1517607 - Security Review for Firebase SDK

Status: RESOLVED WONTFIX

(Firefox for Android Graveyard :: General, enhancement)

Description

[:sdaswani]

We have to integrate the open source Firebase into SDK to support FCM push notifications: https://bugzilla.mozilla.org/show_bug.cgi?id=1510730

Does the security team want / need to review the SDK?

Comment 1

[Kevin Brosnan [:kbrosnan]]

Security reviews don't need to be confidential. If issues are found then the individual bugs can be flagged as such.

Comment 2

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Susheel, can you cc me into bug 1510730? Thanks.

Comment 3

[:sdaswani]

done.

Comment 4

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Dan, Wennie mentioned I could n-i to you for security review, at least until there is some more formal process.

Comment 5

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

It looks like more info may be in bug 1286912.

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to Liz Henry (:lizzard) (use needinfo) from comment #4)

Dan, Wennie mentioned I could n-i to you for security review, at least until there is some more formal process.

There is a process: much like the original pi-request mail-based process but to a different address (which I'm leaving out of this bug to minimize getting on spam lists). I've sent mail to get this request into the queue.

Comment 7

[:sdaswani]

Please hold off on this until I have more clarity on whether we indeed Firebase.