From owner-freebsd-questions@FreeBSD.ORG  Sat Oct 22 01:05:59 2011
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 468DA1065674
	for <freebsd-questions@freebsd.org>;
	Sat, 22 Oct 2011 01:05:59 +0000 (UTC)
	(envelope-from freebsd-announce@chthonic.com)
Received: from www5.pairlite.com (www5.pairlite.com [64.130.10.15])
	by mx1.freebsd.org (Postfix) with ESMTP id 280F18FC12
	for <freebsd-questions@freebsd.org>;
	Sat, 22 Oct 2011 01:05:58 +0000 (UTC)
Received: from whisperer.chthonixia.net (cpe-66-65-69-148.nyc.res.rr.com
	[66.65.69.148])
	by www5.pairlite.com (Postfix) with ESMTPSA id 31D612E2BD
	for <freebsd-questions@freebsd.org>;
	Fri, 21 Oct 2011 20:50:56 -0400 (EDT)
Date: Fri, 21 Oct 2011 20:54:42 -0400
From: Joe Altman <freebsd-announce@chthonic.com>
To: freebsd-questions@freebsd.org
Message-ID: <20111022005442.GA68656@whisperer.chthonixia.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: Upgrading libxul, dependency on Firefox 3
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: freebsd-announce@chthonic.com
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 22 Oct 2011 01:05:59 -0000

Greetings...

I was running portupgrade on libxul and noticed it depends on Firefox
3.x. I cancelled the upgrade, because I thought FF3.x was insecure and
therefore deprecated while FF7 was recommended and secure.

My questions:

1) is the dependency libxul has for FF3 a security problem?

2) is the dependency on FF3 a bug in libxul? If it is a bug, who
   should receive a report: gecko@ or the Mozilla project?

FYI: I'm pretty sure it was portsclean -D (and not me) that deleted
FF3...yet libxul tried to pull it in during the portupgrade.

Best regards,

Joe