1201025 - Disable fallback whitelist by default, in all releases

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Masatoshi Kimura [:emk]]

See https://groups.google.com/d/msg/mozilla.dev.platform/JIEFcrGhqSM/CIjtpwxoLQAJ about the schedule.

Comment 1

[Masatoshi Kimura [:emk]]

Attachment: Disable fallback whitelist by default

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8655960 [details] [diff] [review]
Disable fallback whitelist by default

Review of attachment 8655960 [details] [diff] [review]:
-----------------------------------------------------------------

This patch is correct, but it looks like the timing has changed somewhat. The UX we need for this to succeed isn't in place yet. Hopefully it will land in 44, but in any case I think we still want a release with that UX and the whitelist enabled before we disable it (see also bug 1207257). That means this probably shouldn't land until 45. Let's revisit this when we have the UX.

Comment 3

[Masatoshi Kimura [:emk]]

We have to talk other vendors to delay the schedule.

Comment 4

[Masatoshi Kimura [:emk]]

Comment on attachment 8655960 [details] [diff] [review]
Disable fallback whitelist by default

Now we have a UX.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8655960 [details] [diff] [review]
Disable fallback whitelist by default

Review of attachment 8655960 [details] [diff] [review]:
-----------------------------------------------------------------

Great!

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/481e1b42d886

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/481e1b42d886

Comment 8

[Kohei Yoshino [:kohei]]

Added the site compatibility doc: https://www.fxsitecompat.com/en-US/docs/2015/rc4-is-now-completely-disabled-by-default/

Comment 9

[Jean-Yves Perrier [:teoli]]

Added a note: https://developer.mozilla.org/en-US/Firefox/Releases/44#Security