744966 - Use PFS2 as Plugin Finder data source

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Who is/are the point of contact(s) for this review?
    
Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
    
Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
    
Does this request block another bug? If so, please indicate the bug number This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?

Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)

Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?

Are there any portions of the project that interact with 3rd party services?

Will your application/service collect user data? If so, please describe 

If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):

Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 1

[Kev Needham [:kev]]

(In reply to Curtis Koenig [:curtisk] from comment #0)
> Who is/are the point of contact(s) for this review?

Me. See https://wiki.mozilla.org/Firefox/Features/PFS2_datasource.
     
> Please provide a short description of the feature / application (e.g.
> problem solved, use cases, etc.):

It's in the feature page, but it's essentially moving the Plugin Finder Service from an AMO-hosted python script to the facility that is built-in to plugins.mozilla.org. 

Full scoping is at https://wiki.mozilla.org/PFS2 (this is a completed service that has some open questions on perf/load capacity)

> Please provide links to additional information (e.g. feature page, wiki) if
> available and not yet included in feature description:

Not applicable. What's in the feature page and product currently should be sufficient.

> Does this request block another bug? If so, please indicate the bug number
> This review will be scheduled amongst other requested reviews. What is the
> urgency or needed completion date of this review?

Not that I believe.

> Please answer the following few questions: (Note: If you are asked to
> describe anything, 1-2 sentences shall suffice.)
> 
> Does this feature or code change affect Firefox, Thunderbird or any product
> or service the Mozilla ships to end users?

It changes the data source for an existing Firefox feature to use a backend driven by a db instead of a big 'ole hacky python script that's essentially a giant if/else statement.

> Are there any portions of the project that interact with 3rd party services?

Clients are referred to third-party websites to download plugins capable of rendering the content we don't render natively.

> Will your application/service collect user data? If so, please describe 

No information is collected and stored. User agent and mime-type information is submitted to the service, but nothing that is user=specific.

PLease let me know if context around the review can be required. AFAIK plugins.mozilla.org has aleady passed a review, and it'd be helpful to understand the goals of the review and what the specific concerns are.

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

After looking at this in traige, there is no further need to review.