1335134 - Put the security.mixed_content.send_hsts_priming pref behind the RELEASE_OR_BETA ifdef

Status: VERIFIED FIXED

(Core :: DOM: Security, defect)

Comment 1

[Kate McKinley [:kmckinley, :Kate]]

Attachment: move pref into block

Comment 2

[Lawrence Mandel [:lmandel] (use needinfo)]

[Tracking Requested - why for this release]: Raised on r-d. nomming for tracing although I'm not yet clear on whether this warrants a point release or should be fixed in a followup release.

Comment 3

[Chris Peterson [:cpeterson]]

This pref landed in 51 with bug 1246540.

Comment 4

[Benjamin Smedberg]

Kate, who is going to review this patch, and what is the relationship between this change in all.js and the similar rules in security-prefs.js ?

Comment 5

[Kate McKinley [:kmckinley, :Kate]]

Attachment: Bug 1335134 - pref security.mixed_content.send_hsts_priming to false

Review commit: https://reviewboard.mozilla.org/r/108318/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/108318/

Comment 6

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Setting this as blocking 51/52. This looks like a dot release driver to me.

Comment 7

[Kate McKinley [:kmckinley, :Kate]]

Bug 1311807 has a site that can be used to verify the patch.

Comment 8

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

We should explore pushing a hotfix or system add-on update for this before we start planning a dot release. This is a pref flip and afaik hotfix/SAO update are both good mechanisms of doing this.

Comment 9

[Kevin Brosnan [Ex-Mozilla]]

We should do both a hotfix extension and ship and update. The hotfix would allow us to address a significant part of the userbase quickly. I recall our findings from websense hotfixes that we ended up with several million people who never got the hotfix, is there anything that has changed since that finding? Shipping an update has better penetration.

Comment 10

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

I agree, we should go ahead and ship the system add-on quickly as possible.  We can plan a dot release for later to improve uptake (And that dot release would likely include more fixes)

Comment 11

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Felipe, ckprice, can you help Kate with this as needed? Or is there someone else you can suggest to help out with this over the next couple of days? Thanks!

Comment 12

[Cory Price [:ckprice] (bugmail disabled, NI me!)]

From the process side, we need a sign off from QA, and a signed XPI posted to this bug (I think Liz linked to our docs).

Here are a couple of relevant resources

- Example pref flip tracking bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1307108
- Repository with some boilerplate code: https://github.com/mozilla/one-off-system-add-ons/tree/master/addons/asyncrendering

You could open a PR on that repository, or create a patch on this bug for review.

Comment 13

[:Felipe Gomes (needinfo for replies!)]

Yeah, and https://github.com/mozilla/one-off-system-add-ons is the de facto repo for these add-ons now. So the easiest will be to make a copy of one of the existing system addons there and change what you need.

Comment 14

[Honza Bambas (:mayhemer)]

Comment on attachment 8831782 [details]
Bug 1335134 - pref security.mixed_content.send_hsts_priming to false

https://reviewboard.mozilla.org/r/108318/#review109604

thanks

Comment 15

[Cory Price [:ckprice] (bugmail disabled, NI me!)]

Comment on attachment 8831782 [details]
Bug 1335134 - pref security.mixed_content.send_hsts_priming to false

Approval Request Comment
[Feature/Bug causing the regression]:
Bug 1246540.


[User impact if declined]:
Some discussion references here Bug 1335134 Comment 9. We're shipping as a system add-on in Bug 1335224, uplifting here in the case of a dot release.

[Is this code covered by automated tests?]:
I don't know.


[Has the fix been verified in Nightly?]:
No


[Needs manual test from QE? If yes, steps to reproduce]: 
Yes, Bug 1335224 Comment 7

[List of other uplifts needed for the feature/fix]:
None

[Is the change risky?]:
No

[Why is the change risky/not risky?]:
It's a pref flip

[String changes made/needed]:
No

Comment 16

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8831782 [details]
Bug 1335134 - pref security.mixed_content.send_hsts_priming to false

Let's uplift these changes in case we end up doing a dot release for 51. 
The patch should make it into beta 3 later this week.

Comment 17

[Carsten Book [:Tomcat]]

seems this need rebasing for beta like :

patching file modules/libpref/init/all.js
Hunk #1 FAILED at 5537
1 out of 1 hunks FAILED -- saving rejects to file modules/libpref/init/all.js.rej
abort: patch failed to apply

Comment 18

[Kate McKinley [:kmckinley, :Kate]]

Attachment: Flip send_hsts_priming to false - patch for beta

Comment 19

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/04c9d97c4cd7

Comment 20

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/222836684f2a

Comment 21

[Ryan VanderMeulen [:RyanVM]]

But we're not intending to land this on 53+?

Comment 22

[Honza Bambas (:mayhemer)]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #21)
> But we're not intending to land this on 53+?

We should to keep this change.  Until this feature's perf impact is carefully evaluated it must not be allowed on release/beta.

Comment 23

[Ryan VanderMeulen [:RyanVM]]

Thanks. I'll land this on trunk now and ping RelMan about getting an Aurora approval as well then.

Comment 24

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bdc513580a45
pref security.mixed_content.send_hsts_priming to false r=mayhemer

Comment 25

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8831782 [details]
Bug 1335134 - pref security.mixed_content.send_hsts_priming to false

I've been told this pref flip is also needed in Aurora53.

Comment 26

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/cfb67ac16037

Comment 27

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/bdc513580a45

Comment 28

[Mihai Boldan, Desktop QA [:mboldan]]

The security.mixed_content.send_hsts_priming pref is set to 'False' on Firefox 52.0b9 and set to 'True' on Latest Aurora 53.0a2 (2017-02-24) and on Latest Nightly 54.0a1 (2017-02-24).
The tests were performed under Windows 10 x64.