[no bug] Relaunch and redo the web bug bounty program #4777

craigcook · 2017-04-19T22:42:44Z

Description

Started by @april who did all the real work in #4744, I've only tidied up a few odds and ends and squashed commits.

This completely relaunches the Mozilla web bug bounty program.

It includes:
Updated site lists
Revamped navigation
Completely rewritten documentation
Specific payouts

Bugzilla link

Testing

Checklist

Requires l10n changes.
Related functional & integration tests passing.

jeffbryner · 2017-04-19T23:46:05Z

Thanks @craigcook !

april · 2017-04-20T19:50:16Z

Thanks so much, @craigcook! I have a couple other tweaks I might make, but they can wait until after this is pushed so as to make things cleaner. :)

floatingatoll

drive-by f+ with some notes for @april

floatingatoll · 2017-04-21T19:40:48Z

bedrock/security/templates/security/bug-bounty/faq.html

          <p>Yes, as long as the bug otherwise meets the published bug bounty
-            program guidelines. Bugs found in Aurora and Beta releases of Firefox and
+            program guidelines. Bugs found in Developer Edition and Beta releases of Firefox and
            Firefox for Android, EarlyBird and Beta releases of Thunderbird are eligible as
            long the bug is reproducible in the latest nightly mozilla-central build and has


"in the nightly mozilla-central build at the time that the bug is reported", theoretically.

I'm fine with changing this, but I'd rather it was done in a different bug since it's unrelated to the web bug bounty stuff.

floatingatoll · 2017-04-21T19:42:41Z

bedrock/security/templates/security/bug-bounty/web-eligible-sites.html

+      <h4>Bedrock (www)</h4>
+      <ul>
+        <li>www.firefox.com</li>
+        <li>www.getfirefox.com</li>


Tiny whitespace nitpick: the two lines above are indented differently than the two below.

I'm not sure what you mean? <li> is supposed to be indented differently, since it's under <ul>.

These are indented two spaces, the two items below are indented one space. It is indeed a tiny nitpick but I'll fix it.

floatingatoll · 2017-04-21T19:45:31Z

bedrock/security/templates/security/bug-bounty/web-eligible-sites.html

+      </ul>
+      <p>
+        <strong>Please do not use automated scanners, create, or modify bugs when testing Bugzilla.</strong>
+        <br><br>Instead, install your own local copy for testing from <a href="https://github.com/mozilla/webtools-bmo-bugzilla">webtools-bmo-bugzilla</a> or use our <a href="https://bugzilla-dev.allizom.org/">development instance</a>.


@dylanwh Would you like to add a bit about the vagrantfile here, for "no seriously it's that easy" opportunity?

floatingatoll · 2017-04-21T19:49:22Z

bedrock/security/templates/security/bug-bounty/web-eligible-sites.html

+
+      <h4>Source Control</h4>
+      <ul>
+        <li>hg.mozilla.org (excludes website)</li>


Can this say '(except website, see below)'? I initially interpreted it as a flat denial for https://hg and didn't think "oh, they re-include that later on" at first read.

Works for me

floatingatoll · 2017-04-21T19:50:49Z

bedrock/security/templates/security/bug-bounty/web-eligible-sites.html

+
+      <h4>Source Control</h4>
+      <ul>
+        <li>hg.mozilla.org (website)</li>


"(website only)", paired with the prior note.

floatingatoll · 2017-04-21T19:51:59Z

bedrock/security/templates/security/bug-bounty/web-hall-of-fame.html

@@ -28,7 +29,7 @@ <h1 itemprop="name" class="title-shadow-box">Web And Services Bug Bounty Hall of

      <p>On behalf of the Mozilla and the millions of people who visit our sites, use Firefox and our other products we would like to thank them for their hard work in helping to make us more secure.</p>

-      <p>As of this date, we have paid out almost <b>$1,000,000</b> across all of our bounties. Congratulations to everybody who has participated!</p>
+      <p>As of this date, we have paid out over <b>$1,600,000</b> across all of our bounties. Congratulations to everybody who has participated!</p>


As of what date?

It will always be true as of the present.

Not including a date always it to always be accurate and also reduces the number of updates we need to do.

floatingatoll · 2017-04-21T19:52:34Z

bedrock/security/templates/security/client-bug-bounty.html

@@ -37,7 +37,7 @@ <h1 itemprop="name" class="title-shadow-box">Client Bug Bounty Program</h1>

      <p>Mozilla will pay a bounty for client and security bugs as detailed below. All security bugs must follow the following general criteria to be eligible:</p>

-       <p> Eligible security bugs may be present in any of the current main development or released versions of Firefox, Thunderbird, Firefox for Android, or FirefoxOS as released by Mozilla Corporation (e.g. Nightly mozilla-central, Firefox Developer Edition, or Beta test versions, as well as the final release product versions)</p>
+       <p> Eligible security bugs may be present in any of the current main development or released versions of Firefox or Firefox for Android as released by Mozilla Corporation (e.g. Nightly mozilla-central or Beta test versions, as well as the final release product versions)</p>


One Thunderbird removal occurs here, but this isn't reflected in many other occurrences of Thunderbird elsewhere in the document.

As above, I'd like to clean up the client stuff in a different commit, unless it's really necessary right now.

floatingatoll · 2017-04-21T19:58:25Z

uh, i'm sorry, i didn't intend to exercise some sort of formal merge approval on this pull request. please don't treat whatever github just decided about my commentary as any sort of "approval to merge" by the project.

floatingatoll · 2017-04-24T21:45:43Z

Yes, that's fine, I don't mean my comments to hinder merging, the document is fine as-is and okay to ship.

jpetto · 2017-05-01T21:37:25Z

Code looks good, but a couple pages need a little CSS help:

craigcook · 2017-05-01T23:16:49Z

Pesky floats... should rebuild the whole thing with grids...

Fix bug 1357380: Remove Aurora mention from Bug Bounty FAQ page

jpetto · 2017-05-03T15:50:55Z

LGTM!

craigcook mentioned this pull request Apr 19, 2017

Relaunch and redo the web bug bounty program #4744

Closed

2 tasks

craigcook force-pushed the bug-bounty-relaunch branch from 863030b to ff87ee4 Compare April 19, 2017 22:50

This was referenced Apr 19, 2017

update bounty page and hall of fame #4771

Closed

Fix bug 1357380: Remove Aurora mention from Bug Bounty FAQ page #4773

Closed

craigcook force-pushed the bug-bounty-relaunch branch from ff87ee4 to c9a66e4 Compare April 19, 2017 23:03

tristanweir mentioned this pull request Apr 21, 2017

Change bug bounty sites to conform to Bug Bounty relaunch mozilla/http-observatory-dashboard#16

Closed

floatingatoll approved these changes Apr 21, 2017

View reviewed changes

craigcook force-pushed the bug-bounty-relaunch branch from c9a66e4 to f963470 Compare April 27, 2017 07:14

jpetto self-assigned this Apr 27, 2017

[no bug] Relaunch and redo the web bug bounty program

e4dd27a

Fix bug 1357380: Remove Aurora mention from Bug Bounty FAQ page

craigcook force-pushed the bug-bounty-relaunch branch from f963470 to e4dd27a Compare May 3, 2017 01:14

jpetto merged commit f8a2ee5 into mozilla:master May 3, 2017

craigcook deleted the bug-bounty-relaunch branch May 3, 2017 17:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[no bug] Relaunch and redo the web bug bounty program #4777

[no bug] Relaunch and redo the web bug bounty program #4777

craigcook commented Apr 19, 2017

jeffbryner commented Apr 19, 2017

april commented Apr 20, 2017

floatingatoll left a comment

floatingatoll Apr 21, 2017

april Apr 24, 2017

floatingatoll Apr 21, 2017

april Apr 24, 2017

craigcook Apr 24, 2017

floatingatoll Apr 21, 2017

floatingatoll Apr 21, 2017

april Apr 24, 2017

floatingatoll Apr 21, 2017

floatingatoll Apr 21, 2017

april Apr 24, 2017

april Apr 24, 2017

floatingatoll Apr 21, 2017

april Apr 24, 2017

floatingatoll commented Apr 21, 2017 •

edited

floatingatoll commented Apr 24, 2017 via email

jpetto commented May 1, 2017

craigcook commented May 1, 2017

jpetto commented May 3, 2017

[no bug] Relaunch and redo the web bug bounty program #4777

[no bug] Relaunch and redo the web bug bounty program #4777

Conversation

craigcook commented Apr 19, 2017

Description

Bugzilla link

Testing

Checklist

jeffbryner commented Apr 19, 2017

april commented Apr 20, 2017

floatingatoll left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

floatingatoll commented Apr 21, 2017 • edited

floatingatoll commented Apr 24, 2017 via email

jpetto commented May 1, 2017

craigcook commented May 1, 2017

jpetto commented May 3, 2017

floatingatoll commented Apr 21, 2017 •

edited