SecurityEngineering/Roadmap: Difference between revisions

|-

! Item  

! Owner

|-

| [https://wiki.mozilla.org/NPAPI:Pepper2 Plugin sandboxing]<br>  

| &nbsp;?

|-

| [https://groups.google.com/group/mozilla.dev.security/browse_thread/thread/f8afac1eef7cb4cd/b570280627c3dca8 Effective certificate revocation and management]<br>  

| &nbsp;?

|-

| [https://wiki.mozilla.org/Opt-in_activation_for_plugins Plugin runtime mitigations such as whitelist and/or click to ]<br>  

|-

| javascript: and data: handling in URL bar and chrome  

| <br>

|-

| DLL&nbsp;whitelisting by name or signature<br>  

| &nbsp;?<br>

|-

| Track "Application Reputation"<br>  

| <br>

|-

| Prune dead and dying code<br>  

| <br>

|-

| Malloc should be infallible<br>  

| <br>

|-

| TLS&nbsp;1.2 support<br>  

| <br>

|-

| Eviltraps meta-bug (prevents users from leaving a page)<br>  

| <br>

|-

| Notify user of malware in their crash signatures<br>  

| <br>

|-

| Expose HSTS&nbsp;and other security browser state to plugins (NPAPI)<br>  

| <br>

|-

| Ignore autocomplete="off" for password fields

| <br>

|-

| UX security experiment  

| &nbsp;?

|-

| [https://bugzilla.mozilla.org/show_bug.cgi?id=663566 Content Security Policy revisions]

| Brandon Sterne

|-

| CSRF&nbsp;mitigations  

| <br>

|-

| Clickjacking mitigations  

|  

|-

| X-Content-Type-Options  

|  

|-

| toStaticHTML  

|  

|}