CiviCRM Community Forums (archive)

What is the policy concerning security updates?

In other words, since 3.4 is the final D6 version, are we going to see security updates to 3.4? And if so, for how long?

Thanks,
-Joseph

I think the community needs to consider switching to the way that Drupal handles security updates. They are backported to the previous major version. In this case, we really *should* provide security patches for 3.x for much longer than the plan is currently. Maybe instead of providing security updates for the previous major version (which would often be pointless, since people could/should just upgrade), we should provide security updates for the last version that supports the previous version of Drupal or Joomla!.

The reason is simple: Do we really expect all of the non-profits and other organizations who have settled on CiviCRM to suddenly cough up the money to upgrade their site from D6 to D7 (or Joomla! 1.5 to 1.6)? They don't have the money for that. They aren't planning on it. And they don't have a clue that they are about to have an insecure site.

We need to provide security patches for a good long time for those organizations stuck on D6 or J1.5.

Maybe the MIH should be switched to just funding the security updates. But I also think that we should switch the official policy of providing security updates.

I can't tell a client, "Well, there is this ad-hoc group of people that *might* patch security bugs." Nor can I tell them, "As long as you and other organizations keep bribing the developers every 6 months with large sums of money, they will consider helping you by keeping the site you *just* put online last month secure."

I'm not being very nice in my language, I know. But my point is that this is egg on the face of the entire CiviCRM community. Seriously, big projects are just now being deployed on 3.x and will be *after* we have officially stopped providing security patches. That's not good for business. You know what I mean?