At least it sounds like this vulnerability has an easily-deployable fix. One of the reasons Mozilla folks have opposed standardizing particular libraries as part of the Web platform is the risk that a security vulnerability might not be fixable without breaking compatibility.
This tweet is unavailable
2
20
1
35
That's a fallacious argument. Watch google. they push hard at standardizing protocols, while not giving a second thought to breaking compatibility for security reasons.
1
1
1
Standardization shouldn't stand in the way of security, unless you have a prominent culture of "design by committee". there's NEVER a good reason to compromise security.
1
Replying to @espie_openbsd
Other than leading to the end state of all browsers using a single library, the standardization has little to do with it. The problem isn't about the standards process, it's about the compatibility constraints when websites can assume all browsers behave exactly the same.

Dec 15, 2018 · 5:40 PM UTC

1
Replying to @davidbaron
well, it's more like having IE5 all over again, is it ? I still do not follow your reasoning if any.
2