Discussion and response on Mozilla's dev-security-policy list:

https://groups.google.com/a/mozilla.org/g/dev-security-polic...