Bug Bounty Program

The Mozilla Security Bug Bounty Program is designed to encourage security research in Mozilla software and to reward those who help us create the safest Internet clients in existence.

Many thanks to Linspire and Mark Shuttleworth, who provided start-up funding for this endeavor.

General Bounty Guidelines

Mozilla will pay a bounty for certain client and service security bugs, as detailed below. All security bugs must follow the following general criteria to be eligible:

Security bug must be original and previously unreported.
Security bug must be a remote exploit.
Submitter must not be the author of the buggy code nor otherwise involved in its contribution to the Mozilla project (such as by providing check-in reviews).
Employees of the Mozilla Foundation and its subsidiaries are ineligible.
If you found the security bug as part of your job (in other words, while being paid to work on Mozilla code) then we would appreciate your not applying for the bounty. Our funds are limited and we would like this program to focus on people who are not otherwise paid to work on the Mozilla project.

Mozilla reserves the right to not give a bounty payment if we believe the actions of the reporter have endangered the security of Mozilla's end users.

If two or more people report the bug together the reward will be divided among them.

Client Reward Guidelines

The bounty for valid critical client security bugs will be $3000 (US) cash reward and a Mozilla T-shirt. The bounty will be awarded for sec-critical and sec-high severity security bugs that meet the following criteria:

Security bug is present in the most recent main development (i.e., Aurora, Beta or EarlyBird, and nightly mozilla-central releases) or released versions of Firefox, Thunderbird, Firefox for Android, or in Mozilla services which could compromise users of those products, as released by Mozilla Corporation.
Security bugs in or caused by additional 3rd-party software (e.g. plugins, extensions) are excluded from the Bug Bounty program.
More information about this program can be found in the Client Security Bug Bounty Program FAQ.

Web Application and Services Reward Guidelines

The bounty for valid web applications or services related security bugs, we are giving a range starting at $500 (US) for high severity and, in some cases, may pay up to $3000 (US) for extraordinary or critical vulnerabilities. We will also include a Mozilla T-shirt. The bounty will be awarded for sec-critical and sec-high security bugs that meet the following criteria:

Security bug is present in the web properties outlined in the Web Application Security Bounty FAQ.
Security bug is on the list of sites which part of the bounty. See the eligible bugs section of the Web Application Security Bounty FAQ for the list of sites which is included under the bounty.
More information about this program can be found in the Web Application Security Bounty FAQ.

Process

Please file a bug describing the security bug; be sure to check the box near the bottom of the entry form that marks this bug report as confidential. We encourage you to attach a "proof of concept" testcase or link to the bug report that demonstrates the vulnerability. While not required, such a testcase will help us judge submissions more quickly and accurately.

Notify the Mozilla Security Group by email and include the number of the bug you filed and a brief summary. If you cannot file a bug include the full details in the email and attach any proof of concept testcases or links. Mozilla Foundation staff and the Mozilla Security Group will consider your submission for the Security Bug Bounty and will contact you.

We ask that you be available to provide further information on the bug as needed, and invite you to work together with Mozilla engineers in reproducing, diagnosing, and fixing the bug. As part of this process we will provide you full access to participate in our internal discussions about the bug; for more information read our policy for handling security bugs.

Firefox OS devices now available in Poland, with Germany and more coming soon

You may have noticed that ZDNet looks a little different today. Article pages have been tweaked, the navigation looks a bit different and the topic pages are revamped. But the biggest changes have occurred under the hood at ZDNet.

People, processes and platforms have changed.

In short, we've unified our English-speaking ZDNets in the U.S., Australia, U.K. and Asia. We're now on one platform, one content management system and one team. Technically, our site has moved to Amazon Web Services and operates in an adaptive framework that adjusts to your various screens from smartphone to tablet to PC. Internally, we have called this project global/local. The aim is relatively simple: Bring you 24/7 business technology coverage all around the world with both global and local insight.

Our roll call and masthead are also a bit beefier. In addition to the U.S. team and its merry band of contributors we have local expertise and beat reporters around the world. The short version of the editor roll call goes like this: Steve Ranger and Rupert Goodwins in the U.K.; Brian Haverty and Suzanne Tindal in Australia and Eileen Yu in Singapore and overseeing our Asia operations.

These editors lead teams focused on their locales and regions. To wit:

• From our London hub, we're looking to expand into Eastern Europe (a growing IT outsourcing and startup hub) as well as in the Middle East and Africa. If you're a business IT expert in these regions ping Jo Best.
• In Asia, we're expanding our China coverage, bolstering new tech hotspots such as Vietnam and recruiting folks in India. ZDNet India will be launching in short order once we work out the kinks on our new platform.
• In Australia, we'll also be adding to the roster to cover that side of the world.

These locations in addition to our U.S. beachhead will bolster coverage with research, which is run out of Sydney, and a global CIO Jury to keep tabs on business trends.

Today marks the first phase of the new global ZDNet, but phase two is what has me most wound up. We're eyeing a structure that will revolve around the IT buying cycle so we'll become a news site as well as a productivity tool. We'll be ramping our long-form coverage as well as IT buying case studies. We're also planning to launch a subscription service in the near future. Those projects are notable for us because they will be our first greenfields as a global team.

Just like IT projects, greenfields are a lot more fun than those legacy and integration projects.

We're excited to bring you the new ZDNet and look forward to bringing new business tech markets, expertise and insight to you from around the world.

Thanks for reading and contributing to ZDNet. Feel free to leave feedback on the site as well as items you'd like us to pursue in the Talkbacks below.

mOst sEcUre BrOwSeR

Sony to launch Firefox OS smartphone based on the Xperia E in India

New Delhi: Sony will soon launch new handsets in India with Mozilla's Firefox operating system, according to sources of The Mobile Indian.

The Sony insider who doesn't want to be named said to The Mobile Indian, "We are already in the process of working on a handset with Firefox operating system for the Indian market. It will have applications and tweaks to suit the market here."

ALSO SEE Meet the HTC Myst - the Facebook smartphone

Mozilla has recently announced its Firefox operating system for mobile phones during Mobile World Congress event last month. However, Mozilla did not include India in its launch plans and said it will launch the handsets based on the OS in around 18 countries of Latin America, China and Europe by the month of June this year.

"India is a very important market to avoid and it will be one of the first markets where Sony will launch products based on Firefox," our source in Sony said. He also added an announcement in this regard is expected within few months.

Companies like Sony, LG, ZTE, Alcatel, and Huawei have committed to develop phones on this new operating system. Firefox operating system uses HTML5-based apps and is targeting entry-level devices. As of now Firefox Marketplace, has social networking apps for Facebook and Twitter, Nokia's Here maps service, Box cloud storage, and games from EA Mobile and Disney Mobile.

Sony will also include its recently announced services like Sony Music (15 lakh songs) and Sony Liv (TV application) on the Firefox powered Xperia E.

Firefox Marketplace apps will be powered by cloud services to enable easy transition across devices and platforms. It will have popular apps such as AccuWeather, Airbnb, Pulse News, SoundCloud, SporTV, Terra and Time Out, as well as tailored, local apps that are relevant to users in their respective regions. Web developers can also turn a website into an HTML5 app through Mozilla's development kit. Firefox OS supports video calling over Web RTC, a browser-based technology that's also available on the Android Firefox Aurora app.

Firefox for Android Makes Mobile Browsing Faster & Easier

Firefox for Android makes it easy to get to your favorite sites with a personalized page that we call the Awesome Screen. Firefox for Android includes a new and improved  Awesome Screen to help get you to where you want to go on the Web quickly.

The Awesome Screen now completes your URL destination as-you-type to get you to your favorite sites faster. Firefox for Android includes Switch to Tab that lets you easily find and switch to any open tab from your Awesome Screen without opening duplicate tabs. The title bar in Firefox for Android hides while not in use to make your entire screen available for your content. Simply pull down the title bar from the top of the screen when you are ready to use it again.

Have a favorite search provider? Firefox for Android lets you change your default search provider from the Firefox add-ons manager. It is really easy to make this change in a few clicks. Simply, visit the Add-ons manager, and long-tap on an installed search engine. This brings up a dialog where you can either “Disable” the search engine, or “Set as Default.”

Firefox for Android includes an updated RSS feed reader to create a simple way to subscribe to an RSS feed. If you go to any page with a discoverable RSS feed and long-tap on the URL bar, you will be given the option to “Subscribe to Page.”

Mozilla works with a global volunteer community to create Firefox and almost every non-English version of Firefox is localized by community volunteers. Firefox for Android adds support for Turkish and Hungarian locales bringing an amazing Web experience to even more people around the globe.

For more information:

• Download Firefox for Android
• Release Notes for Firefox for Android
• More information on Firefox Health Report