Apps/StatusMeetings/Engineering/2012-10-31

Details

• Time: 9:05 - 9:55 AM PT (16:05 - 16:55 UTC)
• Backchannel:
  • irc.mozilla.org #openwebapps
• Virtual Location:
  • "Mozilla Apps" Vidyo room
• Physical Locations:
  • Mountain View: 3A - All Your Base
  • San Francisco: 324 - Bay Bridge
• Audio-only Access:
  • +1-650-903-0800 or +1-650-215-1282, x92, conf#: 98652 (US/INTL)
  • +1-800-707-2533, pin: 369, conf#: 98652 (US toll free)
• etherpad for taking minutes

Agenda

P1 Firefox OS Basecamp

• Significant Updates
  • More dev doc bugs incoming - Tracking Bug
  • Note - Custom CSP support has landed - make sure you understand the impact in your relevant area
  • Dogfooding, Unagi, and FF OS with Apps and Marketplace
  • 3rd Party App Updates for FF OS has landed
  • Update from Infrastructure? (Toby or Mark?)
  • payments (caitlin)
• Checkin/Status on Major Challenges
• Questions and Concerns
  • Need to come to final decision on clarity on JWT validation for payments - keep what we have, or pull it onto the server?
  • Have we really finalized the user stories for the trustworthy UI in payments? - bug 806425
• Suggestion to add Triage to this meeting (Caitlin / David B)
  • FFOS B2G Marketplace

P2/3 Other Projects

• Significant Updates
  • Android WebRT analyzed feedback - need to rethink uninstall app UX as top priority
  • Next week: Dev Ecosystem work week in Mountain View
    • Themes: reference apps initiative; MDN/Devhub integration
• Checkin/Status on Major Challenges
  • Progress on Payments for Android?
• Questions and Concerns
  • Any outstanding questions on feedback from Marketplace Aurora Release?
  • Need estimates for bringing packaged apps to Android
  • Need estimates for bringing app security model to Android

Minutes

dev doc bugs

• more dev doc bugs incoming
• tracking bug: https://bugzilla.mozilla.org/show_bug.cgi?id=Apps-Dev-Doc-Needed

custom CSP support

• make sure you understand the impact in your relevant area
• CSP is a content security policy
• the ability for a privileged app to specify its own CSP

• we apply a default CSP to all privileged and certified apps
• this change lets apps apply their own policy to get apps working while we debug Gaia apps

• does this help us with packaged apps?
• main issue there is signing, which is overdue
• then we need to fix apps that are breaking the policy
• mostly affects certified apps, we don't have many privileged apps
• list of privileged APIs is here: https://wiki.mozilla.org/WebAPI#APIs
• list of app permissions keywords is here: http://mozilla.github.com/webapps-spec/#optional-properties
• permissions matrix: https://docs.google.com/spreadsheet/ccc?key=0Akyz_Bqjgf5pdENVekxYRjBTX0dCXzItMnRyUU1RQ0E#gid=0
• manifest strings missing from wiki, but part of the permission matrix, or can be looked up here: http://mxr.mozilla.org/mozilla-central/source/dom/apps/src/PermissionsInstaller.jsm#53

• will we disable it eventually?
• we'll leave it in there as we wanted it anyway (in order to enable apps to restrict policies further)
• so it'll remain available and be repurposed

dogfooding Marketplace

• you should get a dogfooding device and dogfood the marketplace!
• remotees can't get one for dogfooding yet
• but employee developers can get one for developing by requesting one via Service Now

third-party app updates

• landed on Gaia!
• packaged third-party apps also working again
• jsmith will be testing and providing feedback shortly

• Marketplace is just about done except for signing
• Marketplace not allowing packaged app uploads until they can sign packages
• rtilder is working on the server-side code
• after which there will be a small amount of server-side integration work for clouserw's team
• self-signed certs

infrastructure

• folks made wiki page listing many ways things can do wrong
• f.e. what if a mysql master, elastic node, load balancer, etc. goes down
• working on triaging, prioritizing, and addressing issues
• https://wiki.mozilla.org/Marketplace/HAtesting

• we are on track for system documentation
• we are in analysis mode, on track to complete analysis
• single point of failure testing
• target dates for HA are in mid-february

• kick-off meeting for analysis is tomorrow
• target date for completing analysis is end of November
• -> telliott to update meeting about status of HA analysis next week

payments

• much to celebrate on payments and identity
• identity patches have landed for Gaia
• one issue remains, broken out into three blocking bugs
• we're trying to fine-tune our interface with the trustee UI
• zaach and jedp are in SF to hack on it today

• five bugs outstanding out of a total of 40 to be feature-complete
• server integration is just kicking off this week
• pmpcat to meet with bango product/project managers this morning to plan next few weeks
• robust sessions with product, UX, developers afterward
• kumar well embedded in Bango structure
• a few days behind feature-complete
• but on track to meet feature-complete this week

• there's a bug blocked on jcarpenter regarding trustworthy UI for payments
• -> jsmith to ask cyee to look at trustworthy payments UI bug while jcarpenter is PTO
  • caseyyee@mozilla.com <-- his bug mail

JWT validation

• bug on doing JWT (JSON Web Token) validation with no clear decision about how it is to be done
• kumar raised concern about it and suggested moving validation to server
• jsmith concerned that too much work being done on server
• sicking agnostic

• ladamski responsible for making decision and will follow up in bug

adding triage to this meeting

• starting to get feedback on Marketplace (from B2G Test Drivers)
• small set of feedback, but we need to start reviewing it
• how about using this meeting to review feedback?
• we seem to have the time for it
• should last no more than fifteen minutes

• there's already a test drivers meeting to review feedback collated by Michelle Luna
• jsmith thinks we should break it out
• also getting feedback from Android users
• rfant thinks we should be able to review them quickly, prioritize, and assign
• myk thinks this meeting is reasonable provided the feedback we review has been curated in advance

• we're going to try this next week and see how it goes

Android WebRT feedback

• need to rethink uninstall UX as top priority
• lots of folks are confused about uninstallation
• challenges due to constraints on Android
• mfinkle is driving this work

• current thinking is that this won't happen for November 20 release
• some question about whether or not we'll make this available on beta

• next week there will be a developer ecosystem workweek in mountain view
• wenzel's entire team will be there along with people from MDN and product
• https://ecosystem.etherpad.mozilla.org/2012Q4Onsite
• join if you want!
• themes: reference apps initiative; MDN/Devhub integration

Marketplace URL change

• question about changing URL: marketplace.mozilla.org -> marketplace.firefox.com
• if we have installs_allowed_from: marketplace.mozilla.org, and marketplace.mozilla.org 301s to marketplace.firefox.com, will the install be allowed?
• sicking is the right person to ask; clouserw will ask him
• jsmith will test if he has time and report findings to clouserw

payments for Android

• nav.pay isn't on Android
• how easy to implement nav.pay on Android?
• probably best answered by fernando (?)
• Android team is working through this

• assuming we get nav.pay on Android, we need contract with payment provider
• rfant is aware

• we might be able to use a window.open()-based implementation of nav.pay
• pmpcat and elancaster are pulling together kumar, jedp and android folks to discuss

• question about when to implement payments and packaged apps
• no concrete roadmap/timeline yet

Marketplace Aurora release issues

• email jsmith if you have outstanding questions about issues that folks have raised

packaged apps on Android

• folks working on it
• join Android-specific Monday meeting to talk about it

app security model on Android

• join Android-specific Monday meeting to talk about it

updates for packaged apps on Android

• join Android-specific Monday meeting to talk about it

Actions

• telliott to update meeting about status of HA analysis next week
• jsmith to ask cyee to look at trustworthy payments UI bug while jcarpenter is PTO