SecurityEngineering/MeetingNotes/06-20-13
Standing Agenda
- Q2 Goals Recap ( https://intranet.mozilla.org/2013Q2Goals#Security_Engineering )
- Review roadmap priorities to ensure they accurately reflect active projects and Mozilla's priorities
- Suggest additions or changes to roadmaps
- Detailed discussion of features or outstanding issues as time permits
- Additional Items
- Upcoming events, OOO/travel, etc.
Last week: https://wiki.mozilla.org/SecurityEngineering/MeetingNotes/06-06-13
Q2 Goals
- [ON TRACK] land the application reputation scanning tool bug 662819 (mmc)
- [DONE] Turn Mixed Content Blocking on in Aurora (tanvi)
https://bugzilla.mozilla.org/show_bug.cgi?id=843977
https://bugzilla.mozilla.org/show_bug.cgi?id=844556
https://bugzilla.mozilla.org/show_bug.cgi?id=843977
Telemetry : https://bugzilla.mozilla.org/show_bug.cgi?id=781018
- [ON TRACK] land classic cert validation replacement, off by default (bsmith) builds on all platforms, same revovation as classic, pending tests for edge case certtificates (certificate usages & chain building).
https://bugzilla.mozilla.org/show_bug.cgi?id=878932
- [ON TRACK] land OCSP stapling support and tests (keeler)
https://bugzilla.mozilla.org/show_bug.cgi?id=700693
- [ON TRACK] Revamp the MDN documentation of CSP and Mixed Content Blocker (imelven + tanvi)
- [ON TRACK] Develop & socialize plan (document containing steps, timeline, implementation & test plan) for getting sandboxing onto a desktop Firefox, probably Linux (imelven)
- https://wiki.mozilla.org/Electrolysis/Roadmap
https://bugzilla.mozilla.org/show_bug.cgi?id=790923
- [ON TRACK] Deploy pilot cookie study and publish results. (ddahl)
Agenda
- Ivan wants to say something before we start : better communication around what we're doing and links to bugs/feature pages etc that provide background etc. - follow people on bugzilla
- Rapid Q2 Goals Recap
- Platform meeting [ian] - Tuesdays 11am PST
- Training - please review the slides !
- Take a look at Agenda for next week (https://l33t.etherpad.mozilla.org/20 )
- e10s roadmap concerns
more bugs: TLS Bugs: (gracefully degrade from TLS 1.1 -> TLS 1.0 -> SSL 3.0) https://bugzilla.mozilla.org/show_bug.cgi?id=733647 https://bugzilla.mozilla.org/show_bug.cgi?id=839310 DTLS Bug(s): (interesting 'cause it will force you to read the DTLS spec) https://bugzilla.mozilla.org/show_bug.cgi?id=882310 JavaScript Crypto Bugs: (turns out the crypto in JS stuff is not that difficult to grok) https://bugzilla.mozilla.org/show_bug.cgi?id=849553 NSS is sometimes not your friend Bugs (nss does weird things when shutting down) https://bugzilla.mozilla.org/show_bug.cgi?id=675260 https://bugzilla.mozilla.org/show_bug.cgi?id=700499 https://bugzilla.mozilla.org/show_bug.cgi?id=700499