276503 - New security group: update-security

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect, P3)

Description

[alanjstr]

Please create a subset group of webtools-security (if possible) for security
bugs that we can use for the Update product.  Please include the people on the
initial CC list, myself, and whomever from server ops is necessary.

Comment 1

[Dave Miller [:justdave]]

OK, this is partially completed.

The update-security group has been created, and the people on the initial list
here have been added to it.  cbeard has been given bless rights to it, so he can
add and remove people if needed.

The existing bugs in the Update product have been moved from the
webtools-security group to update-security.

What's remaining to be done is to hack the new bug submission form so that bugs
with the "This is a security-sensitive issue" checkbox checked that are filed
into the Update product set the group to update-security intead of webtools-security

Comment 2

[lists.john]

Could we _PLEASE_ have a list of security flaws for current iterations of FF as
promised http://www.mozilla.org/projects/security/known-vulnerabilities.html

"This page will contain a list of the security vulnerabilities known to affect
particular versions of Mozilla products and instructions on what users can do to
protect themselves. The list will be added to when new security problems are found."

They should be listed here, we shouldn't have to hunt for them.

Security by obscurity is complete **** and doesn't befit a project of this calaber. 

I can't figure out where I should send requests like this so I hope this group
can't make it happen, someone can.

Comment 3

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Please don't add unrelated comments to random bugs.

Comment 4

[Dave Miller [:justdave]]

This will be fixed after tonight's upgrade.