Re: Policy 2.5 Proposal: Clarify requirements for reporting of security failures/policy violations

2017-05-19 Thread Gervase Markham via dev-security-policy
On 12/05/17 14:18, Gervase Markham wrote: > I propose instead: > > "Changes that are motivated by a security concern such as certificate > misissuance or a root or intermediate compromise MUST be treated as a > security-sensitive, and a secure bug filed in Bugzilla. Implemented as proposed. Gerv

Policy 2.5 Proposal: Clarify requirements for reporting of security failures/policy violations

2017-05-12 Thread Gervase Markham via dev-security-policy
Mozilla's Enforcement Policy indicates what to do when a serious security concern is noticed, but does not indicate what to do when a lesser security concern is noticed. The current text is now in section 7, and says: "Changes that are motivated by a serious security concern such as a major root