Security/B2G/Contribute - Revision history

Arroway: adding some resources

2014-12-09T19:48:50Z

adding some resources

← Older revision		Revision as of 19:48, 9 December 2014
Line 114:		Line 114:

	* Learning by reading:		* Learning by reading:
			** [https://github.com/getify/You-Dont-Know-JS#titles You don't know JS]
	** [https://developer.mozilla.org/en-US/docs/Web/JavaScript JavaScript documentation and guides on MDN]		** [https://developer.mozilla.org/en-US/docs/Web/JavaScript JavaScript documentation and guides on MDN]
	* Learning by doing:		* Learning by doing:
Line 119:		Line 120:
	** [http://ejohn.org/apps/learn/ Learning Advanced JavaScript]		** [http://ejohn.org/apps/learn/ Learning Advanced JavaScript]
	** [https://webmaker.org/en-US/resources/literacy/weblit-CodingScripting WebMaker resources on JavaScript]		** [https://webmaker.org/en-US/resources/literacy/weblit-CodingScripting WebMaker resources on JavaScript]
			** [http://nodeschool.io/ nodeschool.io]

Arroway: /* Learning resources */

2014-12-09T16:40:54Z

Learning resources

← Older revision		Revision as of 16:40, 9 December 2014
Line 118:		Line 118:
	** [https://www.codeschool.com/courses/javascript-road-trip-part-1 JavaScript Road Trip pt 1 on Code School]		** [https://www.codeschool.com/courses/javascript-road-trip-part-1 JavaScript Road Trip pt 1 on Code School]
	** [http://ejohn.org/apps/learn/ Learning Advanced JavaScript]		** [http://ejohn.org/apps/learn/ Learning Advanced JavaScript]
			** [https://webmaker.org/en-US/resources/literacy/weblit-CodingScripting WebMaker resources on JavaScript]

Arroway: add learning resources

2014-12-09T16:38:26Z

add learning resources

← Older revision		Revision as of 16:38, 9 December 2014
Line 108:		Line 108:

	For more information about how to provide translation for MDN pages, you can consult [https://developer.mozilla.org/en-US/docs/MDN/Contribute/Localize/Translating_pages these guidelines].		For more information about how to provide translation for MDN pages, you can consult [https://developer.mozilla.org/en-US/docs/MDN/Contribute/Localize/Translating_pages these guidelines].

			== Learning resources ==

			=== JavaScript ===

			* Learning by reading:
			** [https://developer.mozilla.org/en-US/docs/Web/JavaScript JavaScript documentation and guides on MDN]
			* Learning by doing:
			** [https://www.codeschool.com/courses/javascript-road-trip-part-1 JavaScript Road Trip pt 1 on Code School]
			** [http://ejohn.org/apps/learn/ Learning Advanced JavaScript]

Arroway at 13:32, 30 October 2014

2014-10-30T13:32:05Z

← Older revision		Revision as of 13:32, 30 October 2014
Line 89:		Line 89:
	* [https://wiki.mozilla.org/Marketplace/Reviewers/Apps/Guide/SecReviewTraining Security review training for app reviewer]		* [https://wiki.mozilla.org/Marketplace/Reviewers/Apps/Guide/SecReviewTraining Security review training for app reviewer]
	* [https://developer.mozilla.org/en-US/Apps/Security_guidelines Security guidelines for app developers and reviewer]		* [https://developer.mozilla.org/en-US/Apps/Security_guidelines Security guidelines for app developers and reviewer]

			To review an app installed from the Marketplace when you don't have direct access to the source code repository, you can use the DevTools in Firefox (depending on the version, [https://developer.mozilla.org/en-US/docs/Tools/WebIDE WebIDE] or the [https://developer.mozilla.org/en-US/Firefox_OS/Using_the_App_Manager App Manager]):
			* install the app (on the [https://developer.mozilla.org/en-US/docs/Tools/Firefox_OS_Simulator simulator] or on a real device)
			* then use the DevTools to debug it and have access to the source code

	=== How to report a security issue: ===		=== How to report a security issue: ===

Mgoodwin: Fixed some typos

2014-10-30T11:43:49Z

Fixed some typos

← Older revision		Revision as of 11:43, 30 October 2014
Line 27:		Line 27:
	}</bugzilla>		}</bugzilla>

	=====~~Plateform~~ Security features=====		=====Platform Security features=====
	<bugzilla>{		<bugzilla>{
	"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],		"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
Line 50:		Line 50:
	'''Get in touch with us early'''		'''Get in touch with us early'''

	Let us know you're starting to work on a feature. Depending on its size, implementing a security feature usually ~~involve~~ important designing decisions which have to be worked on with several teams: platform, Gaia, UX, security. It is also the perfect way to know if other people are working on similar or related features.		Let us know you're starting to work on a feature. Depending on its size, implementing a security feature usually involves important designing decisions which have to be worked on with several teams: platform, Gaia, UX, security. It is also the perfect way to know if other people are working on similar or related features.
	You can start by contacting us, we will help you get in touch with the right people:		You can start by contacting us, we will help you get in touch with the right people:
	* IRC channel #FxOSSec on irc.mozilla.org		* IRC channel #FxOSSec on irc.mozilla.org

Arroway: finish adding bugs

2014-10-29T23:26:56Z

finish adding bugs

← Older revision		Revision as of 23:26, 29 October 2014
Line 10:		Line 10:
	(This list is to be validated and improved by adding a first good bugs section)		(This list is to be validated and improved by adding a first good bugs section)

	~~<bugzilla>{~~		=====Improved privacy=====
	~~"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],~~
	~~"id": ["777948", "930258"],~~
	~~"include_fields": "id, summary, status, assigned_to"~~
	~~}</bugzilla>~~

	~~'''Security sandbox'''~~
	* https://wiki.mozilla.org/Security/Sandbox
	* {{bug\|930258}}

	~~'''~~Improved privacy~~'''~~

	<bugzilla>{		<bugzilla>{
	"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],		"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
Line 27:		Line 16:
	"include_fields": "id, summary, status, assigned_to"		"include_fields": "id, summary, status, assigned_to"
	}</bugzilla>		}</bugzilla>


	* Encrypted messaging		* Encrypted messaging
	** UI for controlling VPN settings (VPN)		* UI for controlling VPN settings (VPN)
	** VPN configuration importing		* VPN configuration importing


	~~'''~~Browser security features~~'''~~		=====Browser security features=====
	<bugzilla>{		<bugzilla>{
	"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],		"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
Line 41:		Line 27:
	}</bugzilla>		}</bugzilla>

			=====Plateform Security features=====
	~~'''~~Plateform Security features~~'''~~
	<bugzilla>{		<bugzilla>{
	"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],		"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
	"id": ["845191", "877541", "769183", "909498", "947897", "773117"],		"id": ["845191", "877541", "769183", "909498", "947897", "773117", "777948", "930258"],
	"include_fields": "id, summary, status, assigned_to"		"include_fields": "id, summary, status, assigned_to"
	}</bugzilla>		}</bugzilla>
			* [https://wiki.mozilla.org/Security/Sandbox Documentation about sandboxing]

	~~'''~~Improved permission management~~'''~~		=====Improved permission management=====
	<bugzilla>{		<bugzilla>{
	"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],		"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
	"id": ["961350", "910222", "943818", "967845", "970599", "1040348", "1055469"],		"id": ["961350", "910222", "943818", "967845", "970599", "1040348", "1055469", "940389"],
	"include_fields": "id, summary, status, assigned_to"		"include_fields": "id, summary, status, assigned_to"
	}</bugzilla>		}</bugzilla>
Line 84:		Line 70:

	You can help improving the Firefox OS apps ecosystem by writing or porting security-related apps on Firefox OS.		You can help improving the Firefox OS apps ecosystem by writing or porting security-related apps on Firefox OS.

	This [https://herdir.nohost.me/pad/p/appsreview etherpad] tracks the apps known to be currently available on the Marketplace.		This [https://herdir.nohost.me/pad/p/appsreview etherpad] tracks the apps known to be currently available on the Marketplace.

			TO BE ADDED: list of apps to be ported on Firefox OS

	== Doing security reviews ==		== Doing security reviews ==

Arroway: adding some bugs

2014-10-29T23:19:11Z

adding some bugs

← Older revision		Revision as of 23:19, 29 October 2014
Line 9:		Line 9:
	=== Security features list ===		=== Security features list ===
	(This list is to be validated and improved by adding a first good bugs section)		(This list is to be validated and improved by adding a first good bugs section)

			<bugzilla>{
			"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
			"id": ["777948", "930258"],
			"include_fields": "id, summary, status, assigned_to"
			}</bugzilla>

	'''Security sandbox'''		'''Security sandbox'''
Line 15:		Line 21:

	'''Improved privacy'''		'''Improved privacy'''
	* Private browsing mode
			<bugzilla>{
			"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
			"id": ["1033580", "1081731", "1085240"],
			"include_fields": "id, summary, status, assigned_to"
			}</bugzilla>


	* Encrypted messaging		* Encrypted messaging
	* OpenVPN support (currently being worked on, see {{bug\|1033580}})
	** UI for controlling VPN settings (VPN)		** UI for controlling VPN settings (VPN)
	** VPN configuration importing		** VPN configuration importing


	'''Browser security features'''		'''Browser security features'''
	* Improved SSL Support in FxOS		<bugzilla>{
	** SSL Certificate Information UI		"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
	** Provide certificate exception management		"id": ["769183", "919807", "1055426"],
	** Add SSL Certificate to cert.db {{bug\|769183}}		"include_fields": "id, summary, status, assigned_to"
			}</bugzilla>


	'''Plateform Security features'''		'''Plateform Security features'''
	* Improved process model (don’t run b2g as root) ({~~{bug\|~~845191~~}})~~		<bugzilla>{
	* Stronger passcode support {{bug\|877541}}		"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
	* Device certificate management {{bug\|769183}}		"id": ["845191", "877541", "769183", "909498", "947897", "773117"],
	* Proxy support in Firefox OS UI {{bug\|909498}}		"include_fields": "id, summary, status, assigned_to"
	* Proxy support in App Manager {{bug\|947897}}		}</bugzilla>
	* Block-listing mechanism for apps {{bug\|773117}}

	'''Improved permission management'''		'''Improved permission management'''
			<bugzilla>{
			"status": ["NEW", "UNCONFIRMED", "ASSIGNED", "REOPENED"],
			"id": ["961350", "910222", "943818", "967845", "970599", "1040348", "1055469"],
			"include_fields": "id, summary, status, assigned_to"
			}</bugzilla>
	* Global permission control for all apps and services		* Global permission control for all apps and services
	* Per permission view for permissions (e.g. which apps have access to my contacts)		* Per permission view for permissions (e.g. which apps have access to my contacts)

Arroway: fix nit

2014-10-29T22:13:57Z

fix nit

← Older revision		Revision as of 22:13, 29 October 2014
Line 1:		Line 1:
	= How to contribute to Firefox OS Security =		= How to contribute to Firefox OS Security =

	If you are willing to help making Firefox OS safer for users, there ~~are~~ are several ways to contribute:		If you are willing to help making Firefox OS safer for users, there are several ways to contribute:

	== Implementing OS features ==		== Implementing OS features ==
Line 41:		Line 41:

	=== Good practices for contributing ===		=== Good practices for contributing ===
	For your contribution work to be successful, it is essential you ~~follows~~ some good practices:		For your contribution work to be successful, it is essential you follow some good practices:

	'''Get in touch with us early'''		'''Get in touch with us early'''

	Let us know you're starting to work on a feature. Depending on its size, implementing a security feature usually involve important designing decisions which ~~has~~ to be worked on with several teams: platform, Gaia, UX, security. It is also the perfect way to know if other people are working on similar or related features.		Let us know you're starting to work on a feature. Depending on its size, implementing a security feature usually involve important designing decisions which have to be worked on with several teams: platform, Gaia, UX, security. It is also the perfect way to know if other people are working on similar or related features.
	You can start by contacting us, we will help you get in touch with the right people:		You can start by contacting us, we will help you get in touch with the right people:
	* IRC channel #FxOSSec on irc.mozilla.org		* IRC channel #FxOSSec on irc.mozilla.org

Arroway: add security features list

2014-10-29T18:22:58Z

add security features list

@@ Line 5: / Line 5: @@
 == Implementing OS features ==
-The Firefox Os Security team is tracking a list of security-related features.
+The Firefox Os Security team is tracking a list of security-related features to be explored or implemented.
-These are first good bugs to start with: (TODO)
 === Good practices for contributing ===

Arroway: add good practices section

2014-10-29T18:08:41Z

add good practices section

← Older revision		Revision as of 18:08, 29 October 2014
Line 13:		Line 13:
	'''Get in touch with us early'''		'''Get in touch with us early'''

	Let us know you're starting to work on a feature. Depending on its size, implementing a security feature usually involve important designing decisions which has to be worked on with several teams: platform, Gaia, UX, security.		Let us know you're starting to work on a feature. Depending on its size, implementing a security feature usually involve important designing decisions which has to be worked on with several teams: platform, Gaia, UX, security. It is also the perfect way to know if other people are working on similar or related features.
	You can start by contacting us, we will help you get in touch with the right people:		You can start by contacting us, we will help you get in touch with the right people:
	* IRC channel #FxOSSec on irc.mozilla.org		* IRC channel #FxOSSec on irc.mozilla.org
Line 21:		Line 21:
	* on [https://bugzilla.mozilla.org/ Bugzilla] if the feature already has a bug ticket open.		* on [https://bugzilla.mozilla.org/ Bugzilla] if the feature already has a bug ticket open.
	* on the [https://lists.mozilla.org/listinfo/dev-b2g dev-b2g] and [https://lists.mozilla.org/listinfo/dev-gaia dev-gaia] mailing lists		* on the [https://lists.mozilla.org/listinfo/dev-b2g dev-b2g] and [https://lists.mozilla.org/listinfo/dev-gaia dev-gaia] mailing lists

			''' Learn how to use Bugzilla '''

			You'll find plenty of useful resources on [https://developer.mozilla.org/en-US/docs/Mozilla/Bugzilla MDN], especially about [https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/How_to_Submit_a_Patch how to submit a patch].

			'''Ask for feedback early'''

			It is recommended you ask for feedback early, if possible as soon as you have a working prototype (you can use the "feedback" tag on Bugzilla). This will enable you to make sure everybody (UX, OS, security people) is aware and agrees on the direction you're taking with your implementation, and you'll possibly receive good advice for the remaining implementation work.

	== Writing security web apps ==		== Writing security web apps ==