836533 - Security Review for Geolocated Snippets

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Justin Crawford [:hoosteeno] [:jcrawford]]

Initial Questions:

Project/Feature Name: Geolocated Snippets
Tracking  ID:836099
Description:
Firefox OS will land on devices in specific countries at different times. This project will allow us to use the snippets area of about:home to notify users only in those countries about the availability of Firefox OS devices. 
Additional Information:
https://wiki.mozilla.org/Websites/Snippets/Geolocated-Snippets
Urgency: 2 days
Key Initiative: Firefox OS
Release Date: 2013-04-02
Project Status: active
Mozilla Data: Yes
New or Change: Existing
Mozilla Project: Marketing Initiative
Mozilla Related: snippets in about:home, the default home page for browser users.
Separate Party: Yes

Security Review Questions:

Affects Products: Yes
Review Due Date: 2013-03-11
Review Invitees: Justin Crawford, Winston Bowden, Mike Kelly, Chris More
Extra Information:

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

we should triage this at the 2013.02.06 triage session
However, we have reviewed snippets already, what is different about geolocated ones?

Also please answer these questions to get a better idea of the need here:
1) Who is/are the point of contact(s) for this review?
2) Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
3) Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
4) Does this request block another bug? If so, please indicate the bug number
5) This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?
6) To help prioritize this work request, does this project support a goal specifically listed on this quarter's goal list?  If so, which goal?
7) Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)
7a) Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?
7b) Are there any portions of the project that interact with 3rd party services?
7c) Will your application/service collect user data? If so, please describe
8) If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):
9) Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 2

[Justin Crawford [:hoosteeno] [:jcrawford]]

Thanks Curtis.


> However, we have reviewed snippets already, what is different about
> geolocated ones?

Until now we have used locales to determine the appropriate snippets to offer people on about:home. With this change, we'll look up a user's IP address in a database to find the country that user is in. The database will be exposed in a web service (hosted by mozilla) that will be accessed by browser javascript. 

> Also please answer these questions to get a better idea of the need here:
> 1) Who is/are the point of contact(s) for this review?

I think myself (hoosteeno), Chris More (cmore), Winston Bowden (wbowden).

> 2) Please provide a short description of the feature / application (e.g.
> problem solved, use cases, etc.):

Using the mechanism described above we will provide information to viewers of about:home that is specific to viewers in a particular country. 

The initial use case of this is to alert users that a FirefoxOS device is available in their country. This change is necessary because FirefoxOS devices do not become available across locales; they generally only become available in a particular country.


> 3) Please provide links to additional information (e.g. feature page, wiki)
> if available and not yet included in feature description:

https://wiki.mozilla.org/Websites/Snippets/Geolocated-Snippets

> 4) Does this request block another bug? If so, please indicate the bug number
> 5) This review will be scheduled amongst other requested reviews. What is
> the urgency or needed completion date of this review?

This project is urgent. We hope the security review will finish by 3/15/13. A complete timeline is available at the wiki page linked above. 

> 6) To help prioritize this work request, does this project support a goal
> specifically listed on this quarter's goal list?  If so, which goal?

This project supports FirefoxOS.

> 7a) Does this feature or code change affect Firefox, Thunderbird or any
> product or service the Mozilla ships to end users?

Indirectly it affects Firefox Desktop and a large portion of users of that product, since about:home is the default homepage for the browser.

> 7b) Are there any portions of the project that interact with 3rd party
> services?

No. 

> 7c) Will your application/service collect user data? If so, please describe

It will collect the IP of the request and return the country associated with that IP. It will not store IPs any more than any Mozilla web server does. It will not store the result of the lookup on the server. It will store the result of the lookup in the browser for a short while to minimize the number of requests necessary to provide this service.


> 9) Desired Date of review (if known from
> https://mail.mozilla.com/home/[e-mail]/Security%20Review.html)
> and whom to invite.

3/11/13.

Please invite me, and I'll invite others as needed.

Comment 3

[Justin Crawford [:hoosteeno] [:jcrawford]]

(An additional note supplementing the above)

This project is a Q1 goal for Community + Engagement.

Comment 4

[Justin Crawford [:hoosteeno] [:jcrawford]]

Hi-

Development is on track for this project. Can we look forward to a security review next week?

Thanks!

Comment 5

[Justin Crawford [:hoosteeno] [:jcrawford]]

The geolocation service is online here:

http://geo.mozilla.org/country.json

Its code is here:

https://github.com/mozilla/geodude

There is a client-side component still under development.

Comment 6

[Justin Crawford [:hoosteeno] [:jcrawford]]

The new client-side code is now online. This means there is a working end-to-end system ready for review. I added instructions for doing so on the wiki:

https://wiki.mozilla.org/Websites/Snippets/Geolocated-Snippets#Testing_on_Staging

Comment 7

[Justin Crawford [:hoosteeno] [:jcrawford]]

Update: We're in the final days of testing and tweaking this system before launch. Please reach out with any concerns about launching the service as it is currently deployed. Thanks!

Comment 8

[Yvan Boily [:ygjb][:yvan]]

Hi Justin, your review is next up, I am finishing up an Identity review today, but unless there were substantial changes to this since its original design, I should be able to complete this fairly quickly.

Comment 9

[Yvan Boily [:ygjb][:yvan]]

The security review is completed.