1488865 - import CRLite enrollment state into cert_storage

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Comment 1

[Mark Goodwin [:mgoodwin]]

Attachment: Bug 1488865 - Add item to blocklist-clients.js to fetch / sync server CRLite state r?jcj

Comment 2

[J.C. Jones [:jcj] (he/they)]

FYI, this needs data-review since it adds telemetry.

Comment 3

[J.C. Jones [:jcj] (he/they)]

Attachment: Data Collection Review.md

Affects this bug and Bug 1545383. Thanks, Chris!

Comment 4

[Mark Goodwin [:mgoodwin]]

Filed bug 1548808 for an issue where the data in the intermediates remote settings collection differs from the interface exposed by nsICertStorage

Comment 5

[Chris H-C :chutten]

Comment on attachment 9062379 [details]
Data Collection Review.md

DATA COLLECTION REVIEW RESPONSE:

    Is there or will there be documentation that describes the schema for the ultimate data set available publicly, complete and accurate?

Yes. This collection is Telemetry so is documented in its definitions file [Histograms.json](https://hg.mozilla.org/mozilla-central/file/tip/toolkit/components/telemetry/Histograms.json) and the [Probe Dictionary](https://telemetry.mozilla.org/probe-dictionary/).

    Is there a control mechanism that allows the user to turn the data collection on and off?

Yes. This collection is Telemetry so can be controlled through Firefox's Preferences.

    If the request is for permanent data collection, is there someone who will monitor the data over time?

Yes and No. For the expiring probes (at least CRLITE_UPDATE_TIME_MS and CRLITE_UPDATE_ERRORS so far) they expire in Firefox 75. For non-expiring probes (not sure which will be), :jcj is responsible.

    Using the category system of data types on the Mozilla wiki, what collection type of data do the requested measurements fall under?

Category 1, Technical. (( Even some mild hint of users being behind an Intranet isn't really Interaction data, IMO. ))

    Is the data collection request for default-on or default-off?

Default on for all channels.

    Does the instrumentation include the addition of any new identifiers?

No.

    Is the data collection covered by the existing Firefox privacy notice?

Yes.

    Does there need to be a check-in in the future to determine whether to renew the data?

Some of the collection is permanent. But :jcj is responsible for renewing or removing the expiring parts of the collection before it expires in Firefox 75.

---
Result: datareview+

Comment 6

[J.C. Jones [:jcj] (he/they)]

Thanks, Chris!

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: bug 1488865 - import CRLite enrollment state r?jcj r?KevinJacobs

This patch saves the CRLite enrollment state of every preloaded intermediate to
cert_storage. This is an intermediate (hah) step towards actually checking
CRLite state. We still have to implement downloading and updating the CRLite
bloom filter cascades and implement checking these filters when we encounter a
certificate issued from an enrolled intermediate (this work will be done in
future bugs).

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/04294661134a
import CRLite enrollment state r=jcj,KevinJacobs

Comment 10

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/04294661134a