Entering all security bugs and tasks for SeaMonkey into Buzilla for schedule tracking.

has the review been completed during m8? rolling this tracking bug over to m9

Depends on 9682, which is M11.

Push security review tasks off until M16.

Bulk moving all Browser Security bugs to new Security: General component. The previous Security component for Browser will be deleted.

Adding 'skins' keyword to selected chrome bugs. Please add any omissions. Sorry for any mistakes...

Mass-adding beta2 keyword to all skins bugs.

Changing Qa contact to myself.

Bulk reassigning most of norris's bugs to mstoltz.

David, Norris suggested I assign this one to you...could you take a look, or else pass it on?

cc'ing myself.

Changing (post-nsbeta2) in Summary to read (post-PR2) so my "nsbeta2 in keyword with no nsbeta2 in Summary" query will pick this bug up for PDT review.

[nsbeta2-]

Changed QA contact to Cathy.

Mass-moving all nsbeta2- bugs to M20

This was never Hyatt's bug. My understanding is that the chrome registry already exists. What is missing that needs security review? Putting back on nsbeta2 radar, this review seems essential for skins to be safe.

Putting on [nsbeta2-] radar.

I'm reassigning this to Skinability so that it will catch the eye of someone who knows this code. I'm happy to help with a security review but I need help from someone who knows/owns this code. Can we set up a meeting time to do this review?

Removed NSBeta2- to trigger re-evaluation. I assume skins are nearing completion, and we should have a security review before beta2 is released.

This is a bug for a review mtg. Not a blocker. Putting on [nsbeta2-] radar.

*spam* changing QA to me for all skinability bugs (all 4 of them!)

Yes, we need to review this for beta 3. Ben, make sure we're following German's spec here.

nav triage team: changing [b3nav+] bugs to [nsbeta3+].

what is required here? I'm only responsible for XUL/CSS stuff. this doesn't sound like my bug.

I want to hold a brainstorming session on chrome/xul/css security this week. Ben, this includes you.

ok, let me know when, preferably a day in advance as I don't often get in early ;)

Adding nsbeta3 keyword to bugs which already have nsbeta3 status markings so the queries don't get all screwed up.

mitch, I don't want this on my radar if I don't know what's going on. Tell me what you want me to do or I'll close it :P

I'll take this back. I've spoken to Hyatt a bit and he's calmed my fears a bit, although a meeting might still be a good idea, when I have the time. Clearing the + for now.

jar suggested that mstoltz take this and if you run into any security fears, create a new bug and nominate nsbeta3.

Removing nsbeta3 as this is a 'tracking" bug

nsbeta3. It would be nice to bring this up at an architecture meeting, maybe.

Unless you guys want me to dial in and listen to your meeting (I'll also accept it if you pay to fly me to CA), I'm not sure how I'll verify that you guys had a meeting about this. So, setting QA to mstoltz.

Marking security reviews as rtm.

Removing nsbeta3 to make queries clearer.

Mitch, on 8/16 you said your fears were calmed a bit by talking to Hyatt. Is there anything left to really do for this bug? Do you still need a skins person to help do a review?

Yes. Mybe not for rtm, but soon.

PDT marking [rtm-] for this to-do item. If any serious bugs crop up as a result of this review, please nominate them separately.

Mass adding mozilla0.9 keyword (mass changing milestone doesn't seem to work).

Mass changing milestone to Moz1.0 - stuff targeted for late spring/early summer.

Bugs targeted at mozilla1.0 without the mozilla1.0 keyword moved to mozilla1.0.1 (you can query for this string to delete spam or retrieve the list of bugs I've moved)

don't move bugs that are in the 1.0 dependency tree. sorry.

Moving Netscape owned 0.9.9 and 1.0 bugs that don't have an nsbeta1, nsbeta1+, topembed, topembed+, Mozilla0.9.9+ or Mozilla1.0+ keyword. Please send any questions or feedback about this to adt@netscape.com. You can search for "Moving bugs not scheduled for a project" to quickly delete this bugmail.

Clearing milestone for now.

Might still be something to look for here; if we do any more security reviews.