974029 - Security Review: Firefox Telemetry Experiments (rev 1)

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Benjamin Smedberg]

Initial Questions:

Project/Feature Name: Firefox Telemetry Experiments (rev 1)
Tracking  ID:973990
Description:
This is the first form of variation testing that we're going to deploy to our Firefox audience by default that doesn't require explicit opt-in.
Additional Information:
PRD: https://docs.google.com/document/d/1GPpkIcWFNkZmXONjqBCc05U3uocOD-1jpZHdAsR0v1k/edit?usp=sharing
Key Initiative: Firefox Desktop
Release Date: 2014-03-17
Project Status: development
Mozilla Data: Yes
Mozilla Related: Firefox desktop, Firefox Health Report, Telemetry
Separate Party: No

Security Review Questions:

Affects Products: Yes
Review Due Date: 2014-02-28
Review Invitees: gps, sstamm, dveditz
Extra Information:
The major known issue is whether we need to do certificate pinning for the experiment manifest serve. Additional review find.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

we want to do a full team reivew of this, what is a good date for you all given available dates on https://mail.mozilla.com/home/[e-mail]/Security%20Review.html

Comment 2

[Benjamin Smedberg]

gregg/gps/gfritzsche does the 27th at 10am PT work?

Comment 3

[Gregory Szorc [:gps]]

I should be able to make that. I'm going to the DMV at 1400 PST that day, so please keep this early.

Comment 4

[Georg Fritzsche [:gfritzsche]]

That would work for me.

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Meeting set: https://mail.mozilla.com/home/[e-mail]/Security%20Review.html?view=month&action=view&invId=400560-400559&pstat=AC&exInvId=400560-420922&useInstance=1&instStartTime=1393524000000&instDuration=3600000

Please fill out this google doc ahead of the meeting to help things go smoothly? Will also allow us to setup the background for everyone:
http://goo.gl/YAgdce

Comment 6

[Benjamin Smedberg]

I don't have access to edit that doc via my @mozilla.com account nor my @gmail.com account.

Comment 7

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

fixed, sorry, I set the share to anyone at with mozilla.com can see it but forgot the second bit to allow you to edit