731044 - Enable SecureMail for "Security-Sensitive Core Bug" group bugs

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Extensions, defect)

Description

[Al Billings [:abillings - ex-MoCo]]

We should enable SecureMail for "Security-Sensitive Core Bug" group bugs in order to protect ourselves from accidental information disclosures as part of defense in depth. This also avoids us transmitting and storing security bug information in the clear on third party mail servers, such as Gmail.

Comment 1

[Michael Coates [:mcoates] (acct no longer active)]

I'd like us to circulate this idea with everyone that will be impacted since it will cripple search functionality.

Comment 2

[Al Billings [:abillings - ex-MoCo]]

Sure, opening the bug was just the first step in order to begin the process.

Comment 3

[Reed Loden [:reed]]

Keep in mind the existing bug 729558, which can cause unreadable bugmail.

Comment 4

[Gervase Markham [:gerv]]

Yep, we should fix 729558 first. However, that doesn't stop us having the discussion.

However, a bug is not a great place for discussing whether or not to do something (it's better for discussing _how_ to do it, which is not a question here - it's a simple check of a box). Mailing lists are better for that. Al: perhaps it would be good to start the discussion on [e-mail]?

Gerv

Comment 5

[Gervase Markham [:gerv]]

(Ah, I see Dan has notified s-g. I'll try and encourage people to talk about it there.)

Gerv

Comment 6

[Al Billings [:abillings - ex-MoCo]]

Based on discussions, there does not seem to be anything blocking us turning this on now.

Comment 7

[Robert Kaiser]

I only see one somewhat "blocking" issue here, and that's getting a wiki, MDC or similar page up that describes in detail how you set up both Bugzilla and e.g. Thunderbird with a cert from e.g. StartSSL, possibly even EnigMail with a GPG key (and how to get a reasonable GPG key in the first place).
That's not a technical requirement, obviously, just a documentation one.

Comment 8

[Al Billings [:abillings - ex-MoCo]]

I don't think we need to block on documentation. Even if people set up nothing, they still get a notification that the bug as changed. Perhaps we can do a security blog post that will go to planet to notify people why this occurred and then see about docs.

Comment 9

[Jeff Walden [:Waldo]]

"need" is maybe -- maybe -- too strong.  But I think as a matter of courtesy the change should be announced, with pointers to how to respond, prior to its actually occurring.  I know I'd be frustrated if this change were to happen before I could adapt to it.  If there's no particular reason that courtesy must be sacrificed to immediacy here (and I'm aware of nothing beyond belt-and-suspenders here), I think we should have those docs and a short lead time before the actual change.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

This has been talked about at length on security-group now. There is a wiki page for guidance at https://wiki.mozilla.org/Security/Security_Bugs/EncryptedBugmail.

We can turn SecureMail on for "Security-Sensitive Core Bug" group bugs now.

Comment 11

[:glob ✱]

secure-mail has been enabled for the core-security group.