Firefox 1.5 patches 'undisclosed' security holes
[Updated: 1:40 PM] Open Source has always prided itself in openness, but why is the Mozilla foundation patching security flaws without disclosing what they are? A new Update for Firefox 1.5 was released by Mozilla which actually has a long list …
Context & Ripple Effects
Firefox 1.5 has been on a fast patch cadence since its November 2005 arrival: the browser hit Mozilla's FTP site in late November, and within weeks Mozilla shipped its first major update alongside a brand-new built-in security-update mechanism. With Firefox confirmed to be pulling users away from Internet Explorer and a public Firefox 2.0 beta promised for March, the project's security process is suddenly running at consumer scale.
This ZDNet piece lands on the friction that scale creates: Mozilla pushed a Firefox 1.5 update carrying a long list of security fixes without saying what they fix, prompting criticism that an open-source project is behaving less transparently than its ethos promises. The tension is not incidental — the faster Mozilla patches, the more its disclosure choices become part of the product.
First-order effects
- Firefox 1.5 users receive the fixes silently through Mozilla's new update mechanism, trading visibility into what changed for faster protection on a browser now challenging Microsoft's installed base.
- Mozilla absorbs immediate reputational pushback from the open-source community and press over withholding flaw details, forcing it to justify quiet patching publicly.
Second-order effects
- As Firefox takes share from Internet Explorer, its disclosure practices face the same scrutiny Microsoft long endured — attackers gain incentive to reverse-engineer the binary diffs Mozilla declines to explain.
- Rival browser vendors can position their own advisory rigor against Mozilla's silence, turning disclosure policy into a competitive talking point rather than a compliance chore.
Third-order effects
- If quiet patching becomes routine for Mozilla, the distinction between open- and closed-source security culture narrows toward a shared norm of partial disclosure when exploits are live, testing what 'openness' concretely guarantees to end users.
The trend: Browsers maturing into mass-market targets are discovering that disclosure practice, not source availability, defines operational trust — Mozilla's quiet 1.5 patching is an early data point in that convergence.