Search by property
This page provides a simple browsing interface for finding entities described by a property and a named value. Other available search interfaces include the page property search, and the ask query builder.
List of results
- Security/Reviews/ChicagoSummerLearning + ( * chris :: add persona-auth to demo/ :: xx )
- Security/AppsProject/IdentityKPIBackend + ( * code review of JS (when ready) * code review of WebService API (when ready) )
- Security/Reviews/Accounts Sync + (
* grant jeff (jbryner@mozilla.com) and ul … * grant jeff (jbryner@mozilla.com) and ulfr (jvehent@mozilla.com) access to 'fraud and abuse' etherpad mentioned in the wiki: https://id.etherpad.mozilla.org/fxacct-metrics-fraud-detection * Schedule Op meeting for fxa * Schedule auth-server discussion with dcoates ** Schedule reviews for auth / cloud, desktop, fxos, android, attached services (end of q1 target) Fraud and abuse meta issue: https://github.com/mozilla/fxa-auth-server/issues/222 ==OPSEC== Threat mapping What would you say are the 2-3 security/intrusion scenarios we should focus on How would you like to respond to those scenarios: --Contain and clear an intrusion --Detect and Deter active attempts --Pursue and Prosecute attackers --(Combination of any/all of the above)--(Combination of any/all of the above) )
- Security/Reviews/PersonaRealms + ( * technical privacy review * privacy review * server for test environment )
- Security/Reviews/bug588270 + ( * user study on how users percieve the UI in this model (future, not for this bug/review) -- does this UI change alter how they perceive the security of a site )
- Security/Reviews/ClickToPlay + (
*Keeler::ability to differentiate plugins … *Keeler::ability to differentiate plugins in persisted permissions :: https://bugzilla.mozilla.org/show_bug.cgi?id=746374 ::FF19? *Keeler::differentiate regular click-to-play permissions from blocklisted click-to-play permissions::before regular click-to-play gets its own UI to enable itclick-to-play gets its own UI to enable it )
- Security/Reviews/Audio Recording - Web API + (- Pauljt::determine the threat model for W … - Pauljt::determine the threat model for WebRTC:: - Cdiehl::fuzz this API - Pauljt::Tainting audio/video elements with cross-origin audio data, so that this API fails in such cases. (ie web page should not be able to access the contents of cross-origin resources)ss the contents of cross-origin resources))
- Security/Reviews/BZBrowserID + (<table border="1">
<tr>
<t … <td>[http://identity.mozilla.com/post/18038609895/introducing-mozilla-persona not needed]</td> </tr> <tr> <td>Gerv</td> <td>Create nobrowserid group and put relevant groups in it - all security, HR, legal </td> <td> </td> <td><span style="color: green; font-size: 80%; font-weight: bold">[DONE]</span> Done</td> </tr> </table>)
Who Action By When Completed date [NEW] new [DONE] Done [MISSED] Miss Gerv Update code to check for absence of "nobrowserid" group [DONE] Done (http://bzr.mozilla.org/bugzilla/extensions/browserid/trunk/revision/8) Gerv File bug on full verifier support (non blocker) [DONE] Done - [https://bugzilla.mozilla.org/show_bug.cgi?id=737480 bug 737480] Gerv At appropriate moment, rename any UI elements to new branding [http://identity.mozilla.com/post/18038609895/introducing-mozilla-persona not needed] Gerv Create nobrowserid group and put relevant groups in it - all security, HR, legal [DONE] Done - Security/Reviews/Marionette + (<table border="1">
<tr>
<td … ot be changed by adding a pref listener, and can only be enabled in prefs.js </td><td>before code migrates to aurora</td><td><span style="color: green; font-size: 80%; font-weight: bold">[DONE]</span> complete 2012-02-15</td> </tr> </table>)
Who Action By When Completed date [NEW] new [DONE] Done [MISSED] Miss marionette team [https://bugzilla.mozilla.org/show_bug.cgi?id=741812 bug 741812] add verificaiton checking for AMO reivewers before code migrates to aurora [DONE] 2012-04-03 marionette team [https://bugzilla.mozilla.org/show_bug.cgi?id=741813 bug 741813] prevent the default startup pref so it cannot be changed by adding a pref listener, and can only be enabled in prefs.js before code migrates to aurora [DONE] complete 2012-02-15 - Security/Reviews/PerWindowPrivateBrowsing + (<table border="1">
<tr>
<td … ;<td>before code migrates to aurora</td><td><span style="color: green; font-size: 80%; font-weight: bold">[DONE]</span> 2012.03.10</td> </tr> </table>)
Who Action By When Completed date jdm ehsan [https://bugzilla.mozilla.org/show_bug.cgi?id=740832 bug 740832][https://bugzilla.mozilla.org/show_bug.cgi?id=729706 bug 729706]Do workers get the right load context for cookies? before code migrates to aurora [DONE] 2012.03.10 - Security/Reviews/CleanUpUserProfile + (<table border="1">
<tr>
<td … ndle this? Do they delete the old profile? * IE does not support profiles, if you reinstall it over-writes - They support irreversible [http://windows.microsoft.com/en-US/windows7/Reset-Internet-Explorer-settings-in-Internet-Explorer-9 reset in IE 9] though)
'''For the other non-action items: Sync is being tracked in bug 725904. Bug 731047 tracks cleaning up the old profile.''' Not sure what the plan is for add-ons (plugins, extensions, themes). They would be disabled, but we might not migrate. Also questions on how that would work with sync. Is there anyway to get to the profile manager for someone who has no idea how to use the command line? How do other browsers handle this? Do they delete the old profile? * IE does not support profiles, if you reinstall it over-writes - They support irreversible [http://windows.microsoft.com/en-US/windows7/Reset-Internet-Explorer-settings-in-Internet-Explorer-9 reset in IE 9] thoughWho Action By When Completed date mnoorenberghe Followup - what's in the cert8.db? We won't be migrating those. '''It does include certificate additions and revocation of trust so it's safer IMO to not migrate since that is closest to our fresh install''' before code migrates to aurora [DONE] 2012.03.05 mnoorenberghe check on migration of DNT pref, master password '''we're not going to migrate any prefs. Master password is migrated properly: the pref UI is not tied to a pref.''' before code migrates to aurora [DONE] 2012.03.05 - Security/Reviews/BackGroundUpdates + (<table> <tr> <td>Who</td> <td>What</td> <td>By When</td> <td>completed Y/N</td> </tr> <tr> <td>imelven</td> <td>review wiki page</td> <td>13-Jan-2012</td> <td>y</td> </tr> </table>)
- Security/Reviews/Telemetry Experiments r1 + (Who :: What :: By When * benjamin :: make call on cert pinning direction, talk to Camilo Viecco (cviecco) :: before shipping * benjamin :: file bug to annotate crash reporter if experiment is enabled)
- Security/Reviews/WebActivities + (`)
- Security/AppsProject/LightningNightlyPHP + (`)
- Security/AppsProject/Element.mozRequestFullscreenWithKeys + (`)
- Security/Reviews/ModuleLoader + (`)
- Security/Reviews/Push API + (`)
- Security/Reviews/Shumway + (`)
- Security/Reviews/MobileJavaAddOns + (`)
- Security/Reviews/ExitFullScreenFocusChange + (`)
- MoPal + (`)
- Security/Reviews/B2G/mozapp + (`)
- Security/Reviews/SocialShare + (`)
- Security/Reviews/TelemetryServer + (`)
- Security/Reviews/SimplePushSrv + (`)
- Security/Reviews/APK Factory + (`)
- Security/Reviews/BZ Elastic Search + (`)
- Security/Reviews/TreeHerder + (`)
