Confirmed users
717
edits
SecurityEngineering/Roadmap: Difference between revisions
m
→Ideas Not Yet Awesome Enough
mNo edit summary |
|||
| Line 62: | Line 62: | ||
{|class=wikitable | {|class=wikitable | ||
|- | |- | ||
! Item | ! Item | ||
! Status | ! Status | ||
| Line 68: | Line 67: | ||
! Owner | ! Owner | ||
|- | |- | ||
| [https://wiki.mozilla.org/NPAPI:Pepper2 Plugin sandboxing]<br> | | [https://wiki.mozilla.org/NPAPI:Pepper2 Plugin sandboxing]<br> | ||
| not started | | not started | ||
| Line 74: | Line 72: | ||
| ? | | ? | ||
|- | |- | ||
| [https://groups.google.com/group/mozilla.dev.security/browse_thread/thread/f8afac1eef7cb4cd/b570280627c3dca8 Effective certificate revocation and management]<br> | | [https://groups.google.com/group/mozilla.dev.security/browse_thread/thread/f8afac1eef7cb4cd/b570280627c3dca8 Effective certificate revocation and management]<br> | ||
| not started | | not started | ||
| Line 80: | Line 77: | ||
| ? | | ? | ||
|- | |- | ||
| [https://wiki.mozilla.org/Opt-in_activation_for_plugins Plugin runtime mitigations such as whitelist and/or click to ]<br> | | [https://wiki.mozilla.org/Opt-in_activation_for_plugins Plugin runtime mitigations such as whitelist and/or click to ]<br> | ||
| not started | | not started | ||
| Line 86: | Line 82: | ||
| Justin Dolske | | Justin Dolske | ||
|- | |- | ||
| javascript: and data: handling in URL bar and chrome | | javascript: and data: handling in URL bar and chrome | ||
| <br> | | <br> | ||
| Line 92: | Line 87: | ||
| <br> | | <br> | ||
|- | |- | ||
| DLL whitelisting by name or signature<br> | | DLL whitelisting by name or signature<br> | ||
| not started<br> | | not started<br> | ||
| Line 98: | Line 92: | ||
| ?<br> | | ?<br> | ||
|- | |- | ||
| Track "Application Reputation"<br> | | Track "Application Reputation"<br> | ||
| <br> | | <br> | ||
| Line 104: | Line 97: | ||
| <br> | | <br> | ||
|- | |- | ||
| Prune dead and dying code<br> | | Prune dead and dying code<br> | ||
| <br> | | <br> | ||
| Line 110: | Line 102: | ||
| <br> | | <br> | ||
|- | |- | ||
| Malloc should be infallible<br> | | Malloc should be infallible<br> | ||
| <br> | | <br> | ||
| Line 116: | Line 107: | ||
| <br> | | <br> | ||
|- | |- | ||
| TLS 1.2 support<br> | | TLS 1.2 support<br> | ||
| <br> | | <br> | ||
| Line 122: | Line 112: | ||
| <br> | | <br> | ||
|- | |- | ||
| Eviltraps meta-bug (prevents users from leaving a page)<br> | | Eviltraps meta-bug (prevents users from leaving a page)<br> | ||
| <br> | | <br> | ||
| Line 128: | Line 117: | ||
| <br> | | <br> | ||
|- | |- | ||
| Notify user of malware in their crash signatures<br> | | Notify user of malware in their crash signatures<br> | ||
| <br> | | <br> | ||
| Line 134: | Line 122: | ||
| <br> | | <br> | ||
|- | |- | ||
| Expose HSTS and other security browser state to plugins (NPAPI)<br> | | Expose HSTS and other security browser state to plugins (NPAPI)<br> | ||
| <br> | | <br> | ||
| Line 140: | Line 127: | ||
| <br> | | <br> | ||
|- | |- | ||
| Ignore autocomplete="off" for password fields | | Ignore autocomplete="off" for password fields | ||
| <br> | | <br> | ||
| Line 146: | Line 132: | ||
| <br> | | <br> | ||
|- | |- | ||
| UX security experiment | | UX security experiment | ||
| not started | | not started | ||
| Line 152: | Line 137: | ||
| ? | | ? | ||
|- | |- | ||
| [https://bugzilla.mozilla.org/show_bug.cgi?id=663566 Content Security Policy revisions] | | [https://bugzilla.mozilla.org/show_bug.cgi?id=663566 Content Security Policy revisions] | ||
| In progress | | In progress | ||
| Line 158: | Line 142: | ||
| Brandon Sterne | | Brandon Sterne | ||
|- | |- | ||
| CSRF mitigations | | CSRF mitigations | ||
| <br> | | <br> | ||
| Line 164: | Line 147: | ||
| <br> | | <br> | ||
|- | |- | ||
| Clickjacking mitigations | | Clickjacking mitigations | ||
| | | | ||
| Line 170: | Line 152: | ||
| | | | ||
|- | |- | ||
| X-Content-Type-Options | | X-Content-Type-Options | ||
| | | | ||
| Line 176: | Line 157: | ||
| | | | ||
|- | |- | ||
| toStaticHTML | | toStaticHTML | ||
| | | | ||