1045781 - Security Review for Makedrive

Status: NEW

(mozilla.org :: Security Assurance: Review Request, task)

Description

[JP Schneider :jp]

1) Who is/are the point of contact(s) for this review?
DevOps: JP Schneider ([e-mail] :jp )
Devs: Jon Buckley ([e-mail] :jbuck )
Boss: Brett Gaylor/David Humphrey ([e-mail] / [e-mail])


2) Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
This is a "dropbox" like service for use with webmaker tools.


3) Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
Staging:  https://makedrive.mofostaging.net
Github: https://github.com/mozilla/makedrive 

4) Does this request block another bug? If so, please indicate the bug number.
X

5) This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?
We're definitely looking to launch in the next couple weeks.

6) To help prioritize this work request, does this project support a goal specifically listed on this quarter's goal list?  If so, which goal?
This is toward the goal of 10000 contributors.

7) Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)
7a) Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users? No
7b) Are there any portions of the project that interact with 3rd party services? Newrelic, Google Analytics
7c) Will your application/service collect user data? If so, please describe: i do not believe so, it is hooked to login via Persona.
8) If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):
9) Desired Date of review asap

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

This would be a review of the code for this, the network items needed to support this or both?

Comment 2

[JP Schneider :jp]

This would be just code.  The infrastructure is AWS based.

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

assignto/needinfo to yvan to assign an appropriate appsec resource