872027 - Mi Movistar in partner customizations is not valid application that may not be built by the site owner

Status: RESOLVED INVALID

(Tech Evangelism Graveyard :: Preinstalled B2G Apps, defect)

Description

[Jason Smith [:jsmith]]

The mi movistar is a not valid application against what we define as an app in our ecosystem at all. The app attempts to take a website, add a wrapper around it, and control what site renders by analyzing the SIM. This is not allowed per our policy for how apps are designed in our ecosystem - apps primarily have to operate in the context of their origin primarily. A different bug (bug 869369) also reveals the fact that this app might have not even have been built by Movistar either - we're getting a desktop site on FF OS. This means that Movistar didn't even test their own app at all or it was built by a non-Movistar vendor.

The right fix this problem would require either use of the sub-domains on a per locale basis in each customization or require a creation of a true packaged app for this app.

Comment 1

[Karen Ward [:kward]]

The app was reviewed by out security team several weeks ago.  I will follow up with Telefonica team, QA, and Security on an urgent basis.

Comment 2

[Jason Smith [:jsmith]]

(In reply to [e-mail] from comment #1)
> This app passed security review several weeks ago.  I will follow up with
> QA, Security & Telefonica teams on an urgent basis.

Whether this passes security review or not is irrelevant to the concerns brought up here. We can't reliably put apps as preinstalls if we know the app developer doesn't even have the underlying site being used here compatible with Firefox OS.

Comment 3

[Karen Ward [:kward]]

New app using read only Moz Connection API being submitted today via Marketplace with developer contacts, so I am closing this as resolved invalid for lack of a better drop down selection. The new app will go on V1.1 devices forward.