920244 - Security Review: TogetherJS

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Ian Bicking (:ianbicking)]

Initial Questions:

Project/Feature Name: TogetherJS
Tracking  ID:
Description:
TogetherJS is a service and library for adding real-time collaboration to a website.

The service/server portion is a server that accepts WebSocket connections, and echos those messages between the participants in a session.  Only aggregated usage statistics are saved, everything else is memory-only.

The client library runs on the website (in content) and introspects the page and communicates with everyone else in the session about certain actions that the user takes.
Additional Information:
Site: https://togetherjs.com/
Github: https://github.com/mozilla/togetherjs
Server: https://github.com/mozilla/togetherjs/blob/develop/hub/server.js
JP is handling the ops/deployment: [e-mail] (it is deployed on AWS)

Key Initiative: Labs / Research / H3
Release Date: Continuous releases
Project Status: launched
Mozilla Data: Yes
Mozilla Related: 
Separate Party: No

Security Review Questions:

Affects Products: No
Review Due Date: 
Review Invitees: 
Extra Information:

Comment 1

[Yvan Boily [:ygjb][:yvan]]

Hi Ian,

Do you want us to test this in production, or do you have a stage instance we can use?

Comment 2

[Ian Bicking (:ianbicking)]

Production is fine, as there's no significant persistence.  It might be useful for me to setup an example more suitable for testing, as the on-site examples have somewhat peculiar flows for session creation, to make the demo more compelling.  Are there particularly features you want to concentrate on particularly (so I can make sure they are in the example)?

http://jsfiddle.net/ also has it deployed (as "Collaboration"), and you could use that.  It might be better than a made-up example, and of course it's easy to setup scratch code to test.

Comment 3

[Mark Goodwin [:mgoodwin]]

Some info on how this hangs together (in absence of a napkin sketch): https://togetherjs.com/docs/#technology-overview

Comment 4

[Mark Goodwin [:mgoodwin]]

https://wiki.mozilla.org/Security/Reviews/TogetherJS