There's no cat and mouse -- they agreed to this blocking. I have in fact encouraged them to use a different extension ID if and when they make a fixed ClickOnce/WPF add-on that can be installed by active user choice rather than by default!

MS09-054 is labelled as an Internet Explorer update, so it's not obvious that Firefox users need to apply it. We're working with Microsoft on getting that fixed. Microsoft did definitely agree to it; I'm the one they told, on the telephone, before I requested the block be pushed out. I don't know why you think I was lying -- I didn't "imply" it, I flat out said that they agreed, which is the case. Do I have a history of lying about such things?

See http://blog.mozilla.com/security/2009/07/19/milw0rm-9158-stack-overflow-crash-not-exploitable-cve-2009-2479/ for more details, including specifics about how the bug affects different platforms and versions (worst case: unexploitable crash in OS X system libraries).

So we were a bit faster, sorry about that :-) I can only speak for OGo by saying that the Sunbird GroupDAV efforts wouldn't have been started if Sunbird CalDAV support would have already been available.

That strikes me as a curious statement, given that Stelian announced on Feb 15that he'd "started his work", but that there was "no code yet", and in the same thread mentioned mozilla/calendar/providers, which has hosted development of a CalDAV provider since the middle of December. In the same newsgroup, in fact, we'd been discussing the architectural changes we were making to Sunbird to support remote servers properly, and the progress of CalDAV, since early November.

But maybe I'm missing something here. It's happened before.

Mike