Re: UK Government's documentation on Firefox security

On 03/11/2015 11:39, Gervase Markham wrote:
> On 02/11/15 16:10, Gijs Kruitbosch wrote:
>> I don't really understand what the point of such a pref would be. Surely
>> then the user would first flip the pref and then bypass the safebrowsing
>> warning?
> The document explains how you can lock preferences in an enterprise
> scenario. I assume we still support that?
Yes.

>>> 6) Can't disable Basic/Digest Auth over HTTP
>>>
>>> -- UNCO bug about warning:
>>>        https://bugzilla.mozilla.org/show_bug.cgi?id=1185145
>> Note that we already warn about sending the credentials if not done
>> through the prompt.
> We warn on every transmission of credentials over HTTP?
No, but if you put e.g. "http://foo:[email protected]/" in the URL bar, 
you will get a warning that you're transmitting credentials to a site 
that does not require any. I'm not 100% sure what the criteria are for 
that prompt.

>>> 9) No security event logging
>> What is a "security event" ?
> The document says:
>
> "Firefox does not provide any built-in mechanism for logging events for
> enterprise analysis. It is therefore not possible to determine whether
> installations adhere to security policies,
This is a particularly vague way of describing what they want. Security 
policy varies from organization to organization, as would the requisite 
logging. It would seem hard if not impossible to strike the right 
balance between not logging anything and logging too much detail... I'm 
aware Windows logs things, and IME a lot of what it logs is not useful, 
and when there is a problem for which such logs would be useful (e.g. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1089188 ) they are too 
superficial to actually be useful.

IOW, I am not convinced it makes sense to add this as a feature, beyond 
the obvious NSPR and NSS logging which we already have.

~ Gijs