Commit f8c94ad6 authored by intrigeri's avatar intrigeri
Browse files

Sponsor S report: move stuff that happened in January to the relevant report.

parent 7f2b224f
......@@ -22,15 +22,6 @@ Everything in this report can be made public.
XXX: explain the new timeline / postponed stuff
## A.1.1 Secure the Icedove autoconfig wizard
We've been evaluating our own patches for Icedove against those
reported to Mozilla's bugtracker and are happy to announce that our
patches would provide an option to accept only secure protocols, as
a user opt-in. These patches will be submitted to Mozilla's bugtracker
and hopefully integrated upstream.
([[!tails_ticket 7064]])
## A.1.2 Make our improvements maintainable for future versions of Icedove
We've been following up on upstreaming patches from
......@@ -43,13 +34,6 @@ XXX: explain the new timeline / postponed stuff
- `Message-ID` headers are fixed with a [C++ patch in Thunderbird
45](https://hg.mozilla.org/comm-central/rev/a8573d4c67292962f9dd9b8f51496e9f62bbedb7).
Unfortunately we also discovered that the autoconfig wizard of Icedove does
not always use the configured proxy. This means, that some traffic can leak.
This is not a security problem in Tails since we drop non-Tor
traffic by default, but for this very reason in breaks the
functionality of the autoconfig wizard in the context of Tails.
We started to write a proof-of-concept patch to fix this bug.
In order to make our improvements maintainable we've got
in touch with the Debian Icedove packaging team and written manual tests for
testing Icedove in Tails. ([[!tails_ticket 9493]])
......
......@@ -30,6 +30,24 @@ Everything in this report can be made public.
* what is the outcome (how it makes Tails better)
* what was not done, and why
## A.1.1 Secure the Icedove autoconfig wizard
We've been evaluating our own patches for Icedove against those
reported to Mozilla's bugtracker and are happy to announce that our
patches would provide an option to accept only secure protocols, as
a user opt-in. These patches will be submitted to Mozilla's bugtracker
and hopefully integrated upstream.
([[!tails_ticket 7064]])
## A.1.2 Make our improvements maintainable for future versions of Icedove
Unfortunately we also discovered that the autoconfig wizard of Icedove does
not always use the configured proxy. This means, that some traffic can leak.
This is not a security problem in Tails since we drop non-Tor
traffic by default, but for this very reason in breaks the
functionality of the autoconfig wizard in the context of Tails.
We started to write a proof-of-concept patch to fix this bug.
# B. Improve our quality assurance process
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment