Black Hat 2008: What’s next for Firefox security
posted Aug 8th 2008 6:30pm by Kimberly Laufiled under: firefox hacks, news, security hacks
Mozilla security chief [Window Snyder] made some surprising announcements about Firefox Next, Mozilla’s next major browser overhaul. In her chat at the Black Hat security conference, she introduced three new initiatives that focused on threat modeling, training, and vulnerability metrics. For the threat modeling initiative, she’s hired Matasano Security consultants to review Firefox’s code for weaknesses and recommend mitigation tactics to protect the browser from hacker attacks. This isn’t inherently unusual; what is abnormal is that the information, once the work is done, will be revealed to the public. The training initiative will have IOActive trainers working with Mozilla engineers on secure computer programming practices. At the end, according to [Snyder], online versions of the classes will be released to the public, along with the class materials. The last initiative revolves around security metrics, and is already in progress. Essentially, the project will ideally take the focus off of patch-counting and provide a better assessment of security and vulnerability issues. [Snyder] says “We’re in the early phase, working on incorporating feedback from the rest of the industry.” She also reveals some more Firefox developments, including possibly incorporating NoScript into the core browser and implementing protected mode, but they’re still a long way from becoming standard features.
Whoa, noscript in the core? That would be seriously awesome and bypass some of the dance the extension has to do to get it to work (though ff3 improved things). I wonder if they’re going to make adblock+ features more integrated — blocking things from known-bad and user-defined hosts would be much easier that way. in fact, that could replace the first few extensions that I install before I actually use the browser…