1016442 - Make mozilla cdn sites production on built-in pins

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Comment 1

[Camilo Viecco (:cviecco)]

Telemetry shows mozilla sites OK, so it is time to start making them into production (starting with low risk).

Comment 2

[Camilo Viecco (:cviecco)]

Attachment: pin-update1

Comment 3

[[:mmc] Monica Chew (no longer reading bugmail)]

Comment on attachment 8429399 [details] [diff] [review]
pin-update1

Review of attachment 8429399 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/manager/tools/PreloadedHPKPins.json
@@ +176,1 @@
>        "pins": "mozilla", "test_mode": true, "id": 2 },

According to bsmedberg and taras, we cannot keep individual telemetry for this bucket (not that it would tell us much anyway). Please remove the id field.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8429399 [details] [diff] [review]
pin-update1

Review of attachment 8429399 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/manager/tools/PreloadedHPKPins.json
@@ +176,1 @@
>        "pins": "mozilla", "test_mode": true, "id": 2 },

a). Let's do this in a separate bug.
b). What's the relationship between addons.mozilla.net and mozilla.net? As I understand it, the former is necessary for the proper functioning of the browser, and so it can have a specific telemetry id. If the latter is just a cdn, depending on what it serves, I don't think we can give it a telemetry id.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8429399 [details] [diff] [review]
pin-update1

Ugh. Bugzilla.

Comment 6

[[:mmc] Monica Chew (no longer reading bugmail)]

(In reply to David Keeler (:keeler) [use needinfo?] from comment #4)
> Comment on attachment 8429399 [details] [diff] [review]
> pin-update1
> 
> Review of attachment 8429399 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: security/manager/tools/PreloadedHPKPins.json
> @@ +176,1 @@
> >        "pins": "mozilla", "test_mode": true, "id": 2 },
> 
> a). Let's do this in a separate bug.

My bad -- Camilo came by and I asked him to do everything in 1 bug because I didn't want any sites to be double-counted (or left out) in the stats.

Comment 7

[Camilo Viecco (:cviecco)]

Attachment: pin-update1 (v2)

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8429413 [details] [diff] [review]
pin-update1 (v2)

Review of attachment 8429413 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/manager/tools/PreloadedHPKPins.json
@@ +176,5 @@
>        "pins": "mozilla", "test_mode": true, "id": 2 },
>      { "name": "aus4.mozilla.org", "include_subdomains": true,
>        "pins": "mozilla", "test_mode": true, "id": 3 },
>      { "name": "cdn.mozilla.net", "include_subdomains": true,
> +      "pins": "mozilla", "test_mode": false},

nit: space after false

Comment 9

[Camilo Viecco (:cviecco)]

Attachment: pin-update1 (v3)

Keeping r+ from mmc

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/19b9549ea7e7