SecurityEngineering: Difference between revisions

Revision as of 03:29, 14 April 2015

We build security and user sovereignty into Firefox. Through this work, we encourage and promote these values on the open web.

We focus hard on ways to improve the privacy and security of all web users, in a Mozilla way that engages the community in our design and implementation decisions. These priorities are reflected in the projects this team manages, public evangelism and participation in relevant standards bodies to maximize adoption of new privacy & security mechanisms.

The open web is powerful; the huge number of people working on web standards and software is astonishing, and the rapid advancement of new businesses and technologies online magnifies the need for advances in mechanisms that enable secure systems and users' control over their presence online.

Who is involved

Security Engineering is led by Richard Barnes and Steve Workman, and mainly driven by Mark Goodwin, JC Jones, Kamil Jozwiak, David Keeler, Christoph Kerschbaumer, Francois Marier, Bob Owen, Sid Stamm, Daniel Veditz, Tanvi Vyas, Matt Wobensmith and Kathleen Wilson.

How We Work

The Security Engineering team works publicly like other Mozilla engineering teams. Continuously, we are focused on four top-level activities:

Implement and Deploy
Consult on Architecture and Design
Research new Ideas
Evangelize what we do

For more details, check out our strategy and 2015 Q2 Goals.

Major Efforts

Tracking Protection	Francois Marier
Safe Browsing and Application Reputation	Francois Marier
Sandboxing	Bob Owen
Mixed Content Blocking	Tanvi Vyas
Content Security Policy	Christoph Kerschbaumer and Sid Stamm
Revamp of Security Hooks	Christoph Kerschbaumer
Meta Referrer	Sid Stamm
Sub-resource Integrity	Francois Marier
Password Manager	Tanvi Vyas
Add-on signing	Daniel Veditz

How to participate

Discuss: We hang out on #security on irc.mozilla.org, and our primary mailing list is mozilla.dev.security.

Follow our work: To see our current progress against features please see the Mozilla Security Blog.

Do some reviews:

Contribute: Wanna pitch in, maybe do a project? Check out SecurityEngineering/Projects or the good first bugs list and if one interests you, contact us!

Experimental Things

We have a few feature proposals for things we might want to add to Firefox but that aren't currently scheduled:

Contextual Identity
Foreign Certificate Warning
Master Password in the Password Manager
Containers, private sessions and user profiles

From time to time we make add-ons to try out experimental features. Here are a few; let us know what you think!

Security Bugs

If you've found a security bug please see http://www.mozilla.org/security/#For_Developers

@@ Line 55: / Line 55: @@
 ==How to participate==
-'''Discuss:''' We hang out on #security on [http://irc.mozilla.org irc.mozilla.org], and our primary mailing list is mozilla.dev.security.  Milestone reviews and other meetings will be announced on mozilla.dev.security.
+'''Discuss:''' We hang out on #security on [http://irc.mozilla.org irc.mozilla.org], and our primary mailing list is [https://www.mozilla.org/en-US/about/forums/#dev-security mozilla.dev.security].
 '''Follow our work:''' To see our current progress against features please see the [https://blog.mozilla.org/security/ Mozilla Security Blog].