838174 - [Security Review] VPS for Mozilla Buddycloud instance

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

1) Who is/are the point of contact(s) for this review?
2) Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
3) Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
4) Does this request block another bug? If so, please indicate the bug number
5) This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?
6) To help prioritize this work request, does this project support a goal specifically listed on this quarter's goal list?  If so, which goal?
7) Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)
7a) Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?
7b) Are there any portions of the project that interact with 3rd party services?
7c) Will your application/service collect user data? If so, please describe
8) If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):
9) Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 2

[Michael Burns [:mburns]]

Curtis, per bug 781964#c7 we won't be using any Mozilla infra for this, just an external VPS for :Leo to run some community projects on.

Does this still require a sec review?

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

(In reply to Michael Burns [:mburns] from comment #2)
> Curtis, per bug 781964#c7 we won't be using any Mozilla infra for this, just
> an external VPS for :Leo to run some community projects on.
> 
> Does this still require a sec review?

I don't think so but since I'm not the assigned resource I am going to let mgoodwin make the final call.

Comment 4

[Simon Bennetts [:psiinon]]

Had a chat with mburns via irc
This is just a test instance which will run on an allizom domain.
On that basis I dont think it needs a sec review.
However if Buddycloud is adopted then it will need a sec review.