SecurityEngineering/2014/Q2Goals

This is a heavy-Implement quarter (as opposed to the other strategic actions in our SecurityEngineering/Strategy).

Web Platform Security

Outcome: Faster, more correct web platform security feature/tool roll-out (plus, easier maintenance!)
Who: tanvi, ckerschb, grobinson, sstamm, rbarnes

[DONE] Consult/Research: plan out replacement for nsIContentPolicy and start executing (the Sicking project) [dri=tanvi, a=ckerschb] Try Run
[DONE] Implement: Make new CSP parser on by default in nightly bug 925004 [dri=ckerschb, a=grobinson,sstamm]
[DONE] Implement: Land WebCrypto [dri=rbarnes] bug 865789

Outcome: incremental progress towards containing unprivileged code to mimize risk due to vulnerabilities
Who: bobowen, sstamm, tabraldes

[MISSED] Get open.h264 plugin sandboxed on windows [dri=sstamm, a=tabraldes] (not done with reviews, close)
[DROPPED] Get some tests on TBPL running with sandbox [dri=bobowen, a=sstamm,tabraldes] (Dropped due to complications in getting even e10s in windows running on TBPL, in favor of warn-only mode goal below)
[MISSED] Create warn-only mode for sandbox in windows builds so developers can see what *will* break before it does [dri=bobowen, a=sstamm] (needs review and landing, close)

Outcome: More correct cert validation and way to detect MITM of at least one site (via pinning)
Who: keeler, cviecco, mmc, kathleen

[DONE] Land key pinning [dri=cviecco, a=keeler,mmc]
- Landed, on by default (no sites are in "test-telemetry" mode). Working on enabling more sites next.
- See dashboard: http://people.mozilla.org/~mchew/pinning_dashboard/
[DONE] mozilla::pkix on by default, (riding the train to) / (targeting a) release [dri=keeler, a=cviecco]
[DEFER] BONUS (not required): Deploy UI for cert error reporting [dri=grobinson] bug 846489
- at risk due no engineer to work on it -- Updated Privacy Policy was published! (http://www.mozilla.org/en-US/privacy/firefox/), unfortunately some links incorrect bug 1006204
- Made tons of progress

[MISSED] Get through the next 2 releases (1.0.10 (released) and 1.0.11) of Lightbeam: https://github.com/mozilla/lightbeam/issues/milestones towards the goal of conducting a small user study on tracking protection [dri=mmc, a=grobinson]