744926 - Hang Detector and Reporter

Status: VERIFIED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Who is/are the point of contact(s) for this review?
    
Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
    
Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
    
Does this request block another bug? If so, please indicate the bug number This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?

Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)

Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?

Are there any portions of the project that interact with 3rd party services?

Will your application/service collect user data? If so, please describe 

If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):

Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

:vladan once these are answered please assign the bug back to me so the security team can triage this and assign and act on this appropriately. We file these bugs so we can track our activities with regards to security reviews and actions.

Comment 2

[Vladan Djeric (:vladan)]

(In reply to Curtis Koenig [:curtisk] from comment #0)
> Who is/are the point of contact(s) for this review?
That's me

> Please provide a short description of the feature / application (e.g.
> problem solved, use cases, etc.):
https://wiki.mozilla.org/index.php?title=Privacy/Reviews/SnappySymbolicServer#Architecture

> Please provide links to additional information (e.g. feature page, wiki) if
> available and not yet included in feature description:
https://wiki.mozilla.org/Snappy_Symbolication_Server
https://wiki.mozilla.org/Security/Reviews/SnappySymbolSrv
https://wiki.mozilla.org/index.php?title=Privacy/Reviews/SnappySymbolicServer


> Does this request block another bug? If so, please indicate the bug number
> This review will be scheduled amongst other requested reviews. What is the
> urgency or needed completion date of this review?
There isn't a bug for it yet, but the sec-review and privacy reviews do block the public deployment of the Symbolication Server.
The Symbolication Server is needed for some features of the SPS profiler and the about:telemetry extension on Windows.

> Please answer the following few questions: (Note: If you are asked to
> describe anything, 1-2 sentences shall suffice.)
> 
> Does this feature or code change affect Firefox, Thunderbird or any product
> or service the Mozilla ships to end users?
No.

> Are there any portions of the project that interact with 3rd party services?
No.

> Will your application/service collect user data? If so, please describe 
The service receives call stacks from Firefox users for symbolication but it does not store this information anywhere.

> If you feel something is missing here or you would like to provide other
> kind of feedback, feel free to do so here (no limits on size):
> 
> Desired Date of review (if known from
> https://mail.mozilla.com/home/[e-mail]/Security%20Review.html)
> and whom to invite.
I think David Chan has already completed the review in bug 744126, and I have fixed the bugs he has reported.

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

:dchan is this already covered, can we close this bug?

Comment 4

[Vladan Djeric (:vladan)]

This feature was landed back in Firefox 13 in bug 712109.. I'm not sure if it needs additional security review. The data submitted and the server side were reviewed in bug 744126 and https://wiki.mozilla.org/index.php?title=Privacy/Reviews/SnappySymbolicServer

Comment 5

[David Chan [:dchan]]

Going to close this bug off. The review was completed.