<div style="white-space:pre-wrap">Hi!<br><br>[sorry for the dupe to a few of you.. I just subscribed to fx-dev]<br><br>Currently, we provide a limited number of reviews on request, with Paul Theriault and someone from EIS/IT (Jeff Bryner's team). These would be threat model + architecture reviews. Recent requests have come from CD and Flyweb. I'm aware of some other, more informal reviews that different engineers give when they can, and we're interested in making those easier to request and give. <br><br>As a "program", security review doesn't formally exist today. We have ideas about what more we might try to do in 2017, but no solid plans yet. <br><br>Also, we don't have enough people to do many security *code reviews*. We're trying to avoid a "security cop" mentality where we are the source of tons of stop energy for innovation and creativity -- for the sake of the reviewers and people requesting review. <br><br>Get in touch with Paul and myself if you have requests or ideas about what you would like to see for security review.<br><br>I'll spend some quality time with the wiki on Monday to update out-dated information. Thanks for bringing this to my attention. I'll see about making or repurposing a bugzilla component for requests as well and report back to his thread. </div><br><div class="gmail_quote"><div dir="ltr">On Sat, Oct 1, 2016 at 11:33 AM Gijs Kruitbosch <<a href="mailto:gijskruitbosch@gmail.com">gijskruitbosch@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000" class="gmail_msg">
<div class="m_4349097452213491574moz-cite-prefix gmail_msg">-relman,gofaster,mgrimes<br class="gmail_msg">
+Selena<br class="gmail_msg">
<br class="gmail_msg">
On 01/10/2016 00:48, J. Ryan Stinnett wrote:<br class="gmail_msg">
</div>
<blockquote type="cite" class="gmail_msg">
<div dir="ltr" class="gmail_msg">
<div class="gmail_extra gmail_msg"><br class="gmail_msg">
<div class="gmail_quote gmail_msg">On Fri, Sep 30, 2016 at 8:41 AM, Gijs
Kruitbosch <span dir="ltr" class="gmail_msg"><<a href="mailto:gijskruitbosch@gmail.com" class="gmail_msg" target="_blank">gijskruitbosch@gmail.com</a>></span>
wrote:<br class="gmail_msg">
<blockquote class="gmail_quote gmail_msg" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div id="m_4349097452213491574gmail-:vn" class="m_4349097452213491574gmail-a3s m_4349097452213491574gmail-aXjCH m_4349097452213491574gmail-m1577b542054ec998 gmail_msg">In this specific case, it
sounds like you're already talking to the security team.
They would be the best people to judge if you (still)
need a formal security review to happen on the code
you're landing. If you haven't talked to them about
this, now would be a good time. For other projects, a
quick web search gets me: <a href="https://wiki.mozilla.org/Security#Request_a_Security_or_Privacy_Review" rel="noreferrer" class="gmail_msg" target="_blank">https://wiki.mozilla.org/Security#Request_a_Security_or_Privacy_Review</a>
which seems fairly straightforward to me.<span class="m_4349097452213491574gmail- gmail_msg"></span></div>
</blockquote>
</div>
<br class="gmail_msg">
</div>
<div class="gmail_extra gmail_msg">I suppose this is the wrong venue for
this rabbit hole,</div>
</div>
</blockquote>
I think fx-dev is a fine venue as far as desktop product security is
concerned. I've taken us out of the earlier thread, though.<br class="gmail_msg">
<blockquote type="cite" class="gmail_msg">
<div dir="ltr" class="gmail_msg">
<div class="gmail_extra gmail_msg">but I've had a hard time contacting the
security team in the past, so I am not sure what the right
venue is. The wiki page above links to a security review
request form that says "This process not currently in use,
maintaining for historical purposes".<br class="gmail_msg">
<br class="gmail_msg">
</div>
<div class="gmail_extra gmail_msg">Is there a description of the correct
process for requesting security review somewhere? I've
received a lot of mixed signals about this process in the
past, so having the right answer would be great!</div>
</div>
</blockquote>
<br class="gmail_msg">
I hadn't noticed that. And you're right, it would be good if the
wikipage was up-to-date (or redirected to somewhere up-to-date) and
process here was clearer (more than "ask around to find the right
person").<br class="gmail_msg">
<br class="gmail_msg">
Selena, AFAICT from phonebook you should be a good person to ask
(please forward as necessary if I missed something) - can you help
elucidate what would be the most current process here as far as
gecko/desktop/mobile stuff (rather than web/ops) is concerned?<br class="gmail_msg">
<br class="gmail_msg">
Thanks,<br class="gmail_msg">
Gijs<br class="gmail_msg">
</div>
</blockquote></div>