Ubuntu
sqlite3 package

  1. Bug #457791
  2. Comment #15

Comment 15 for bug 457791

Revision history for this message
In , Scott Wolchok (evilsporkman) wrote :

(In reply to comment #14)
> (In reply to comment #12)
> > I've reproed this on Ubuntu jaunty's "Shiretoko", which it claims is Firefox
> > 3.5.3. Detailed steps to repro:
> Well, Ubuntu ships their own version of Firefox and it uses the system SQLite.
> I'm betting they don't compile with SQLITE_SECURE_DELETE, which is all sorts of
> sadness.
>
> Not sure who to get in touch with them to get them to do that. I should add a
> test in our test suite to make sure that the library in question is compiled
> with SQLITE_SECURE_DELETE, not that any distros run our test suite to my
> knowledge before shipping with system SQLite.

What about vacuuming only if SQLite is not compiled with SQLITE_SECURE_DELETE? This seems more likely to be secure than relying on distros to negatively impact performance of every use of SQLite in exchange for browser security.

Also, it would be extra super nice if it were possible to avoid unnecessarily hitting disk with possibly sensitive information if Clear Recent History was invoked before the data got flushed to disk, but that level of control might not be exposed by SQLite.