SecurityEngineering/MeetingNotes/09-26-13

From MozillaWiki
Jump to: navigation, search

Agenda 26-Sep-2013

  • Q3 Goals Recap
  • Anything we need to talk about for summit?
    • Session plan? (runthrough with co-located facilitators)
  • Q4 Goals
    • This time: two people (at least) per goal to provide peer support and reviews. We are committing to get all this done, and may work on other stuff too, but this is our main focus
    • Sandbox
      • Chromium-sandbox: make it possible to compile and activate c-s on mozilla-central (win) - [brian + keeler +christoph]
      • gpu-remoting plan [christoph + sid]
      • Get security feature tests (CSP, HSTS, window.crypto) passing in e10s (with platform team - on b2g) [garrett + sid + mwobensmith]
    • Roadmap & user data storage plan
      • security, privacy, anonymity (tor) roadmaps update and brown-bag scheduled [monica + sid]
      • multi-stakeholder plan for unified storage/prefs so that our tracking story is not full of holes? [moniica + garrett + cviecco]
    • NetSec
      • TLS 1.2 enabled on nightly - server intolerance + telemetry [cviecco+ brian]

dissertation [christoph + ??? + coffee = profit]

    • Mixed Content [tanvi + christoph]
      • redirect bug - bug 418354
      • don't show mixed content on http pages - bug 909920 (may require content policy api changes)
      • missing notification - bug 915951
      • target = _parent - bug 906219
    • CSP - script nonce and hash (behind a pref) [garrett + sid]

From previous meeting: - Initial Q4 goal brainstorm

  • Sandboxing
    • Import chromium-sandbox
    • GPU remoting plan/work starting
    • Multiprocess observer service - is this still needed? Investigation ongoing
    • Goal around summit-obtained unity around the project
  • NetSec
    • Certificate pinning (list- and header-based)
    • Cert error reporting including better error messages
    • Something around CT and/or TACK? (no, no time)
    • Conduct summit session on "securing yer server with SSL"?
    • Ship tls 1.2
  • Privacy
    • Referrer controls (meta referrer etc)
    • Something around tor cooperation
  • We are hiring: https://careers.mozilla.org/en-US/position/oG3PXfwf , https://careers.mozilla.org/en-US/position/oC3PXfwb
  • Platform workweek coming in Q1
  • Content Policy API
  • On interviewing, this was interesting: https://etherpad.mozilla.org/metro-phone-screens

Q3 Goals

  • [ON TRACK] Finish first phase of Sandboxing
    • Outcome: seccomp in e10s/Larch or on nightly + clear roadmap
    • DRI: Sid
      • Consult : E10S contributions to make it reasonably usable in nightly. (without extensions/plugins) assign: ALL as appropriate
      • Implement : [NEW] Fix window.crypto to work in E10S}
      • Implement : [DROPPED] Fix CSP tests to work in E10S garrett + sid - prepped, but for Q4
      • Implement : [DONE] land seccomp for Linux (min bar for sandboxing) keeler -

bug 914716

      • Research : [AT RISK] Prioritize secomp tightening steps, begin executing it sid
      • Research : [ON TRACK] Create story/plan for addon compatibility monica
  • [DONE] Cookie Clearinghouse
  • [AT RISK] Implement alternative revocation checking mechanisms
    • Outcome: must-staple + pinning + insanity on by default in nightly
    • DRI: Camilo
    • Tasks:
      • Implement : [MISSED] Enable insanity::pkix validation by default on nightly - landing some next week (9/16)
      • Implement : [DROPPED] Land key pinning
      • Implement : [MISSED] Land must-staple support
  • [ON TRACK] SafeBrowsing 2.0
    • Outcome: App reputation whitelist on by default in nightly
    • DRI: Monica
    • Tasks:
      • Implement : [ON TRACK] Land app reputation system with whitelist support bug 904607,...
Retrieved from "https://wiki.mozilla.org/index.php?title=SecurityEngineering/MeetingNotes/09-26-13&oldid=716632"