thoughts on mozilla

In our weekly roundup post, we briefly mentioned the following:

The Firefox “Input” project, slowly moved forward. Its goal is to organize all of the feedback mechanisms, into one location.

Of course, this project had yet to be officially announced, thought much of its work has been happening in public wikis and meetings.

In a post to the mozilla.dev.planning newsgroup, Aakash Desai – a QA engineer at the Mozilla Corporation (MoCo) – officially announced the “Input” project and its future. The plan was met with some resistance, notably from the SeaMonkey community which had yet to be informed that a feature they were using (“Report a Broken Website”) was being removed. Robert Kaiser – Project Manager for the SeaMonkey Project – finally conceded that he didn’t care and a little warning was better than none at all.

Yes, let’s leave it at that, the warning still came in before it actually happened, so I guess we’ll should [sic] fine in the end anyhow.

Outside of the smallest amount of conflict, the thread moved a bit off-topic as discussion of changes to the user-agent came into play. Such changes have been heatedly discussed in the past for various reasons and no changes have been made.

However, work is now underway to improve “fingerprinting” of individual users using a variety of methods. A few weeks ago, Dan Witte – a MoCo platform engineer – wrote a fairly detailed wiki page on fingerprinting and a few changes that could be made to improve it. Notably:

Remedies: remove the last point digit in the Firefox and Gecko versions, and the Gecko build date; for Linux, remove distribution and version; possibly remove CPU. Windows is actually the least unique since the OS version string only identifies the major version (e.g. XP), and by far the majority of users are on it.

Remove language and “Firefox” as well?

Such changes would be fairly significant and likely won’t go uncontested. But in the name of privacy, this is one fight worth having.

The Infrastructure Security team at the Mozilla Corporation (MoCo) consists of one person, Chris Lyon, a MoCo director. As part of his job, Lyon has drafted a new disclosure policy, similar to the more general policy used across the Mozilla codebase.

The disclosure policy is mostly inline with the general policy, but allows for a good number of bugs to never be disclosed. Unlike security bugs in the Mozilla codebase, infrastructure security bugs do not go through the security group. Often times, members of the security group – who are from a collection of companies – do not have access to such bugs to determine their severity, with a few exceptions. Even when such bugs are vetted, it’s hasn’t been under a community process.

Additionally, the policy can only be changed by the “Director of Infrastructure Security and/or VP of Engineering Operations.” That shouldn’t be strange, except it’s the first Mozilla policy that’s called out a specific MoCo position, as opposed to a community position, which just happens to be filled by a MoCo employee.