On Thu, Apr 29, 2010 at 9:58 AM, Christopher Aillon <caillon(a)redhat.com> wrote:
Anyway, it's unfortunate that this really isn't done more
often. I
really think that as a project, we'd be doing a lot better if we
mandated upstream review before applying patches to any package if you
aren't an upstream maintainer of the code. As it is now, it's somewhat
scary to think how many packagers would take a bugfix patch and apply it
without being able to figure out if there's a potential hidden exploit
in it...
The question is... is there a communication breakdown which let this
particular patch linger in the review process for too long ? And if
so, what can 'we' do to address that breakdown?
It definitely seems there's recognition from Mozilla that something in
the communication broke down from this sidebar discussion at LWN:
http://lwn.net/Articles/385171/
The question I have is.. do 'we' understand our role in driving
important issues up into upstream's review que to make sure it gets
looked at in a timely way?
It seems to me the review process worked like it was suppose to
here...but it just didn't get triggered in a timely manner...partly
because we didn't jump up and down about it being important.
-jef