1258647 - Content-Signature Error Reporting

Status: RESOLVED FIXED

(Core :: Security, enhancement, P2)

Description

[Franziskus Kiefer [:franziskus]]

It would be good to have some error reporting if a content-signature verification fails.

Comment 1

[Julien Vehent]

JC: I'd like to bump this bug on the list of priorities to help catch production issues when signatures fail. Could you put it on the roadmap?

I think a telemetry probe would do the job here.

Comment 2

[J.C. Jones [:jcj] (he/they)]

Thanks, Julien. I've got an estimate and it looks like something we can do in January. I've added it to our list and tentatively marking this for Franziskus to handle, but that's TBD.

Comment 3

[Franziskus Kiefer [:franziskus]]

Rebecca, could you take a look at the patch for data collection? This is measuring content-signature failures when we push things such as the block list to Firefox. This is to debug failures that are seen by Julien's team (comment 1).

Comment 4

[Phabricator Automation]

Comment on attachment 8944401 [details]
Bug 1258647 - Content-Signature telemetry

David Keeler [:keeler] (use needinfo) has approved the revision.

https://phabricator.services.mozilla.com/D427#10270

Comment 5

[François Marier [:francois]]

Franziskus, can you please fill out the data review request form and attach it as a plaintext file on this bug?

You can find the details of the new process here: https://wiki.mozilla.org/Firefox/Data_Collection#Step_1:_Submit_Request

Basically, as soon as you have the request form attached here, you can r? one of the data stewards on it and we'll take care of Step 2.

Comment 6

[Franziskus Kiefer [:franziskus]]

Attachment: data review request

Comment 7

[François Marier [:francois]]

Comment on attachment 8946564 [details]
data review request

1) Is there or will there be **documentation** that describes the schema for the ultimate data set available publicly, complete and accurate?

Yes, histograms.json.

2) Is there a control mechanism that allows the user to turn the data collection on and off?

Yes, telemetry setting.

3) If the request is for permanent data collection, is there someone who will monitor the data over time?**

Yes, Franziskus.

4) Using the **[category system of data types](https://wiki.mozilla.org/Firefox/Data_Collection)** on the Mozilla wiki, what collection type of data do the requested measurements fall under?  **

Category 1.

5) Is the data collection request for default-on or default-off?

Default-on, all channels.

6) Does the instrumentation include the addition of **any *new* identifiers** (whether anonymous or otherwise; e.g., username, random IDs, etc.  See the appendix for more details)?

No.

7) Is the data collection covered by the existing Firefox privacy notice?

Yes.

8) Does there need to be a check-in in the future to determine whether to renew the data? 

No, permanent.

Comment 8

[François Marier [:francois]]

One thing I would suggest is that you might be able to get away with a 6 month or 12 month expiry on that probe if you're only using it to try and find the root cause of these problems.

We do allow permanent probes, but we try to encourage expiring probes whenever possible. It's a very simple process to renew them after 6 months / 12 months if you're still using. Basically, you just r? me and point to this bug as the place where the data review was done and there's nothing else to do.

Anyways, up to you. datareview+

Comment 9

[Julien Vehent]

> One thing I would suggest is that you might be able to get away with a 6 month or 12 month expiry on that probe if you're only using it to try and find the root cause of these problems.

This probe will be used to detect issues with signing in our production services, so it needs to be permanent.

Comment 10

[Franziskus Kiefer [:franziskus]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=def9d6c7d0ef9edf68918739097c7d1ad9b777f9

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c8c3e5505d9c
Content-Signature telemetry, r=keeler,francois

Comment 12

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/c8c3e5505d9c