Security/Meetings/SecurityAssurance/2012-12-18

« previous week | index | next week »

• Time: (Weekly) Tuesday at 13:30 PM PDT / 16:30 PM EDT / 21:30 PM UTC.
• Place: Mozilla HQ, 3A-All Your Base (3rd Floor)
• Phone (US/Intl): 650 903 0800 x92 Conf: 95316#
• Phone (Toronto): 416 848 3114 x92 Conf: 95316#
• Phone (US): 800 707 2533 (pin 369) Conf: 95316#

Agenda

• Goals - Please keep status up to date - https://mana.mozilla.org/wiki/display/SECURITY/2012+-+Q4+Goals
  • We spent most of the meeting discussing where we are on Q4 goals
  • Lots of green :)
• 2013 Responsibility Areas
  • Dan continues "owning" Firefox (Desktop and Mobile)
  • yvan - sites and services
  • joes - opsec (secure all the things!)
  • Firefox OS is currently unowned until we hire someone? pauljt and dchan have been working on it but there isn't a single person through which communication can flow(?)
• [curtisk] Draft blog post about security engagement - https://etherpad.mozilla.org/lnEF8AkO9g
• [curtisk] communications plan
  • https://docs.google.com/a/mozilla.com/spreadsheet/ccc?key=0AlDw2hHXmVgCdHN3LWZTZ0hjMElPc1g2clRKb2lNN3c
  • Previous talks available at https://wiki.mozilla.org/Security/Talks
• [sarentz] Minion 0.1 Release. Please give either the VM https://github.com/ygjb/minion/wiki/Minion-0.1-VM-Release or the site https://50.56.178.103 a try
• [yboily] Mentorships
• [rforbes] HSM Usage for key storage - https://etherpad.mozilla.org/hsm
• Review Security Radar Page - https://wiki.mozilla.org/Security/Radar
• Stale bugs: https://bugzilla.mozilla.org/buglist.cgi?type1-0-0=lessthan;list_id=5237360;type3-0-0=substring;field0-0-0=flagtypes.name;value3-0-0=pending;value2-0-0=triage;field2-0-0=status_whiteboard;resolution=---;query_based_on=Stale;field3-0-0=status_whiteboard;type2-0-0=notsubstring;query_format=advanced;value1-0-0=2w;bug_status=UNCONFIRMED;bug_status=NEW;bug_status=READY;bug_status=ASSIGNED;bug_status=REOPENED;type0-0-0=notsubstring;value0-0-0=needinfo;component=Security%20Assurance%3A%20Review%20Request;field1-0-0=delta_ts

Actions

• [curtisk] tag to mark stuff for long term waiting

Upcoming Speaking Engagements

• (Who) : Date: Name of Event : Talk Title: Link
• Simon Bennetts : Feb 2-3 : FOSDEM : Talking about ZAP :)
• Raymond Forbes : Feb 27 - March 2 : Nullcon

Security Review Status (curtisk)

Chart View:

• Completed in Q4 2012: (Q3=56)
• Number of Reviews Completed (so far this quarter): 48 (47)
  • https://bugzilla.mozilla.org/buglist.cgi?list_id=4619884;resolution=FIXED;chfieldto=2012-12-31;query_format=advanced;chfield=resolution;chfieldfrom=2012-09-30;type0-0-0=anywords;component=Security%20Assurance%3A%20Review%20Request;product=mozilla.org
• Number of Outstanding Reviews: 132 (132)
  • https://bugzil.la/comp%3A%22security%20assurance%3A%20review%20request%22
• Number of Reviews Ready For Review: 75 (73)
  • https://bugzil.la/component%3A%22Security%20Assurance%3A%20Review%20Request%22%20%2Bsw%3A%22pending%22%20-flag%3A%22needinfo%22
• Number of reviews without risk rating: 30 (51) <UPDATED QUERY: removes items marked needinfo?>
  • https://bugzilla.mozilla.org/buglist.cgi%3Ftype1-0-0%3Dnotsubstring%3Blist_id%3D5236765%3Bfield0-0-0%3Dcomponent%3Bvalue2-0-0%3D%5Bscore%253A%3Bfield2-0-0%3Dstatus_whiteboard%3Btype2-0-0%3Dnotsubstring%3Bquery_format%3Dadvanced%3Bbug_status%3DUNCONFIRMED%3Bbug_status%3DNEW%3Bbug_status%3DREADY%3Bbug_status%3DASSIGNED%3Bbug_status%3DREOPENED%3Bvalue1-0-0%3Dneedinfo%3Btype0-0-0%3Dsubstring%3Bvalue0-0-0%3DSecurity%2520Assurance%253A%2520Review%2520Request%3Bfield1-0-0%3Dflagtypes.name
• Number of reviews without deadline set: 95 (122) <UPDATED QUERY: removes items marked needinfo?>
  • https://bugzilla.mozilla.org/buglist.cgi%3Ftype1-0-0%3Dnotsubstring%3Blist_id%3D5236788%3Bfield0-0-0%3Dcf_due_date%3Bresolution%3D---%3Bquery_format%3Dadvanced%3Bvalue1-0-0%3Dneedinfo%3Btype0-0-0%3Disempty%3Bcomponent%3DSecurity%2520Assurance%253A%2520Review%2520Request%3Bfield1-0-0%3Dflagtypes.name%3Bproduct%3Dmozilla.org
• Find Yours:
  • Risk Rating (Yours)
  • Without Deadline (Yours)

Project Updates

Please don't leave blank. Add "No Update" if nothing has changed

B2G (Paul Theriault, David Chan)

• updating tests for b2g changes

Sync (Simon Bennetts)

No update

Services (Simon Bennetts & Adam Muntner)

No update

JS (Christian Holler)

• Bug 822385: Add getters/setters/methods with jitinfo to the shell
  • Will make it possible to reproduce certain browser-only issues in the shell too (e.g. for fuzzing)

Automation Tools (Gary Kwong)

• No update

Networking (Christoph Diehl)

• Bug 820990 is blocking SDP fuzzing

Media / Graphics (Christoph Diehl) =

• Looking into cache.manifest
• Looking into JAR

Peach (Christoph Diehl / Raymond Forbes) =

• Working on FruitFarm

AddressSanitizer (Christian Holler)

• No update