1462101 - Please CNAME protocol.mozilla.org to protocol.moz.works

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSL Certificates, task)

Comment 1

[Josh Mize [:jgmize]]

Context: https://github.com/mozmeao/infra/issues/830

Comment 2

[Shyam Mani [:fox2mike]]

This will need an RRA before we can make the change (as it's a mozilla.org subdomain). Can you please link the RRA in here once that's complete and we'll be happy to add the entry. Thanks!

Comment 3

[Josh Mize [:jgmize]]

(In reply to Shyam Mani [:fox2mike] from comment #2)
> This will need an RRA before we can make the change (as it's a mozilla.org
> subdomain). Can you please link the RRA in here once that's complete and
> we'll be happy to add the entry. Thanks!


The MEAO team is requesting to use protocol.mozilla.org as the official URL for the documentation of a new design system for Mozilla branded websites. This URL would be hosting a static site, not a service, so I believe the guidelines in  https://infosec.mozilla.org/guidelines/risk/rapid_risk_assessment.html#when-not-to-run-an-rra would likely apply here. :gene do you agree, or should I file a bug requesting an RRA?

Comment 4

[Gene Wood [:gene]]

:jgmize is all of the data on this static site public? Is the impact of an attacker modifying the data on the static site not a problem? If it's public data and an attacker modifying it doesn't have an impact then yes, skip the RRA, otherwise run it.

Comment 5

[Josh Mize [:jgmize]]

(In reply to Gene Wood [:gene] from comment #4)
> :jgmize is all of the data on this static site public? Is the impact of an
> attacker modifying the data on the static site not a problem? If it's public
> data and an attacker modifying it doesn't have an impact then yes, skip the
> RRA, otherwise run it.

All data for the static site is public on https://github.com/mozilla/protocol/ and we are aware of and accept the risks that all *.mozilla.org subdomains have in that an attacker that was able to modify the page would be able to read and write cookies for .mozilla.org.

Comment 6

[Gene Wood [:gene]]

> Is the impact of an attacker modifying the data on the static site not a problem?

Comment 7

[Josh Mize [:jgmize]]

(In reply to Gene Wood [:gene] from comment #6)
> > Is the impact of an attacker modifying the data on the static site not a problem?

The impact of an attacker modifying the data on the site would be low as it is not directly associated with any Mozilla product or service, nor will it be promoted to end users, only designers and front-end developers implementing Mozilla websites.

Comment 8

[Gene Wood [:gene]]

Sounds like no need for an RRA then if the availability, integrity and confidentiality of the data on the site don't matter.

Comment 9

[Eric Ziegenhorn :ericz]

Thanks Gene.  CNAME created.