QA/Browser Technologies/Services/Releases/BrowserID 12282011

Information

• Train 17: 12-28-2011

Links

• Bugs/Issues: https://github.com/mozilla/browserid/issues
• Test Plan: https://wiki.mozilla.org/QA/BrowserID/TestPlan
• Weekly Train Wiki: https://wiki.mozilla.org/QA/BrowserID/BrowserID_Weekly_Trains_Beta
• Stage Test Wiki: internal site TBD
• Stage Server: https://diresworb.org
• Stage Client/RP1: http://beta.myfavoritebeer.org
• Stage Client/RP2: http://beta.myfavoritebooze.org
• Stage Client/RP3: http://beta.myfavoriteshow.org
• Stage Client/RP4: http://carrera.databits.net:9999

• New Dev Server: https://dev-browserid.services.mozilla.com
• New Dev Client: http://beer.mtv1.dev.svc.mozilla.com

• Old Dev Server: https://dev.diresworb.org
• Old Dev Client/RP1: http://dev.myfavoritebeer.org
• Old Dev Client/RP2: http://dev.myfavoritebooze.org
• Old Dev Client/RP3: http://dev.myfavoriteshow.org

Deployment Ticket

• bug 713961 - QA and deploy BrowserID train-2011.12.28 to production

ChangeLog

• 12/28: ChangeLog including issues resolved
  • https://github.com/mozilla/browserid/blob/train-2011.12.28/ChangeLog#L1-28

Versions

• Beta: no longer available
• old Dev: https://dev.diresworb.org/ver.txt
  • 98ab87c Adding vepbundle.js to the main site js.
• Prod: https://browserid.org/ver.txt
  • f8c2efd merge hotfix for issue #754 into beta: train-2011.12.08
• new Dev: https://dev-browserid.services.mozilla.com/ver.txt
  • f8c2efd merge hotfix for issue #754 into beta: train-2011.12.08
• Stage: https://stage-browserid.services.mozilla.com/ver.txt
  • 08b727e ChangeLog update for issue #800

Heartbeat

• old Dev: https://dev.diresworb.org/__heartbeat__
  • ok
• old Prod: https://browserid.org/__heartbeat__
  • ok
• Dev: https://dev-browserid.services.mozilla.com/__heartbeat__
  • ok
• Stage: https://diresworb.org/__heartbeat__
  • ok

Processes

• webheads
  • /usr/bin/node bin/browserid
  • /usr/bin/node bin/verifier
  • /usr/bin/node /opt/browserid/lib/verifier/verifier-compute.js
  • /usr/bin/node /opt/browserid/lib/bcrypt-compute.js
• secure webheads
  • /usr/bin/node bin/dbwriter
  • /usr/bin/node /opt/browserid/lib/bcrypt-compute.js
• keysigners
  • /usr/bin/node bin/keysigner
  • /usr/bin/node /opt/browserid/lib/keysigner/keysigner-compute.js
• databases: various mysql processes
• zeus: various zeus processes

Unit Tests

• Front-End Unit Tests
  • Pass
• Back-End Unit Tests
  • Pass
• Headless Front-End Unit Tests
  • Pass

New/Updated OPs Tickets and Issues

• bug 713691 - bid webheads: monitor /wsapi/have_email
• bug 715183 - BrowserID: Get Production running latest node and npm
• bug 715350 - browserid: monitor node memory usage

New/Updated APPs Tickets and Issues

• bug 708086 - Cannot log-in to BrowserID on Dashboard or to https://apps-preview-dev.allizom.org using Opera
• bug 715027 - [prod] [stage] Affiliates: Logging in via BrowserID sporadically fails with a 403

Resolved/Closed Bugs and Issues

• bug 713691 - bid webheads: monitor /wsapi/have_email
• bug 695963 - browserid: coordinate log collection with metrics
• [BrowserID issue 73] : email verification link should ask for confirmation
• [BrowserID issue 76] : create a 'Tools' page on browserid.org
• [BrowserID issue 114] : add ability to change password
• [BrowserID issue 229] : Relay frame
• [BrowserID issue 235] : The submit button looks weird on iOS
• [BrowserID issue 242] : make sure only one relay iframe is ever created
• [BrowserID issue 348] : manage page showing up by default is uncomfortable
• [BrowserID issue 359] : iphone4 screens are jumbled
• [BrowserID issue 363] : error message needed on sign up page if not using email address.
• [BrowserID issue 498] : Cannot authenticate with dev.myfavoritebeer.org - /api/login always returns null
• [BrowserID issue 528] : Verify user screen has no directions once the user has entered password
• [BrowserID issue 546] : static resources served with improper headers
• [BrowserID issue 551] : dialog window is very wide in Firefox 8
• [BrowserID issue 555] : chrome: Unable to post message to http://127.0.0.1:10002. Recipient has origin http://localhost:10001.
• [BrowserID issue 590] : Opera and Opera Mobile in Android "Relay frame could not be found" Problem.
• [BrowserID issue 613] : new Dev/Stage: not seeing any *-error.log files
• [BrowserID issue 615] : IE8: diresworb.org is missing formatting and layout
• [BrowserID issue 621] : "Relay frame could not be found" Problem in Opera and Opera Mobile in Android
• [BrowserID issue 632] : beta.myfavoriteshow.org email field allows all matter of silliness...
• [BrowserID issue 638] : IE8 broken on dev
• [BrowserID issue 639] : IE9: Beer and Booze names are not being stored/used.
• [BrowserID issue 652] : Add a script to clean up from compress.sh
• [BrowserID issue 664] : SEC7111 error on beta.myfavoritebooze.org in Win7/IE9
• [BrowserID issue 665] : add check to ensure requiredEmail is actually an email address.
• [BrowserID issue 676] : remove the inline script in relay.ejs - it will break CSP
• [BrowserID issue 678] : check that requiredEmail is a true email in the dialog
• [BrowserID issue 690] : rename qunit.html to index.html
• [BrowserID issue 698] : New email is not marked as "last used" after logout, Sign In
• [BrowserID issue 700] : clean up production front end build
• [BrowserID issue 703] : Confusing behavior when trying to add an email already associated to the BrowserID account in use
• [BrowserID issue 719] : diresword.org returns "You are offline" (Stock browser, Android 2.3.4)
• [BrowserID issue 725] : Delayed email verification does not seem to be working
• [BrowserID issue 732] : Signing in already known email will prompt to confirm your mail address
• [BrowserID issue 738] : Handle 503 on the front end
• [BrowserID issue 747] : Sample RP too wide for mobile devices
• [BrowserID issue 754] : cancel forgot password is not working on required email flow.
• [BrowserID issue 756] : verification email comes from "no reply"
• [BrowserID issue 758] : remove all trailing whitespace from all files.
• [BrowserID issue 764] : consider migrating to winchan
• [BrowserID issue 765] : Cancel "Use Different Email" not working in dev.
• [BrowserID issue 766] : channel.js no longer needed
• [BrowserID issue 771] : XHR mock: session_context call unnecessarily difficult to use.
• [BrowserID issue 776] : old Dev: dev.myfavoritebooze.org does not always "keep me signed in"
• [BrowserID issue 780] : Confusing behavior when trying to add an email already associated to the currently used BrowserID account
• [BrowserID issue 782] : load_gen: fix Usage information
• [BrowserID issue 799] : Stage: Currently unable to sign in due to Internal Server Error
• [BrowserID issue 800] : fix csrf token generation
• [BrowserID issue 804] : IE8: Cancelling a "Use a different email" path closes the pop-up
• [BrowserID issue 811] : Dev: Password change does not work in IE8/WinXP
• [BrowserID issue 814] : It is possible to "combine" accounts through myfavoriteshow.org
• [BrowserID issue 819] : Dev: dev.diresworb.org main page is mostly blank
• [BrowserID issue 823] : Cannot log in to BrowserId using stock browser on Froyo
• [BrowserID issue 13] : verifier.browserid.org
• [BrowserID issue 259] : check timestamps in cert chains
• [BrowserID issue 260] : turn up crypto parameters for certs
• [BrowserID issue 237] : call window.focus() on the popup window
• [BrowserID issue 382] : Make a live link of MPL on the TOS page
• [BrowserID issue 441] : E-mail messages from browserid.org have bad DKIM signatures (according to Yandex.ru)
• [BrowserID issue 489] : relay.js->browserid_relay is called twice whenever assertion is generated
• [BrowserID issue 499] : BrowserID UI breaks Firefox password manager
• [BrowserID issue 506] : The following assertion returns an Internal Server Error; also, server should return JSON errors, not HTML
• [BrowserID issue 563] : Getting error on login post - on local and live sites
• [BrowserID issue 564] : Localization?
• [BrowserID issue 569] : User Profile info needed.
• [BrowserID issue 573] : KEYSIGNER_URL should not be full
• [BrowserID issue 585] : in dev, inclusion of include.js causes 8 transactions costing 300k
• [BrowserID issue 592] : Beta/Prod: email verifications not getting sent to email providers
• [BrowserID issue 593] : Opera: Closing SignIn window with "x" results in beer site not getting reset.
• [BrowserID issue 594] : Better logging for email delivery
• [BrowserID issue 597] : Determine internal JS API in dialog for auto-approval by modified web envs
• [BrowserID issue 601] : build pagemod-ready API
• [BrowserID issue 608] : share forgot password screens in main dialog flow and required email flow.
• [BrowserID issue 618] : Nintendo 3DS browser unsupported
• [BrowserID issue 619] : Nintendo 3DS browser unsupported
• [BrowserID issue 628] : BrowserID popup is blocked by Firefox
• [BrowserID issue 687] : Split off the actions from the dialog controller to make it easier to test.
• [BrowserID issue 689] : Login sessions inconsistency
• [BrowserID issue 692] : too many links in emails
• [BrowserID issue 694] : analyze and maybe implement bcrypt out of process
• [BrowserID issue 706] : User is uninformed while key/assertion is being generated.
• [BrowserID issue 709] : improve animation during cert/assertion procedures in dialog
• [BrowserID issue 735] : move to crypto.getRandom
• [BrowserID issue 748] : fixes in dialog communication channel
• [BrowserID issue 779] : BrowserID hangs on "Communicating with server" on iPad (iOS5)
• [BrowserID issue 789] : use crypto.getRandom instead of urandom
• [BrowserID issue 816] : package.json is missing a few dependencies
• [BrowserID issue 830] : Unable to post message to https://browserid.org. Recipient has origin http://localhost:8888.

Verified As Still Open, Reopened, or Updated : Server

• bug 698044 - browserid: setup production backups
• bug 706572 - Document best practices for localizing node.js services
• [BrowserID issue 2] : IP should check for primary support upon email addition
• [BrowserID issue 5] : Implement anonymous email support
• [BrowserID issue 9] : develop the primary pitch
• [BrowserID issue 16] : cert refresh when dropped in by primary
• [BrowserID issue 72] : Mozilla Security Review of browserid
• [BrowserID issue 80] : l18n: BR-pt
• [BrowserID issue 81] : l18n: FR-fr
• [BrowserID issue 83] : l18n: nl_NL & nl_BE
• [BrowserID issue 105] : l18n: DE-de
• [BrowserID issue 237] : call window.focus() on the popup window
• [BrowserID issue 257] : A cert can be dropped to the browser without being authenticated with BrowserID.
• [BrowserID issue 298] : mix in the server seed into the client entropy pool, fixes
• [BrowserID issue 386] : The "Use a different email" link is confusing or add separate functionality for adding emails
• [BrowserID issue 421] : Functionality for adding emails should also be added in the Account Manager
• [BrowserID issue 475] : Refreshing the Sign in dialog/tab closes it
• [BrowserID issue 536] : need log rotation for keysigner
• [BrowserID issue 607] : Resolve issues around account consolidation.
• [BrowserID issue 708] : can't sign-in with stock browser on android
• [BrowserID issue 719] : diresword.org returns "You are offline" (Stock browser, Android 2.3.4)
• [BrowserID issue 728] : Support Center link should open a new tab/window
• [BrowserID issue 730] : Verification email text is incorrect for forgotton passwords.
• [BrowserID issue 732] : Signing in already known email will prompt to confirm your mail address
• [BrowserID issue 787] : load_gen: Fix code to better handle failures due to up-front overloading
• [BrowserID issue 800] : added random seed in session context and in the process improved CSRF token entropy fixes
• [BrowserID issue 810] : Dev: Account Manager password section not working right for IE8.

Verified As Still Open, Reopened, or Updated : Client

• None

Opened Bugs/Issues For This Week: Server

• [BrowserID issue 814] : It is possible to "combine" accounts through myfavoriteshow.org
• [BrowserID issue 819] : Dev: dev.diresworb.org main page is mostly blank
• [BrowserID issue 824] : Stage: All the help links together on diresworb.org seem like overkill
• [BrowserID issue 825] : Back-end unit tests failing on local install
• [BrowserID issue 826] : CentOS: local install now failing with dbwriter error
• [BrowserID issue 834] : Android4: RPs will not render to correct size
• [BrowserID issue 836] : load_gen: Re-fix usage information
• [BrowserID issue 838] : load_gen: sporadic 400s during med-sized load test
• [BrowserID issue 815] : Android: clicking the email address fires the App launcher
• [BrowserID issue 821] : first time login flashes leftover dialog text saying "hardcore crypto"
• [BrowserID issue 818] : Confusing message displayed when trying to add to BID an email address already associated to it
• [BrowserID issue 828] : Small trace left in checkbox on Firefox (linux) in e-mail list screen
• [BrowserID issue 837] : Change password UI allows entry of password length < 8

Opened Bugs/Issues For This Week: Client

• None

Other Open Bugs

• [BrowserID issue 813] : moved to new assertion format, added a bunch of tests to check both old
• [BrowserID issue 816] : package.json is missing a few dependencies
• [BrowserID issue 817] : Turn license URL in ToS into a clickable link (closes #382)
• [BrowserID issue 820] : IE8: change all background-color: rgba(x,x,x,x) to use a normal hex value.
• [BrowserID issue 822] : limit the size of POST body
• [BrowserID issue 827] : IE8/WinXP - cannot authenticate to dev.diresworb.org
• [BrowserID issue 829] : if session expires in the middle of user using it, problems
• [BrowserID issue 830] : Unable to post message to https://browserid.org. Recipient has origin http://localhost:8888.
• [BrowserID issue 831] : JavaScript errors in IE7
• [BrowserID issue 832] : Feature encrypt session cookie
• [BrowserID issue 833] : sporadic test failures in verifier-test
• [BrowserID issue 835] : Generic error message when authenticating with cookies disabled.
• [BrowserID issue 839] : the browserid process consumes too much memory
• [BrowserID issue 840] : Shortened email displayed in browserid.org/signup page
• [BrowserID issue 841] : Present site's TOS and privacy policy to user
• [BrowserID issue 842] : email sent when forgetting password is confusing
• [BrowserID issue 843] : Add "add email" button to manage page
• [BrowserID issue 844] : BrowserID logo in header of dialog_layout an image
• [BrowserID issue 845] : new user set password does not check max password length

Notes

• Lloyd's notes
  • train-2011.12.08 rolled into production today at 2pm pacific time, with zero downtime (our new production environment and pro services team mean weekly trains and hotfixes roll with *zero* user visible downtime). This train *finally* brings IE8 support into production. Give it a test! Next up, in our staging environment is train-2011.12.28, with a c-c-c-crazy pile of changes [1]. Here's a couple highlights:
  • many fixes for mobile platforms and fringe browsers
  • the new code performs better, handles million ADU bursts with ease, and fails more gracefully
  • you can change your password now (finally!)