{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/42","repository_url":"https://api.github.com/repos/mozilla/wikimo_opsec","labels_url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/42/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/42/comments","events_url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/42/events","html_url":"https://github.com/mozilla/wikimo_opsec/issues/42","id":157962831,"number":42,"title":"Web Security Guidelines rename?","user":{"login":"amuntner","id":4481467,"avatar_url":"https://avatars.githubusercontent.com/u/4481467?v=3","gravatar_id":"","url":"https://api.github.com/users/amuntner","html_url":"https://github.com/amuntner","followers_url":"https://api.github.com/users/amuntner/followers","following_url":"https://api.github.com/users/amuntner/following{/other_user}","gists_url":"https://api.github.com/users/amuntner/gists{/gist_id}","starred_url":"https://api.github.com/users/amuntner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amuntner/subscriptions","organizations_url":"https://api.github.com/users/amuntner/orgs","repos_url":"https://api.github.com/users/amuntner/repos","events_url":"https://api.github.com/users/amuntner/events{/privacy}","received_events_url":"https://api.github.com/users/amuntner/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"marumari","id":230528,"avatar_url":"https://avatars.githubusercontent.com/u/230528?v=3","gravatar_id":"","url":"https://api.github.com/users/marumari","html_url":"https://github.com/marumari","followers_url":"https://api.github.com/users/marumari/followers","following_url":"https://api.github.com/users/marumari/following{/other_user}","gists_url":"https://api.github.com/users/marumari/gists{/gist_id}","starred_url":"https://api.github.com/users/marumari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marumari/subscriptions","organizations_url":"https://api.github.com/users/marumari/orgs","repos_url":"https://api.github.com/users/marumari/repos","events_url":"https://api.github.com/users/marumari/events{/privacy}","received_events_url":"https://api.github.com/users/marumari/received_events","type":"User","site_admin":false},"assignees":[{"login":"marumari","id":230528,"avatar_url":"https://avatars.githubusercontent.com/u/230528?v=3","gravatar_id":"","url":"https://api.github.com/users/marumari","html_url":"https://github.com/marumari","followers_url":"https://api.github.com/users/marumari/followers","following_url":"https://api.github.com/users/marumari/following{/other_user}","gists_url":"https://api.github.com/users/marumari/gists{/gist_id}","starred_url":"https://api.github.com/users/marumari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marumari/subscriptions","organizations_url":"https://api.github.com/users/marumari/orgs","repos_url":"https://api.github.com/users/marumari/repos","events_url":"https://api.github.com/users/marumari/events{/privacy}","received_events_url":"https://api.github.com/users/marumari/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2016-06-01T17:26:32Z","updated_at":"2016-07-15T03:01:59Z","closed_at":null,"body":"\"Website Security Guidelines\" is an overly overly broad for what they describe, our goals are much more narrow. \r\n\r\nApril's goal was to make them generic, usable by the world, and focused on headers, I am in complete agreement with this. \r\n\r\n \"HTTP Header Security Guidelines\" or something like it would be more appropriate. "},"comment":{"url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/comments/232848706","html_url":"https://github.com/mozilla/wikimo_opsec/issues/42#issuecomment-232848706","issue_url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/42","id":232848706,"user":{"login":"amuntner","id":4481467,"avatar_url":"https://avatars.githubusercontent.com/u/4481467?v=3","gravatar_id":"","url":"https://api.github.com/users/amuntner","html_url":"https://github.com/amuntner","followers_url":"https://api.github.com/users/amuntner/followers","following_url":"https://api.github.com/users/amuntner/following{/other_user}","gists_url":"https://api.github.com/users/amuntner/gists{/gist_id}","starred_url":"https://api.github.com/users/amuntner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amuntner/subscriptions","organizations_url":"https://api.github.com/users/amuntner/orgs","repos_url":"https://api.github.com/users/amuntner/repos","events_url":"https://api.github.com/users/amuntner/events{/privacy}","received_events_url":"https://api.github.com/users/amuntner/received_events","type":"User","site_admin":false},"created_at":"2016-07-15T03:01:59Z","updated_at":"2016-07-15T03:01:59Z","body":"April, I think there was some miscommunication.\r\n\r\nI remember your describing your vision for this project - that it was to be a list of guidelines that was not too Mozilla-specific and would be usable by the wider world. You intended for this to be a guideline that would inform Mozilla standards and weren't sure at first whether contribute.json should be here or a Mozilla standard. I thought your approach was right and I and would be happy with contribute.json in either or both locations.\r\n\r\nInitially the guideline standard list was geared towards Web server/web site/service configuration issues. I didn't say \"exclusively about headers,\" I said \"focused on.\" Even though CORS problems are mostly XML related, the user agent and server signal communication in headers. TLS config isn't all headers, but HPKP, HSTS, and CORS are all signalled and negotiated through headers. There's also Contribute.json and robots.txt. \r\n\r\nSo the document is called Guidelines, but says \"All Mozilla sites and deployments are expected to follow the recommendations below. Use of these recommendations by the public is strongly encouraged.\" Is it a guideline? I see that now your intent is to make it a lot more inclusive of other kinds of issues than it already is, such as the queued work for sql injection discussion, and agree with this approach. The right place for the standard is probably in Mana with a copy on the Wiki, in @gdestuynder's standards format, keeping the Wiki version the guideline that informs our standard. \r\n\r\nYou have seen https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines I'm pretty sure. I like a lot of the elements you used in your page like the cheat sheet approach and layout which are really good and very useful. What do you think about an effort at reviewing the older Secure Coding guidelines, seeing what parts are still good, integrating those parts into your document, and updating the parts of the old doc, that need it? We could track it with the Trello board. "}}
{"actor":{"display_login":"amuntner"}}