964451 - Access to security bug denied to me

Status: RESOLVED FIXED

(mozilla.org :: Governance, task)

Description

[Ben Bucksch (:BenB)]

I'm a founding member of the security group and need access to all Mozilla security bugs, without exception. Bug 700979 is supposedly a Thunderbird security bug, but I am denied access. Please ensure that I can access all security bugs.

Thank you.

(A critical part of my role is to ensure good government of security bugs, which requires that I see everything without exception.)

(FWIW, once granted access, I will remove the embargo on that particular bug, because it was publicly reported about by a news site.)

Comment 1

[Reed Loden [:reed]]

You really haven't read your s-g mail lately, then have you? Bugs are getting restricted to sub groups that actually need access to them. See https://securitywiki.mozilla.org/Client_Security_Teams. Specifically, bug 700979 falls under the mail security team.

I've unhidden the bug, but marking this WFM, as the reason for you not accessing the bug is fine.

Comment 2

[Ben Bucksch (:BenB)]

Hey reed, I've read discussions about it, and I can see the rational behind it, but I have consistently asked to be given access to all of the groups. It's important that there is oversight from people outside the Mozilla employees, to ensure that mozilla.org treats these security bugs properly - both procedurally and quantitatively. One important purpose for my membership - since the very beginning - is exactly that.

I think I have earned this trust, too. I've been there since the very creation of this security group, and the formulation of its guiding principles.

I can only fulfill this role when granted access to all bugs.

I've assigned this to dveditz, because a) he's the head of security and b) I believe that he understands where I am coming from.

Comment 3

[Ben Bucksch (:BenB)]

Based on https://securitywiki.mozilla.org/Client_Security_Teams , it seems like the "Client Security Triage Team" seems like the right bucket to me.

Comment 4

[Ben Bucksch (:BenB)]

FWIW, I rigorously manage my client security, much more even than most developers.

Comment 5

[Reed Loden [:reed]]

We don't track this stuff in Bugzilla. If you have an issue, e-mail dveditz directly.

Comment 6

[Ben Bucksch (:BenB)]

I seem to have access to Security-Core again, e.g. to bug 1012694. Thanks a lot! This is a big relieve for me.