Confirmed users
908
edits
SecurityEngineering: Difference between revisions
→Experimental Things: containers are no longer experimental
(→How We Work: link to Q2 goals) |
(→Experimental Things: containers are no longer experimental) |
||
| (43 intermediate revisions by 9 users not shown) | |||
| Line 7: | Line 7: | ||
==Who is involved== | ==Who is involved== | ||
Security Engineering is led by | Security Engineering is led by Wennie Leung. Work is divided between these main teams: | ||
* Privacy and Security Engineering: website & browser security features ([[Security/Contextual_Identity_Project/Containers|Containers]], [[CloudServices/Password_Manager|Password Manager]], etc.), DOM security ([[Security/CSP|CSP]], [[Security/Subresource_Integrity|SRI]], Cookies, [[Security/Features/Mixed_Content_Blocker|Mixed Content Blocking]], origin, etc), Content Blocking ([[Security/Safe Browsing|Safe Browsing]], [[Security/Application_Reputation|Download Protection]] and [[Security/Tracking_protection|Tracking Protection]]), [[Security/Features/Revamp_Security_Hooks|revamp of security hooks]], [[Security/Tor_Uplift/Tracking|Tor Uplift]] and [[Security/Sandbox/Hardening|Sandbox Hardening]]. | |||
* [[Security/CryptoEngineering|Communications security]] (Lead:[https://mozillians.org/en-US/u/jcjones/ JC Jones]): TLS stack, communications security, WebCrypto, [[PSM:Topics|PSM]], [[NSS]], [[SecurityEngineering/TLS_Error_Reports|Error Reporting]] and OneCRL | |||
* Defensive Security Engineering (Lead: Tom Ritter): implementing changes to Firefox that improve our security posture. | |||
* [[CA:Overview|Mozilla's CA Certificate Program]] (Program Manager: [https://mozillians.org/en-US/u/kwilson/ Kathleen Wilson]) | |||
To connect with us directly, you can our contact details on [https://mozillians.org/en-US/group/securityengineeringstaff/ Mozillians]. | |||
==How We Work== | ==How We Work== | ||
| Line 18: | Line 24: | ||
* Evangelize what we do | * Evangelize what we do | ||
For more details, check out our [[SecurityEngineering/Strategy|strategy | For more details, check out our [[SecurityEngineering/Strategy|strategy]]. | ||
== | ==What we work on== | ||
The core security guarantee of the web is that it’s safe to browse. You can run a web browser and connect to any web server on the planet, and whatever that server sends you, it won’t be able to harm you. | |||
Delivering on this promise requires many layers of assurance: | |||
* That the browser itself is safe to run -- that no malicious code has been introduced, and that we find and fix vulnerabilities before they can be exploited. | |||
* That the browser is protecting web content as it’s delivered over the network. | |||
* That that web content is forced to play by our rules, including assuring that privacy-sensitive actions that web pages take are gated on a user’s permission. | |||
* That we’re providing a user experience that helps people understand the risks and how they can stay safe. | |||
For details of our projects in these four areas, see the [[Security/Roadmap|security roadmap]]. | |||
==How to participate== | ==How to participate== | ||
'''Discuss:''' We hang out on #security on [http://irc.mozilla.org irc.mozilla.org], and our primary mailing list is mozilla.dev | '''Discuss:''' We hang out on #security and #contentsecurity on [http://irc.mozilla.org irc.mozilla.org], and our primary mailing list is [https://www.mozilla.org/en-US/about/forums/#dev-security mozilla.dev.security]. | ||
'''Follow our work:''' To see our current progress against features please see the [https://blog.mozilla.org/security/ Mozilla Security Blog]. | '''Follow our work:''' To see our current progress against features please see the [https://blog.mozilla.org/security/ Mozilla Security Blog]. | ||
'''Contribute:''' Wanna pitch in, maybe do a project? Check out the [https://bugzil.la/sw:%5Bgood%20first%20bug%5D%20security good first bugs list] and if one interests you, contact us! | |||
'''Contribute:''' Wanna pitch in, maybe do a project? Check out | |||
== Experimental Things == | == Experimental Things == | ||
| Line 69: | Line 48: | ||
We have a few feature proposals for things we might want to add to Firefox but that aren't currently scheduled: | We have a few feature proposals for things we might want to add to Firefox but that aren't currently scheduled: | ||
* [[Security/Foreign_Certificate_Warning|Foreign Certificate Warning]] | * [[Security/Foreign_Certificate_Warning|Foreign Certificate Warning]] | ||
* [[CloudServices/Password_Manager/Master_Password|Master Password]] in the Password Manager | * [[CloudServices/Password_Manager/Master_Password|Master Password]] in the Password Manager | ||
* [[Security/ | * [[Security/Automatic_Private_Browsing_Upgrades|Automatic Private Browsing Upgrades]] | ||
==Security Bugs== | ==Security Bugs== | ||
If you've found a security bug please see http://www.mozilla.org/security/#For_Developers | If you've found a security bug please see http://www.mozilla.org/security/#For_Developers | ||