LAS VEGAS -- Mozilla doesn't want to just make a better browser; it wants to make the Web a safer place for everyone.

That's the message that Mozilla Chief Security Officer Window Snyder and Mozilla project co-founder Mike Shaver delivered here today to a Black Hat crowd.

The Mozilla staffers provided an overview of how the open source group secures its code and how it intends to secure it in the future.

"Because everything is out in the open, it's easier for people to participate than they could with a traditional vendor," Snyder told the audience. "With traditional vendors you can only participate once the product ships. With Mozilla you can participate all along the process."

Mozilla uses a variety of security approaches to secure the browser, Snyder explained. Among them is threat modeling, which is a methodology for analyzing software for weaknesses and allows you to identify areas of risk.

Then there is the component security review, which is an approach that considers that every feature has a security impact on overall product. Mozilla also does code review looking for things like input validation mechanisms, improper sting handling and memory allocation errors.

"Mozilla's code review system is something we've had in since the project started nearly 10 years ago," Shaver said. "It catches errors and it also increases the number of people that are familiar with the code."

Snyder noted that Mozilla is also engaging in automated penetration testing, as well.

"We find fuzzing to be a very practical approach for finding vulnerabilities," Snyder said. "Targets include FTP, HTTP server responses, JavaScript and others."

For a browser vendor the Web can be a dangerous place. Shaver said that the whole of the Web for Mozilla is code and content you can't trust.

Mozilla's staffers also took aim at how to validate how secure or insecure a particular browser may be. In particular Snyder said that simply counting bugs is not a good measure.

"It doesn't tell you about the quality of the bug, how fast you're finding them or how bug-dense a particular piece of code is," Snyder said. "The real story shouldn't be that a vendor has x number of vulnerabilities; it should be that x number of vulnerabilities have been fixed.

Mozilla uses a number of metrics for bugs that are important: bug severity, find/fix rate; time to fix; and time to deploy. On the time-to-deploy metric, Snyder shared some statistics for the Firefox 2.0.0.4 release, which showed that 90 percent of users updated their browsers within six days.

It is with tools that Shaver and Snyder expect to further improve the security of Firefox.

"Tools let people that aren't experts to help out," Shaver said. "Tools capture expertise so that non experts can behave like experts."

Three tools that Mozilla has been working on will eventually be made public to help those outside Mozilla. Snyder explained that Mozilla is working on an HTTP fuzzer and an FTP fuzzer in collaboration with vendors Leviathan and Matasano, though neither tool will be made publicly available for a few months.

A third tool, for JavaScript fuzzing, called "jsfunfuzz" (JavaScript Fun Fuzz), which was developed by Mozilla, was released today.

Snyder claimed that Mozilla engaged with all vendors, including Microsoft, Opera and Apple. The general idea is that Mozilla didn't want to break the Web.

"We wanted to make sure we weren't releasing a tool without notifying other vendors," Snyder claimed.

Mozilla developer Jesse Ruderman who wrote the jsfunfuzz fuzzer explained that the tool creates JavaScript function bodies using a bunch of mutually recursive functions and runs them. .

Ruderman claimed that in its brief existence jsfunfuzz has already found 280 bugs in Firefox, 27 of which were exploitable.

With jsfunfuzz, as with Mozilla's participation at Black Hat, Snyder noted that it's all about getting more participation.

"The work that you do helps make Mozilla secure."