551745 - things needed to avoid leaking of security patches and tipping our hand to evil doers prematurely.

Status: RESOLVED DUPLICATE of bug 1136954

(Firefox :: Security, defect)

Description

[chris hofmann]

malware developers have the ability to watch our source file checkins and get a head start in creating exploits before before the patches are released in maintenece releases.   a paper released summer 2010 will outline steps to identify security patches sooner and weed out security problems from the high volume of general patches landing on the trunk.  We need a better system for keeping the patches hidden while making progress on review and testing, then manage risk and reduce exposure time during public beta testing and deployment to the geneneral firefox user base.

this is a tracking bug for all the pieces needed to improve security patch hiding, increase testing while the patches are under development, and reduce pre-release risk and exposure time.

Comment 1

[chris hofmann]

more details on the overall plan are at https://securitywiki.mozilla.org/SourceLeakRiskReductionPlan

Comment 2

[chris hofmann]

we will need to complete all  the dependency bugs by the end of q2 to stay ahead of the release of the research paper, so this needs to get good attention in q2 goal setting.