625217 - security review for panorama

Status: RESOLVED FIXED

(Firefox Graveyard :: Panorama, defect)

Description

[chris hofmann]

basic outline of the process and template is here:  

https://wiki.mozilla.org/Security/ReviewTemplate

ian, can you participate, and round up any others that might be helpful so we could do a quick review?

I'll suggest next Monday afternoon pacific time, and I can set up conf. call and meeting room for anyone that can attend here in mt. view.

If we discover any areas of vulnerability as part of the review we can spin off tracking bugs from this one.

Comment 1

[Michael Yoshitaka Erlewine [:mitcho]]

Next Monday afternoon works for me.

Comment 2

[Ian Gilman [:iangilman]]

Sounds good; Monday afternoon works for me as well. CC-ing some others who may or may not be interested.

Comment 3

[chris hofmann]

Sounds like Monday is a holiday in the US.  How about Wed. at 3p pacific?

Comment 4

[Michael Yoshitaka Erlewine [:mitcho]]

(In reply to comment #3)
> Sounds like Monday is a holiday in the US.  How about Wed. at 3p pacific?

Holiday!? The Panorama team doesn't have holidays! ;)

I'll be getting out of an appointment just around that time... would 3:30 pacific work?

Comment 5

[chris hofmann]

ok, I'll set that up and we can adjust if needed.

Comment 6

[Ian Gilman [:iangilman]]

3:30 Pacific on Wednesday works for me as well.

Comment 7

[chris hofmann]

I did a quick search of the wiki to build this list of background info for the items in the security template.  Fee free to update or add to any good background info links to help get people up to speed for for the review.

Background links

    design docs or internal specifications
    feature-tracking bug links

       https://wiki.mozilla.org/Firefox/Projects/TabCandy
       https://wiki.mozilla.org/Firefox/Projects/TabCandy/FAQ
       https://wiki.mozilla.org/Firefox/Projects/TabCandy/Work#Bugs

       recent developments (beta9?)
       https://wiki.mozilla.org/Firefox/Projects/UX_Priorities#Panorama

    public specifications (RFC's, W3C specs, IETF Drafts, etc)
       n/a
       https://wiki.mozilla.org/Firefox/Projects/TabCandy#Problem_Space

    data flow or entity relation diagrams

    links to other implementations of the feature 

    Test Plan
       https://wiki.mozilla.org/QA/Mozmill_Test_Automation/Panorama_Testing

Comment 8

[Ian Gilman [:iangilman]]

Yup, that's about what we've got...most of it's not terribly up to date, unfortunately. At this point the most reliable source on what Panorama does is Panorama itself. 

There's also the code documentation: 

http://hg.mozilla.org/labs/tabcandy/raw-file/tip/content/doc/index.html

Comment 9

[(no longer active)]

Is there a wiki page for the security review?

Comment 10

[Ian Gilman [:iangilman]]

(In reply to comment #9)
> Is there a wiki page for the security review?

This bug is the definitive source for this review as far as I know (I'm new to this process).

Comment 11

[Daniel Veditz [:dveditz]]

(In reply to comment #10)
> (In reply to comment #9)
> > Is there a wiki page for the security review?
> 
> This bug is the definitive source for this review as far as I know (I'm new to
> this process).

In the past we've linked to pages on the wiki:
https://wiki.mozilla.org/Security/Reviews/Firefox4#Front_End
https://wiki.mozilla.org/Security/Reviews/Firefox4/Tab_Panorama_Security_Review

Comment 12

[Ian Gilman [:iangilman]]

I guess since we've done the review, this bug is resolved? I don't really know how this works, so please re-open if that's not the right thing to do.