanning. When they can show system logs indicating consistent policy conformance, it will raise the standard for openness in FOSS development.

I agree gus, this is extremely sloppy on the part of Mozilla. As I look at all of the security precautions that are taken with other FOSS projects, this is shocking. And it's a darn shame too. Mozilla is a prominent FOSS project so any of their screwups will reflect badly on the entire FOSS community.

You can bet there will be bales and bales of hay made of this...

h

There have been already, read the comments at the end of the article.

Would an automatic (clamv?) virus scan after uploading have found it?

I fully understand the disgust, and three months seems a long time unless simply no one connected the infection with the language pack download.

@Bob: From what I read, Mozilla already has a virus scanner in place. But it didn't detect the virus on upload. Perhaps periodic rescanning of all the files should be done (e.g. once after each AV update).

This demonstrates one truism, a system that needs to rely on Virus Scanners for it's security is already broken.

On the other hand Mozilla will need to be very open about what they are doing to stop this recurring.

Keep in mind it was because the author of the language pack managed to let their machine get infected. The title on its own implies that Mozilla did this on purpose, which is misleading.

@tracyanne:

I trust the system you're talking about is the Redmond OS, and not the Mozilla development methodology?

Well yes I am.