The security implications of Just-in-Time (JIT) Compilers in browsers have been getting attention for the past decade and the references to more recent resources is too great to enumerate. While … Read more
Recently we increased bounty payouts and also included a Static Analysis component in our bounty program; and we are expanding our bug bounty program even further with a new Exploit … Read more
In a recent academic publication titled Hardening Firefox against Injection Attacks (to appear at SecWeb – Designing Security for the Web) we describe techniques which we have incorporated into … Read more
The Secure Open Source track of the Mozilla Open Source Support (MOSS) Program primarily funds audits of open source projects. For example, we funded the iTerm2 Audit which turned out … Read more
In November of 2019 we added static analysis bounties for CodeQL queries and Clang plugins. Github has a great CodeQL portal with detailed instructions for creating a database that will … Read more
Welcome to Mozilla’s new Attack & Defense blog. We’re going to use this blog as a vehicle for tailored content specifically for engineers, security researchers, and Firefox bug bounty participants. … Read more
This post first appeared on the Mozilla Security Blog. At Github Universe, Github announced the GitHub Security Lab, an initiative to help secure open source software alongside the community and … Read more