« previous week | index | next week »

• Time: (Weekly) Tuesday at 13:30 PM PDT / 16:30 PM EDT / 21:30 PM UTC.
• Place: Mozilla HQ, 3A-All Your Base (3rd Floor)
• Phone (US/Intl): 650 903 0800 x92 Conf: 95316#
• Phone (Toronto): 416 848 3114 x92 Conf: 95316#
• Phone (US): 800 707 2533 (pin 369) Conf: 95316#

Contents 1 Agenda 1.1 Actions 1.2 Upcoming Speaking Engagements 2 Security Review Status (curtisk) 3 Operations Security Update (Joe Stevensen) 4 Project Updates 4.1 Silent updates (rforbes / dveditz) 4.2 B2G (Paul Theriault, David Chan) 4.3 Thunderbird (Adam Muntner) 4.4 Rust (Jesse Ruderman) 4.5 Mobile (Mark Goodwin) 4.6 Sync (Simon Bennetts) 4.7 Services (Simon Bennetts & Adam Muntner) 4.8 Jetpack, Add-on SDK, Add-on Builder (Dan Veditz) 4.9 JS (Christian Holler) 4.10 DOM, XPConnect (Jesse Ruderman) 4.11 Layout, Style (Jesse Ruderman) 4.12 Automation Tools (Gary Kwong) 4.13 Web Developer Tools (Mark Goodwin) 4.14 Networking (Christoph Diehl) 4.15 Media / Graphics (Christoph Diehl) = 4.16 Peach (Christoph Diehl / Raymond Forbes) = 4.17 Market (Raymond Forbes) 4.18 Firefox APIs (Raymond Forbes) 4.19 Payment Flow (Raymond Forbes) 4.20 Dynamic API Security Model (Raymond Forbes) 4.21 WebRT (Raymond Forbes) 4.22 BrowserID 4.23 Identity Services (David Chan) 4.24 Addons.M.O (Raymond Forbes) 4.25 Bugzilla.M.O (Mark Goodwin & Eric Parker) 4.26 Mozillians (Raymond Forbes) 4.27 MDN (Raymond Forbes) 4.28 SUMO (Kitsune) () 4.29 AddressSanitizer (Christian Holler)

Agenda

• Goals - Please keep status up to date - https://mana.mozilla.org/wiki/display/SECURITY/2012+-+Q4+Goals
  • We spent most of the meeting discussing where we are on Q4 goals
  • Lots of green :)
• 2013 Responsibility Areas
  • Dan continues "owning" Firefox (Desktop and Mobile)
  • yvan - sites and services
  • joes - opsec (secure all the things!)
  • Firefox OS is currently unowned until we hire someone? pauljt and dchan have been working on it but there isn't a single person through which communication can flow(?)
• [curtisk] Draft blog post about security engagement - https://etherpad.mozilla.org/lnEF8AkO9g
• [curtisk] communications plan
  • https://docs.google.com/a/mozilla.com/spreadsheet/ccc?key=0AlDw2hHXmVgCdHN3LWZTZ0hjMElPc1g2clRKb2lNN3c
  • Previous talks available at https://wiki.mozilla.org/Security/Talks
• [sarentz] Minion 0.1 Release. Please give either the VM https://github.com/ygjb/minion/wiki/Minion-0.1-VM-Release or the site https://50.56.178.103 a try
• [yboily] Mentorships
• [rforbes] HSM Usage for key storage - https://etherpad.mozilla.org/hsm
• Review Security Radar Page - https://wiki.mozilla.org/Security/Radar
• Stale bugs: https://bugzilla.mozilla.org/buglist.cgi?type1-0-0=lessthan;list_id=5237360;type3-0-0=substring;field0-0-0=flagtypes.name;value3-0-0=pending;value2-0-0=triage;field2-0-0=status_whiteboard;resolution=---;query_based_on=Stale;field3-0-0=status_whiteboard;type2-0-0=notsubstring;query_format=advanced;value1-0-0=2w;bug_status=UNCONFIRMED;bug_status=NEW;bug_status=READY;bug_status=ASSIGNED;bug_status=REOPENED;type0-0-0=notsubstring;value0-0-0=needinfo;component=Security%20Assurance%3A%20Review%20Request;field1-0-0=delta_ts

Actions

• [curtisk] tag to mark stuff for long term waiting

Upcoming Speaking Engagements

• (Who) : Date: Name of Event : Talk Title: Link
• Simon Bennetts : Feb 2-3 : FOSDEM : Talking about ZAP :)
• Raymond Forbes : Feb 27 - March 2 : Nullcon

Security Review Status (curtisk)

Chart View:

• Completed in Q4 2012: (Q3=56)
• Number of Reviews Completed (so far this quarter): 48 (47)
  • https://bugzilla.mozilla.org/buglist.cgi?list_id=4619884;resolution=FIXED;chfieldto=2012-12-31;query_format=advanced;chfield=resolution;chfieldfrom=2012-09-30;type0-0-0=anywords;component=Security%20Assurance%3A%20Review%20Request;product=mozilla.org
• Number of Outstanding Reviews: 132 (132)
  • https://bugzil.la/comp%3A%22security%20assurance%3A%20review%20request%22
• Number of Reviews Ready For Review: 75 (73)
  • https://bugzil.la/component%3A%22Security%20Assurance%3A%20Review%20Request%22%20%2Bsw%3A%22pending%22%20-flag%3A%22needinfo%22
• Number of reviews without risk rating: 30 (51) <UPDATED QUERY: removes items marked needinfo?>
  • https://bugzilla.mozilla.org/buglist.cgi%3Ftype1-0-0%3Dnotsubstring%3Blist_id%3D5236765%3Bfield0-0-0%3Dcomponent%3Bvalue2-0-0%3D%5Bscore%253A%3Bfield2-0-0%3Dstatus_whiteboard%3Btype2-0-0%3Dnotsubstring%3Bquery_format%3Dadvanced%3Bbug_status%3DUNCONFIRMED%3Bbug_status%3DNEW%3Bbug_status%3DREADY%3Bbug_status%3DASSIGNED%3Bbug_status%3DREOPENED%3Bvalue1-0-0%3Dneedinfo%3Btype0-0-0%3Dsubstring%3Bvalue0-0-0%3DSecurity%2520Assurance%253A%2520Review%2520Request%3Bfield1-0-0%3Dflagtypes.name
• Number of reviews without deadline set: 95 (122) <UPDATED QUERY: removes items marked needinfo?>
  • https://bugzilla.mozilla.org/buglist.cgi%3Ftype1-0-0%3Dnotsubstring%3Blist_id%3D5236788%3Bfield0-0-0%3Dcf_due_date%3Bresolution%3D---%3Bquery_format%3Dadvanced%3Bvalue1-0-0%3Dneedinfo%3Btype0-0-0%3Disempty%3Bcomponent%3DSecurity%2520Assurance%253A%2520Review%2520Request%3Bfield1-0-0%3Dflagtypes.name%3Bproduct%3Dmozilla.org
• Find Yours:
  • Risk Rating (Yours)
  • Without Deadline (Yours)

Operations Security Update (Joe Stevensen)

Project Updates

Please don't leave blank. Add "No Update" if nothing has changed

Silent updates (rforbes / dveditz)

B2G (Paul Theriault, David Chan)

• updating tests for b2g changes

Thunderbird (Adam Muntner)

Rust (Jesse Ruderman)

Mobile (Mark Goodwin)

Sync (Simon Bennetts)

No update

Services (Simon Bennetts & Adam Muntner)

No update

Jetpack, Add-on SDK, Add-on Builder (Dan Veditz)

JS (Christian Holler)

• Bug 822385: Add getters/setters/methods with jitinfo to the shell
  • Will make it possible to reproduce certain browser-only issues in the shell too (e.g. for fuzzing)

DOM, XPConnect (Jesse Ruderman)

Layout, Style (Jesse Ruderman)

Automation Tools (Gary Kwong)

• No update

Web Developer Tools (Mark Goodwin)

Networking (Christoph Diehl)

• Bug 820990 is blocking SDP fuzzing

Media / Graphics (Christoph Diehl) =

• Looking into cache.manifest
• Looking into JAR

Peach (Christoph Diehl / Raymond Forbes) =

• Working on FruitFarm

Market (Raymond Forbes)

Firefox APIs (Raymond Forbes)

Payment Flow (Raymond Forbes)

Dynamic API Security Model (Raymond Forbes)

WebRT (Raymond Forbes)

BrowserID

Identity Services (David Chan)

Addons.M.O (Raymond Forbes)

Bugzilla.M.O (Mark Goodwin & Eric Parker)

Mozillians (Raymond Forbes)

MDN (Raymond Forbes)

SUMO (Kitsune) ()

AddressSanitizer (Christian Holler)

• No update