749233 - Security Review of turn on "don't load tabs until selected" by default / Tabs on Demand

Status: VERIFIED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

https://wiki.mozilla.org/Tab_on_demand
1. Who is/are the point of contact(s) for this review?
2. Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
3. Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
4. Does this request block another bug? If so, please indicate the bug number
5. This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?
6. Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)
6a. Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?
6b. Are there any portions of the project that interact with 3rd party services?
6c. Will your application/service collect user data? If so, please describe 
7. If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):
8. Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 1

[Raymond Forbes[:rforbes]]

pinging again for the above information.

Comment 2

[Dietrich Ayala (:dietrich)]

I recommend you communicate directly with the developers of the feature. Bugmail is most assuredly not the best way to directly connect with people and get replies.

You should email these questions to Paolo Amadini (owner of the original bug).

Cheers,

-d

Comment 3

[:Paolo Amadini]

Hello Raymond, thanks for getting in touch! Sorting things out required a bit of
digging, now I've summarized what I found in the feature page itself:

https://wiki.mozilla.org/Tab_on_demand#1._Feature_overview

The relevant piece of information here is that the feature page is about enabling
an existing feature by default, and there has already been a security review about
the original feature in <https://wiki.mozilla.org/Security/Reviews/Firefox4/Cascade_Session_Restore_Security_Review>.

The original outcome was that there was no security impact. I don't think there
are reasons to expect otherwise now, but if you have any additional question or
would like me to provide detailed answers to comment 0, feel free to ask!

Comment 4

[Daniel Veditz [:dveditz]]

This review is complete