843407 - SecReview: Persona team KPI dashboard security review update

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Katie Parlante]

Who is/are the point of contact(s) for this review?

Katie Parlante (kparlante)

Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
KPI Dashboard for Persona Team: https://id.etherpad.mozilla.org/persona-kpi-security-review

Does this request block another bug? If so, please indicate the bug number
Tracked in github: https://github.com/mozilla/browserid/issues/2831

This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?
We're hoping to get this through quickly, but its a Q1 goal.

To help prioritize this work request, does this project support a goal specifically listed on this quarter's goal list? If so, which goal?
Yes, Persona KPI dashboard live with production data

Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?
Yes, the Persona sign-in service

Are there any portions of the project that interact with 3rd party services?
The kpi-dashboard and kpiggybank servers will be hosted on AWS.

Will your application/service collect user data? If so, please describe
Yes: https://id.etherpad.mozilla.org/persona-kpi-security-review

If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):
We've already gone through reviews, we need to discuss the changes due to AWS deployment. See: https://id.etherpad.mozilla.org/persona-kpi-security-review

Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.
Soon? Friday?

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

marked for triage on 27-Feb-2013

Comment 2

[Katie Parlante]

Yvan, could we get a date by which you'll let us know of any problems or concerns? If we can identify any issues by 3/15, that gives us a window to fix and test to make our Q1 goal. Thanks!

Comment 3

[Yvan Boily [:ygjb][:yvan]]

Hi Katie,
This secreview is underway, and I expect to finish this week.

Comment 4

[Edwin Wong [:edwong]]

Checking in on the status of the review.  We had hope to ship on 3/29 and currently blocked by this review completion.  Please let us know where we're at.  Thanks.

Comment 5

[Yvan Boily [:ygjb][:yvan]]

This is good to go pending a green light from the opsec team; I will ask Joe to comment here when that is ready to go.

Comment 6

[Yvan Boily [:ygjb][:yvan]]

Joe: anything further needed by your team here?

If not I will mark the bug as fixed.

Comment 7

[Joe Stevensen [:joe]]

Nothing for us to do here.