Security/Reviews/SnappySymbolSrv

• Property "SecReview feature goal" (as page type) with input value "* Map library offsets to the function name and optionally line information
  • Web application that takes as input a library name, version and address and translate them to the function name
  • Uses the breakpad SYM files for this information
  • Used by the profiler to symbolicate it's trace file
  • Used by telemetry to symbolicate chrome hangs when the browser is froozen
    • uses a build flag that can be disabled
  Server code: https://github.com/vdjeric/Snappy-Symbolication-Server/" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.
• Property "SecReview alt solutions" (as page type) with input value "* Running a symbolication script for the chrome telemetry, but does not address the need of the profiler
  • The profiler could simply download the PDBs, but because these files are so big this would significantly slow down the profiling performance." contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.
  • Property "SecReview threats considered" (as page type) with input value "- any significant privacy concerns?

  - no, only a basic api, no identifiers passed back and forth
  

  - this is the privacy-sensitive way to send back chromehang reports: because the stackwalking occurs on the client, we aren't sending a minidump which may contain user data (this approach chosen in response to prior decision that we could not send minidumps as part of telemetry) - no significant changes to the product code

  - do not want to expose Flash symbols via this API, https://bugzilla.mozilla.org/show_bug.cgi?id=732485 filed" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.
• Property "SecReview threat brainstorming" (as page type) with input value "* fingerprinting via crash info
  • • https://bugzilla.mozilla.org/show_bug.cgi?id=644762
    • https://bugzilla.mozilla.org/show_bug.cgi?id=644892
    • ships only in the profiling branch right now, might go to nightly at some point
    • user must opt-in to 2 add-ons
      • Gecko Profiler Add-on (Developped by BenWa)
      • about:snappy Add-on (Developped by jmuizelaar)" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.

WhobugActionBy WhenCompleted date

curtiskStart a privacy review of the feature/td>by 16-Mar-2011[ON TRACK] https://wiki.mozilla.org/Privacy/Reviews/SnappySymbolicServer

dchanbug 744126code review before migrating to Aurora[DONE] done

1 Total; 0 Open (0%); 1 Resolved (100%); 0 Verified (0%);