1012669 - [B2G] SecReview of BuddyUp

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Security Assurance: FxOS Review, task)

Description

[Stephanie Ouillon [:arroway] (needinfo me)]

Opening a bug for the secreview of the project app BuddyUp. The code is currently on github:
https://github.com/mozilla/buddyup

BuddyUp is a service meant to have users interacting and helping other users needing support by allowing "herlpers" to chat and take control over a user's device.

Comment 1

[Jen Fong-Adwent [:ednapiranha]]

Not sure if we need a security review on demo code? This is all prototyped, not actually going to any official Mozilla server to be used by the public. It will only be used for a demo in June.

Comment 2

[Hermina]

Stephanie opened this so that they are able to keep track on BuddyUp changes and help us when this will be the case. The github link was shared with Security team a while ago, there won't be made a code review now.

Comment 3

[Stephanie Ouillon [:arroway] (needinfo me)]

Jen, as Hermina explained, I'm keeping track of the project so we can help on the security perspective when needed during the designing phase. The earlier we are in contact, the less surprises they are for everyone :)

Comment 4

[Yvan Boily [:ygjb][:yvan]]

Hi, please add me to meetings so that we can help out with the security review process.

Comment 5

[Hermina]

BuddyUp project plan: https://mana.mozilla.org/wiki/display/ProductMgmt/FxOS+-+BuddyUp+Project
BuddyUp dev plan - https://trello.com/b/uJahiZW4/buddy-up-status-of-user-stories-for-phase-1

Code for phase 1:
Backend: https://github.com/mozilla/kitsune
FxOS app:https://github.com/mozilla/buddyup/

Mike, could you please indicate if there's a specific location with BuddyUp APIs in kitsune so that it's easier for security to check?

Comment 6

[Stephanie Ouillon [:arroway] (needinfo me)]

Thx Hermina for the pointers.