Re: New strings in FxA for train-143

[Shane Tomlinson]

If strings are en-only, we do not "wrap" them in a tag that means
"translate this string." It's a low-tech solution that has worked well so
far. Extracting strings for only a set of locales is something we aren't
currently set up for, and I don't have an estimate on what kind of effort
it would be to make that happen, though I suspect more than non-trivial.

Shane

On Thu, Aug 8, 2019 at 6:03 PM Peiying Mo  wrote:

> Thank you for sharing all the information.
>
> We want to do as much as we can help  communities prioritize their loads,
> including separating the ones that are US market only from the rest. Is
> there a way in the code that can hide these strings from showing up in
> Pontoon? Is it possible to create a separate file for en-US only if that's
> easier to do? In the future, if we decide to open up the strings to Germany
> or France for example, we can add more locales to the file(s).
>
> The communities are aware the importance of FxA product. If some of these
> features will never roll out in their markets, it's a waste of their time
> to translate them, not knowing which ones are required and which ones they
> won't see on staging/production. Many of them don't look at string IDs to
> know where they show up, unless they have questions with a particular
> string, and they look for context.
>
> If we have not thought about separating strings for US only or a couple of
> locales only, we should start thinking of a solution soon.
>
>
>
> On Wed, Aug 7, 2019 at 1:52 AM Shane Tomlinson 
> wrote:
>
>> Unfortunately the changes within the "server.po" resource are all email
>> title strings and are sent to all users. These need
>> to be translated as broadly as possible to avoid people being sent emails
>> with English titles. I'm not sure the l10n impact
>> was considered when making these changes.
>>
>> Within the "client.po" resource, the following strings are available to
>> everyone:
>>
>>- Logins and Passwords
>>- Open Tabs
>>- Credit Cards
>>- By proceeding, you agree to the >/legal/terms\" tabindex=\"-1\">Terms of Service and >\" href=\"/legal/privacy\" tabindex=\"-1\">Privacy Notice.
>>- You've connected your Firefox account to Mozilla products that keep
>>you secure and productive on the web:
>>- Please acknowledge that by deleting your account:
>>- Any subscriptions you have will be cancelled
>>- You may lose saved information and features within Mozilla products
>>- Reactivating with this email may not restore your saved information
>>
>>
>> Shane
>>
>>
>> On Tue, Aug 6, 2019 at 7:36 PM pmo  wrote:
>>
>>> I was going to ask, is there a deadline for completing these strings?
>>> Any high priority markets as must haves, and others are nice to have? We
>>> are going to prepare an l10n monthly report, we will mention this and any
>>> upcoming new content coming their way.
>>>
>>>
>>> On 8/6/19 11:30 AM, Julie McCracken wrote:
>>>
>>> We're translating strings related to the SubPlat at this time, even
>>> though we're targeting a US only market?
>>>
>>> On Mon, Aug 5, 2019 at 10:26 PM Shane Tomlinson 
>>> wrote:
>>>
>>>> > 75% of the strings were for either Subscription Platform or for title
>>>> casing the emails [1]. Ryan Feeley requested
>>>> the title casing, Ryan is that in support of a particular project?
>>>>
>>>> Shane
>>>>
>>>> [1] - https://github.com/mozilla/fxa/issues/1684
>>>>
>>>> On Tue, Aug 6, 2019 at 1:45 AM Julie McCracken 
>>>> wrote:
>>>>
>>>>> Hi, Shane - which Skyline deliverable were you referring to in your
>>>>> above message?
>>>>>
>>>>> On Mon, Aug 5, 2019 at 8:45 AM pmo  wrote:
>>>>>
>>>>>> Hi Shane,
>>>>>>
>>>>>> Always appreciate your update on these type of pushes. Is this
>>>>>> Skyline
>>>>>> related? Is this for FxA Toolbar menu? In the one pager, it said
>>>>>> "L10n
>>>>>> is done by 7/29":
>>>>>>
>>>>>> https://docs.google.com/document/d/1s1gBAfdcArMxDb27HCdgU1-JYEZF1IIXCOK_MvblyT0/edit.
>>>>>>
>>>>>>
>>>>>>
>>>>>> We are trying to figure out which delivery is for what feature so we
>>>>>> can
>

Re: New strings in FxA for train-143

[Shane Tomlinson]

Unfortunately the changes within the "server.po" resource are all email
title strings and are sent to all users. These need
to be translated as broadly as possible to avoid people being sent emails
with English titles. I'm not sure the l10n impact
was considered when making these changes.

Within the "client.po" resource, the following strings are available to
everyone:

   - Logins and Passwords
   - Open Tabs
   - Credit Cards
   - By proceeding, you agree to the Terms of Service and Privacy Notice.
   - You've connected your Firefox account to Mozilla products that keep
   you secure and productive on the web:
   - Please acknowledge that by deleting your account:
   - Any subscriptions you have will be cancelled
   - You may lose saved information and features within Mozilla products
   - Reactivating with this email may not restore your saved information


Shane


On Tue, Aug 6, 2019 at 7:36 PM pmo  wrote:

> I was going to ask, is there a deadline for completing these strings? Any
> high priority markets as must haves, and others are nice to have? We are
> going to prepare an l10n monthly report, we will mention this and any
> upcoming new content coming their way.
>
>
> On 8/6/19 11:30 AM, Julie McCracken wrote:
>
> We're translating strings related to the SubPlat at this time, even though
> we're targeting a US only market?
>
> On Mon, Aug 5, 2019 at 10:26 PM Shane Tomlinson 
> wrote:
>
>> > 75% of the strings were for either Subscription Platform or for title
>> casing the emails [1]. Ryan Feeley requested
>> the title casing, Ryan is that in support of a particular project?
>>
>> Shane
>>
>> [1] - https://github.com/mozilla/fxa/issues/1684
>>
>> On Tue, Aug 6, 2019 at 1:45 AM Julie McCracken 
>> wrote:
>>
>>> Hi, Shane - which Skyline deliverable were you referring to in your
>>> above message?
>>>
>>> On Mon, Aug 5, 2019 at 8:45 AM pmo  wrote:
>>>
>>>> Hi Shane,
>>>>
>>>> Always appreciate your update on these type of pushes. Is this Skyline
>>>> related? Is this for FxA Toolbar menu? In the one pager, it said "L10n
>>>> is done by 7/29":
>>>>
>>>> https://docs.google.com/document/d/1s1gBAfdcArMxDb27HCdgU1-JYEZF1IIXCOK_MvblyT0/edit.
>>>>
>>>>
>>>>
>>>> We are trying to figure out which delivery is for what feature so we
>>>> can
>>>> document all the requests.
>>>>
>>>> Thank you,
>>>>
>>>> Peiying
>>>>
>>>>
>>>>
>>>> On 8/5/19 5:22 AM, Shane Tomlinson wrote:
>>>> > Hi Peiying,
>>>> >
>>>> > Ordinarily we extract FxA's strings on a bi-weekly basis and the l10n
>>>> > crew manages to turn around translations pretty quickly. I didn't
>>>> > realize this train was going to be *so* string heavy and wanted to
>>>> let
>>>> > you know before you hear it from the localizers. There are 68 new
>>>> > strings comprised of 329 words.
>>>> >
>>>> > Next, the strings weren't extracted automatically on Friday because
>>>> of
>>>> > an error parsing the source code. I noticed the lack of new strings
>>>> > today and was able to fix the parsing problem, but the strings are
>>>> > extracted later than the normal Friday deadline.
>>>> >
>>>> > I'm sorry for both the count and the late extraction.
>>>> >
>>>> > Shane
>>>> ___
>>>> Dev-fxacct mailing list
>>>> Dev-fxacct@mozilla.org
>>>> https://mail.mozilla.org/listinfo/dev-fxacct
>>>>
>>>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: New strings in FxA for train-143

[Shane Tomlinson]

SubPlat changes that land in the content server, e.g., updates to the
"delete your account" panel within
settings are universally available and need to be translated. Strings from
the payments and support servers
are not yet extracted.

Shane

On Tue, Aug 6, 2019 at 7:31 PM Julie McCracken 
wrote:

> We're translating strings related to the SubPlat at this time, even though
> we're targeting a US only market?
>
>

___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: New strings in FxA for train-143

[Shane Tomlinson]

> 75% of the strings were for either Subscription Platform or for title
casing the emails [1]. Ryan Feeley requested
the title casing, Ryan is that in support of a particular project?

Shane

[1] - https://github.com/mozilla/fxa/issues/1684

On Tue, Aug 6, 2019 at 1:45 AM Julie McCracken 
wrote:

> Hi, Shane - which Skyline deliverable were you referring to in your above
> message?
>
> On Mon, Aug 5, 2019 at 8:45 AM pmo  wrote:
>
>> Hi Shane,
>>
>> Always appreciate your update on these type of pushes. Is this Skyline
>> related? Is this for FxA Toolbar menu? In the one pager, it said "L10n
>> is done by 7/29":
>>
>> https://docs.google.com/document/d/1s1gBAfdcArMxDb27HCdgU1-JYEZF1IIXCOK_MvblyT0/edit.
>>
>>
>>
>> We are trying to figure out which delivery is for what feature so we can
>> document all the requests.
>>
>> Thank you,
>>
>> Peiying
>>
>>
>>
>> On 8/5/19 5:22 AM, Shane Tomlinson wrote:
>> > Hi Peiying,
>> >
>> > Ordinarily we extract FxA's strings on a bi-weekly basis and the l10n
>> > crew manages to turn around translations pretty quickly. I didn't
>> > realize this train was going to be *so* string heavy and wanted to let
>> > you know before you hear it from the localizers. There are 68 new
>> > strings comprised of 329 words.
>> >
>> > Next, the strings weren't extracted automatically on Friday because of
>> > an error parsing the source code. I noticed the lack of new strings
>> > today and was able to fix the parsing problem, but the strings are
>> > extracted later than the normal Friday deadline.
>> >
>> > I'm sorry for both the count and the late extraction.
>> >
>> > Shane
>> ___
>> Dev-fxacct mailing list
>> Dev-fxacct@mozilla.org
>> https://mail.mozilla.org/listinfo/dev-fxacct
>>
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

New strings in FxA for train-143

[Shane Tomlinson]

Hi Peiying,

Ordinarily we extract FxA's strings on a bi-weekly basis and the l10n crew
manages to turn around translations pretty quickly. I didn't realize this
train was going to be *so* string heavy and wanted to let you know before
you hear it from the localizers. There are 68 new strings comprised of 329
words.

Next, the strings weren't extracted automatically on Friday because of an
error parsing the source code. I noticed the lack of new strings today and
was able to fix the parsing problem, but the strings are extracted later
than the normal Friday deadline.

I'm sorry for both the count and the late extraction.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: FxA application registration request: Firefox for Fire TV

[Shane Tomlinson]

Hi Mike, we have to manually provision credentials for prod, there is not
automatic escalation path. I have opened [1] to provision credentials on
our stage and prod servers.

Shane

[1] - https://bugzilla.mozilla.org/show_bug.cgi?id=1566346


On Mon, Jul 15, 2019 at 10:25 PM Michael Comella 
wrote:

> Hi Shane,
>
> When do the credentials merged to the dev server move onto the production
> Firefox Accounts server?
> - Mike
>
> On Tue, Jul 2, 2019 at 4:43 PM Michael Comella 
> wrote:
>
>> Hi Shane,
>>
>> On Tue, Jul 2, 2019 at 4:22 AM Shane Tomlinson 
>> wrote:
>>
>>> Hi Mike,
>>> Those docs are a bit out of date now and need to be updated (on Q3's OKR
>>> list), sorry for the confusion. It shouldn't be a problem to get you set up
>>> with OAuth credentials.
>>>
>>> As mentioned in the docs development occurs against the
>>> https://stable.dev.lcip.org FxA stack. stable is a prod-like stack that
>>> is updated every Thursday. Note that it's user database is distinct to
>>> https://accounts.firefox.com, so developers will need to create and
>>> verify an account there to sign into the app. OAuth credentials for
>>> https://accounts.firefox.com are reserved for your beta/production apps.
>>>
>>> I have created a PR to provision creds
>>> <https://github.com/mozilla/fxa-dev/pull/468> on
>>> https://stable.dev.lcip.org for you. If that looks good to you, we can
>>> get that deployed soon.
>>>
>>
>> Given my limited knowledge, this looks good to me.
>>
>> When would create beta/production credentials?
>>
>>>
>>> Will Firefox for Fire TV access Sync data? I'm assuming so.
>>>
>>
>> In the short term (Q3), we only intend to receive tabs. We have no
>> current plans to use sync data otherwise.
>>
>>>
>>> I know from speaking to Chenxia that there are a few wriggles that need
>>> to be ironed out for Fx for Fire TV, especially around navigation and
>>> input. Email verification is going to be interesting too, I wonder if users
>>> will find it obvious how to verify their email. We have been talking about
>>> making all users verify their email address by typing a TOTP-like code
>>> <https://github.com/mozilla/fxa/issues/457> that is sent to their email
>>> address, in this case, since Firefox for Fire TV is input constrained, it
>>> might make sense to have continue with the existing behavior and have users
>>> click a link instead.
>>>
>>
>> Our intent is to land a proof-of-concept FxA sign in integration ASAP to
>> be able to test all the flows on device and figure out the optimal user
>> experience. Bram, our UX designer, may have already done some research with
>> your team here but fwiw, I'm missing context on it.
>>
>> Thanks for the quick response – let me know if you have any questions or
>> suggestions for me! I don't have much context on the FxA integration so I'm
>> currently in the process of figuring it out in this issue
>> <https://github.com/mozilla-mobile/firefox-tv/issues/2445>.
>> - Mike
>>
>>>
>>> Shane
>>>
>>> On Tue, Jul 2, 2019 at 2:17 AM Michael Comella 
>>> wrote:
>>>
>>>> Hey dev-fxacct (CC firefox-tv list for context),
>>>>
>>>> The Firefox for Fire TV app is integrating FxA sign in and I'd like to
>>>> get credentials to enable sign in. I don't fully understand the
>>>> documentation
>>>> <https://mozilla.github.io/application-services/docs/accounts/welcome.html#becoming-a-firefox-accounts-relier>
>>>> – it suggests that our app is an "OAuth relier" (what does that mean?) and
>>>> that we have a "service" (is the app considered a service?) – but from
>>>> reading the docs and looking at samples
>>>> <https://github.com/mozilla-mobile/android-components/tree/master/samples/firefox-accounts>,
>>>> I think if we provide the following info, we can get credentials to allow
>>>> users to log into FxA:
>>>>
>>>> name: "Firefox for Fire TV"
>>>> redirect_uri: https://accounts.firefox.com/oauth/success/
>>>>
>>>> fwiw, like the sample linked above, we'd intend to intercept the
>>>> redirect URL, grab the returned credentials, and redirect the user to a
>>>> native UI screen (as per our mocks)
>>>> <https://whimsical.com/Mbrga1N3KwHiJpExhSR23m>. Additionally, since we
>>>> can't create additional WebViews on Fire OS and we only support a single
>>>> tab, we have to use the user's current browsing session so we'd consider
>>>> removing the FxA sign in pages from the user's browsing history.
>>>>
>>>> Let me know if there are any issues. Thanks!
>>>> - Mike
>>>> ___
>>>> Dev-fxacct mailing list
>>>> Dev-fxacct@mozilla.org
>>>> https://mail.mozilla.org/listinfo/dev-fxacct
>>>>
>>>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: FxA application registration request: Firefox for Fire TV

[Shane Tomlinson]

Hi Mike,
Those docs are a bit out of date now and need to be updated (on Q3's OKR
list), sorry for the confusion. It shouldn't be a problem to get you set up
with OAuth credentials.

As mentioned in the docs development occurs against the
https://stable.dev.lcip.org FxA stack. stable is a prod-like stack that is
updated every Thursday. Note that it's user database is distinct to
https://accounts.firefox.com, so developers will need to create and verify
an account there to sign into the app. OAuth credentials for
https://accounts.firefox.com are reserved for your beta/production apps.

I have created a PR to provision creds
 on https://stable.dev.lcip.org
for you. If that looks good to you, we can get that deployed soon.

Will Firefox for Fire TV access Sync data? I'm assuming so.

I know from speaking to Chenxia that there are a few wriggles that need to
be ironed out for Fx for Fire TV, especially around navigation and input.
Email verification is going to be interesting too, I wonder if users will
find it obvious how to verify their email. We have been talking about
making all users verify their email address by typing a TOTP-like code
 that is sent to their email
address, in this case, since Firefox for Fire TV is input constrained, it
might make sense to have continue with the existing behavior and have users
click a link instead.

Shane

On Tue, Jul 2, 2019 at 2:17 AM Michael Comella  wrote:

> Hey dev-fxacct (CC firefox-tv list for context),
>
> The Firefox for Fire TV app is integrating FxA sign in and I'd like to get
> credentials to enable sign in. I don't fully understand the documentation
> 
> – it suggests that our app is an "OAuth relier" (what does that mean?) and
> that we have a "service" (is the app considered a service?) – but from
> reading the docs and looking at samples
> ,
> I think if we provide the following info, we can get credentials to allow
> users to log into FxA:
>
> name: "Firefox for Fire TV"
> redirect_uri: https://accounts.firefox.com/oauth/success/
>
> fwiw, like the sample linked above, we'd intend to intercept the redirect
> URL, grab the returned credentials, and redirect the user to a native UI
> screen (as per our mocks) .
> Additionally, since we can't create additional WebViews on Fire OS and we
> only support a single tab, we have to use the user's current browsing
> session so we'd consider removing the FxA sign in pages from the user's
> browsing history.
>
> Let me know if there are any issues. Thanks!
> - Mike
> ___
> Dev-fxacct mailing list
> Dev-fxacct@mozilla.org
> https://mail.mozilla.org/listinfo/dev-fxacct
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: Firefox Account application registration request

[Shane Tomlinson]

Hi Tim,

Thank you for reaching out to us, your use case is really interesting. I'm
sorry to say that Firefox Accounts is not yet open to 3rd parties on a
general basis. We have a lot of groundwork we need to do before we are able
to open up more broadly, including getting the appropriate legal and
security approvals.

Out of curiosity, how would signing in to FxA work from a command line app?
Would you open a WebView of some description to accounts.firefox.com to
allow the user to sign in, or would you implement your own FxA client that
accepts a username and password and does all the background bits?

Thanks,
Shane


On Wed, May 29, 2019 at 8:17 PM Tim Visée  wrote:

> Dear,
>
> I am the developer of `ffsend` (https://github.com/timvisee/ffsend),
> which is well known 3rd-party tool for Firefox Send to use on the command
> line. And I would like to implement Firefox Account support, to allow users
> to authenticate, for higher limits similar to what Firefox Send itself
> supports.
>
> Therefore, I would like to request to register `ffsend` as relier on FxA.
> Since this is currently a manual process, I'm sending this message, as
> suggested on:
> https://mozilla.github.io/application-services/docs/accounts/welcome.html
>
> Here is the application name and redirect URI that I will be using:
> *name:* `ffsend`
> *redirect_uri:* `http://localhost:14565/oauth/callback`
>
> Note that the redirect URI is pointed to `localhost`, because `ffsend` is
> a local-use tool and not a web service.
> It would be awesome if any port for this URI could be whitelisted, to
> allow users to configure what port is used at run-time.
>
> If relevant, here is the email address of my Firefox Account: t...@visee.me
>
> Thanks in advance, and have a nice day!
>
> --
> Best regards,
>
> Tim Viséehttps://timvisee.com/
>
> ___
> Dev-fxacct mailing list
> Dev-fxacct@mozilla.org
> https://mail.mozilla.org/listinfo/dev-fxacct
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA core services, now a monorepo

[Shane Tomlinson]

Hi all,

If you are subscribed to any of the fxa repos, you will have noticed a
flurry of email in your inbox regarding issues being migrated and repos
being archived. Danny and Phil have been working hard for the past week to
consolidate all of FxA's core repositories into a single monorepo
 that is easy to find, install, and work
with.

Danny pulled the trigger last night to migrate all open issues to the
monorepo, and some follow up work will continue today.

*Why was this change made?*

The TL;DR is that having a diffuse set of repositories made working with
FxA difficult. Developers, contributors, and folks filing bugs all found
various facets of multiple repos challenging, and while fxa-local-dev made
this simpler, we wanted to go further. More reasoning can be found in this
doc

.

*What does this mean for you?*

   1. If you contribute to Firefox Accounts, you will need to re-clone
   https://github.com/mozilla/fxa. I tried a simple `git pull` today and
   git complained about merging unrelated.
  1. Working with the new repo will be like working with fxa-local dev,
  with pm2 as the command that manages servers
  2. Previous repos are now found under the packages subdirectory
  .
   2. Open bugs  against the new
   repo, no more wondering "which repo should this be in?".
   3. Open pull  requests against the
   new repo.


A big thanks to Danny and Phil for aggressively (and carefully) pursuing
this work. We've been talking about it for a long time, it's great to see
it finally done.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Relying Party Review Checklist

[Shane Tomlinson]

The FxA Relying Party Checklist

has already proven its worth when it has been shown to other teams.

Turns out it's not just *other teams* that need a checklist before going to
prod, the FxA team needs one too because we regularly forget things like
ensuring a client_id is mapped to a human friendly name for metrics
purposes, or adding a relying party's domain to the list of domains allowed
to call /metrics-flow.

With that in mind, I have started a new checklist, the FxA Relying Party
Review Checklist
,
this one aimed at FxA developers who are reviewing relying party
integrations.

It's pretty short right now, I could use help filling it in. What have we,
the FxA team, forgotten to do before a relying party went to production?
What should we be doing when asked for review? Let's capture that.

Thanks,
Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Meeting Agenda for Mar 11th, 2019

[Shane Tomlinson]

For folks in the US the meeting begins 1 hour later than usual (09.30)
until the end of the month when the UK starts to observe British Summer
Time. It's also 30 minutes shorter, we are going to start a separate Ops
meeting on Tuesday.

Here's a link to the agenda

.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: authentication ?

[Shane Tomlinson]

Hi Tom,

I'm sorry to read about this problem. You might find the support page about
2-factor authentication useful

,
it covers the most common scenarios. An authentication app is something
like Google Authenticator

 that
presents a 6 or 8 digit code you can use when signing in to your account.
Authentication apps provide
an extra level of security over passwords, the codes they provide are only
good for a short time period.

Out of curiosity, the code you are being asked to enter, is it 10, 8, or 6
digits? 2-factor authentication codes
are 6 digits by default. If you lose access to your authentication app and
need to use a backup code, those
are 8 digits. We can also send an 8 digit code via email for certain apps
like Lockbox. 10 is one I was not
aware we used.

Shane






On Mon, Mar 11, 2019 at 1:38 PM Tom H  wrote:

> Open your authentication app and enter the security code it provides.
>
> I can't login to my Firefox account as i don't know what my 10 digit code
> is and i don't know what the authentication app is.
> Can any one help?
>
> Tom.
> ___
> Dev-fxacct mailing list
> Dev-fxacct@mozilla.org
> https://mail.mozilla.org/listinfo/dev-fxacct
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA architecture session recording + "How to make changes to FxA session"

[Shane Tomlinson]

Hi all,

Thank you for those that attended the FxA architecture overview yesterday,
there were a lot of good questions asked. As promised, the session was
recorded [1] for those who could not attend.

I'll be running a follow on session with a theme of "How to make changes to
FxA" on Monday (19:30-20:30 GMT) in the FxA vidyo room. I'll do a little
live coding (what could go wrong?!?!) to show how to make changes to the UI
on the content server as well as one backend server. The session will be
recorded and made public for those who are unable to attend.

Thanks,
Shane

[1] -
https://vreplay.mozilla.com/replay/showRecordingExternal.html?key=O2AeQ8mfuhoB8Po
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA meeting agenda for Feb 25th, 2019

[Shane Tomlinson]

We have the train-132 mid-cycle checkin today. Add your items!

Agenda


Unfortunately I'm going to miss the first part of the meeting, I have a
parent-teacher conference at 16:20 GMT today. I should be around for the
2nd portion.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA meeting agenda for Feb 19th, 2019

[Shane Tomlinson]

We have an FxA meeting today! We are going to do PM/UX, Ops/Dev, and
train-132 planning.

The agenda.


Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

AS/FxA Meeting Changes - Feb 18th -> Feb 19th

[Shane Tomlinson]

I forgot that Monday the 18th is holiday in both the US and Canada. The
Monday meetings are going to be awfully sparse if just Phil, Ryan, Mark and
I show up.

I'm moving all the Feb 18th FxA/AS meetings to Tuesday the 19th.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: FxA OAuth Relier Checklist - Add topics that should be covered

[Shane Tomlinson]

Since documentation was a hot topic of conversation last night, I figured
I'd post a very rough draft of the relier checklist
<https://docs.google.com/document/d/18l-EKwDyKwnUYUsvtud7j6AwfOe_ZA93YEkrBIjJe1Y/edit#heading=h.xr0oqh70wemf>
I
wrote about earlier in the quarter. The feedback you provided was very
helpful in pointing out areas of confusion, and I hope we can use that
feedback to minimize friction and confusion for future reliers.

My request is simple, more feedback! It's still a bit hand-wavy, the hope
is to provide reliers with a page or two of guidance that allows them to
run from top to bottom and say "yup, did that, that too, that's not
applicable," and by the end feel somewhat confident their integration will
"Just Work".

Next steps:

   - Further refine the checklist (nudge nudge, more feedback please!)
   - Add a small bit of context for each heading
   - Put the content up in a public place so we can point reliers at it
   - Finally, build documentation around each of the important concepts
   - Work with John and Grace to understand what they are working and how
   to combine forces

I'm not sure how long to wait before putting the checklist on the AS site,
it seems like even in its current state the checklist could be useful for
reliers looking to integrate.

Shane


On Wed, Jan 9, 2019 at 6:14 PM Julie McCracken 
wrote:

> + Tony Cinotto
>
> On Wed, Jan 9, 2019 at 9:49 AM Matthew Miller  wrote:
>
>> Thanks for starting this.  I've added a couple of comments and
>> suggestions.  I'll be happy to help flesh things out and/or review
>> content as this progresses.
>>
>>
>> - m
>> Matthew A. Miller
>> Mozilla
>>
>> On 19/01/09 03:10, Shane Tomlinson wrote:
>> > Hi!
>> >
>> > Over the past couple of months it has become abundantly clear that we
>> > (FxA) do not provide sufficient guidance to new OAuth reliers on either
>> > the mechanics of integrating with FxA or the responsibilities of doing
>> > so. A few quick examples:
>> >
>> > 1. We have seen multiple instances where "email-first" reliers did not
>> > know they needed to integrate with our metrics pipeline.
>> > 2. Nearly everyone asks which scopes they need.
>> > 3. For GDPR compliance, all reliers should delete user data whenever a
>> > user deletes their FxA account.
>> >
>> > I want to document things like these so that new reliers can get up and
>> > running with minimal fuss and minimal confusion. I have started an
>> > outline of topics to cover
>> > <
>> https://docs.google.com/document/d/18l-EKwDyKwnUYUsvtud7j6AwfOe_ZA93YEkrBIjJe1Y/edit
>> > and
>> > am sharing this outline in its infancy to ask for your help in adding
>> > topics you feel should be covered.
>> >
>> > I have cc'd several folks who have recently gone through the integration
>> > process and have felt the pain firsthand. They have the best knowledge
>> > of anybody about what info they wish they had.
>> >
>> > Thanks,
>> > Shane
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Application Services" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to application-services+unsubscr...@mozilla.com.
>> To post to this group, send email to application-servi...@mozilla.com.
>>
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA meeting agenda for Feb 11th, 2019

[Shane Tomlinson]

Today is the mid-cycle checkin. Here's the agenda

.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Meeting Agenda for Feb 4th, 2019

[Shane Tomlinson]

It's the end of train-130, and the beginning of train-131.

Let's talk about the upcoming sprint. Here's the agenda

.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Cancelling today's AS retro group 2

[Shane Tomlinson]

Janet is out today, and the consensus in IRC is that nobody has anything so
pressing that it can't wait for the next retro. I have cancelled today's
retro, let's save those thoughts for 2 weeks from now.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Meeting Agendas for Jan 28, 2019

[Shane Tomlinson]

Lots of yack today:

   - FxA Weekly
   

-
   16.30 GMT, 11.30 EST, 08.30 PST
   - Rescheduled Monthly AS - 20.30 GMT, 15.30 EST, 12.30 PST
   - AS Ops
   

-
   21.00 GMT, 16.00 EST, 13.00 PST
   - 2FA retrospective
   

   - 21.30 GMT, 16.30 EST, 13.30 PST

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Weekly Agenda (now at a new URL!) for Jan 22nd, 2019

[Shane Tomlinson]

The weekly FxA catchup is almost upon us!

Here's the brand new agenda

[1], without Q4 notes.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA OAuth Relier Checklist - Add topics that should be covered

[Shane Tomlinson]

Hi!

Over the past couple of months it has become abundantly clear that we (FxA)
do not provide sufficient guidance to new OAuth reliers on either the
mechanics of integrating with FxA or the responsibilities of doing so. A
few quick examples:

1. We have seen multiple instances where "email-first" reliers did not know
they needed to integrate with our metrics pipeline.
2. Nearly everyone asks which scopes they need.
3. For GDPR compliance, all reliers should delete user data whenever a user
deletes their FxA account.

I want to document things like these so that new reliers can get up and
running with minimal fuss and minimal confusion. I have started an outline
of topics to cover

and
am sharing this outline in its infancy to ask for your help in adding
topics you feel should be covered.

I have cc'd several folks who have recently gone through the integration
process and have felt the pain firsthand. They have the best knowledge of
anybody about what info they wish they had.

Thanks,
Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Meeting Agenda for Dec 17th, 2018

[Shane Tomlinson]

FxA has a mid-cycle UX/PM and triage meetings today! Here is the agenda

.

See everyone soon,
Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Meeting notes: Monitor/FxA integration from Orlando

[Shane Tomlinson]

We were too busy munching on breakfast and I didn't write down notes of our
meeting. Here's a recap of what hasn't slipped out of my dome.

*Background*
Firefox Monitor is a service that allows users to see if their email
address has been involved in a data breach. Monitor can email breach alerts
whenever the user's address is involved in a new breach, doing so requires
the user to verify their email address using a flow that is very similar to
what FxA does. To remove the redundancy, Monitor is integrating with FxA
(integrate, integrate, integrate!). This was a chat about deepening that
integration.

*WHO*: Luke Crouch, Lesley Norton, Vijay Budhram, Shane Tomlinson

*Questions and comments*

Is it possible for a user to add more than one secondary email address to
Firefox Accounts?

   - The idea is that Monitor will fetch all of a user's email addresses
   associated with FxA and give the user the option to monitor them all. Many
   users have more than 1 primary and 1 secondary address, tracking all of
   these in FxA would make setting up Monitor simpler.
   - This is not available currently, though this is a front end
   restriction, the backend is already set up for it.
   - If a user adds an email address to Monitor that is unknown by FxA,
   should that address be added to FxA?

Is it possible to integrate Monitor into the FxA settings page?

   - Allow users to sign up to Monitor or view breaches from within the
   settings page.
   - This will need UX work, our settings page is already pretty panel
   heavy.

If a user verifies their address as part of the Monitor signup, can a
Firefox Account be created automatically as part of that process?

   - We can't automatically create an account because we need a password
   for the user. FxA needs to be involved in that flow at some point.
   - We might be able to skip email verification, but this alters the trust
   boundary we currently have of how much we trust an email address.
  - Ryan Kelly reminded me after the meeting we used to do this for
  Firefox Marketplace, we had the notion of a "preVerifyToken" which was a
  JWT from trusted sources that indicated the email address has
already been
  verified. We removed all of that code because it was gross.

Monitor will need some production OAuth creds.

   - The bug is at [1].
   - Going to be a trusted client, requesting the profile scope and a
   refresh token.

*Action items*

   - stomlinson to open a bug requesting production OAuth creds [1]
   - stomlinson to open a bug about allowing multiple secondary email
   addresses [2]
   - stomlinson to talk to rfeeley and jgruen about the future of the
   settings page (started with Ryan Feeley on Saturday)

Is there anything that's missing from here?

Shane

[1] - https://bugzilla.mozilla.org/show_bug.cgi?id=1513060
[2] - https://github.com/mozilla/fxa-content-server/issues/6748
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Meeting notes: FxA/FxA China in Orlando

[Shane Tomlinson]

Date: December 5, 2018

*Background*
Because of local regulations, Mozilla China runs its own FxA stack that has
several customizations. Hector from the Mozilla China team regularly pulls
the latest versions of the FxA code and adds their local modifications.
Sometimes this goes smootly, sometimes not. We try to catch up at work
weeks to see whether we can make their lives simpler.

How hard have the reverse merges been?

   - Usually alright, sometimes a pain.
   - Can we merge some of the china code into baseline repos?
   - Logging is the most sensitive
  - Phone numbers are only added for registration for OAuth users.
  - 2FA like flow.
 - Profile server and auth server are simpler than the content
  server.
  - COPPA, SMS to connect another device is not needed.


Profile photo Error detection

   - A proxy server in front of the profile server
   - result.shouldRemove on /v1/avatar/upload

If we remove BrowserID assertions, will that cause problems?

   - Sending SMSs for OAuth verification will break, but there are
   alternatives.


Will merging the auth server and OAuth server cause any pain?

   - No.


Have you figured out the problems with the mozilla.org side of things?

   - Yes


Should we try to send Mozilla China log data through our pipeline
(flow/amplitude events)?

   - Mozilla China has several million accounts and we have little insight
   into how those users act/react. Does it make sense to send Mozilla China
   events to our metrics processing pipeline?
   - Their logs are currently sent to Alibaba for processing, would need to
   start sending to AWS.
   - Suggestion:get one day’s data somewhere, send it to Amplitude
   - We’d need to be careful of uid clashes here though, presumable the
  hmac key is different for hashing UIDs


FxA’s GCP migration

   - No immediate concern.
   - As long as GCP requirements are done in a modular fashion, should be
   OK.


China awareness in Rust/Android/iOS components: API design & implementation

   - When writing components, keep in mind the Mozilla hosted stack is not
   the only stack. It needs to be easy to point at alternative servers.

Seamless OAuth login for China based qq.com/163.com/126.com users?

   - I didn't capture enough context here!

*Follow up bugs opened*


   -

   Content-server: Add the ability to customize the desktop background
   
   -

   Content-server: Add ability to feature flag COPPA
   
   -

   Content-server: Integrate the Mozilla China phone number verification
   screens behind a feature flag
   
   -

   Profile-server: Add hooks to check uploaded profile photos
   


Hector or Phil, is there anything else that should be added to these notes?
Maybe some more info on the "Seamless OAuth login for China based
qq.com/163.com/126.com users"?

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Meeting notes: AMO, FxA and 2FA in Orlando

[Shane Tomlinson]

AMO and FxA 2FA Discussion

Date: December 5, 2018

Attendees: Jorge Villalobos, Stuart Colville, Mathieu Pillard, Andrew
Williamson, Vijay Budhram, Shane Tomlinson


*Background:*


AMO would like the ability to force 2FA for developer accounts. Users who
do not have 2FA

enabled are then able to enable 2FA as part of the login flow. FxA
currently shows an error message

if a relier forces 2FA and the user does not have it enabled. There is a
link to a SUMO article, but

no link to /settings to enable 2FA. Even if there was a link to /settings,
the user would

not be able to get back to the relier.


Smoothing out this flow to allow a user to add 2FA mid-login requires
significant effort on the

FxA side. We are trying to figure out some interim solutions that might get
us to a good enough

place.


*Background issues:*



   -

   Force 2FA at login for developers, behind a waffle
   -

  https://github.com/mozilla/addons-server/issues/10046
  -

   Allow users to set up 2FA/TOTP for reliers that pass acr_values=AAL2
   -

  https://github.com/mozilla/fxa-content-server/issues/6683
  -

   Provide a way for reliers to confirm a user's login state without
   re-entering password
   -

  https://github.com/mozilla/fxa-content-server/issues/6661


*Questions & Comments:*

Could AMO send a list of emails and FxA sends an email to those users
asking them to enable 2FA?

   - Idea is to send an email to the list of users explaining the new AMO
   requirement and ask them to enable 2FA.
   - User enables 2FA out of band so the next time they sign into AMO, they
   are ready to go.
   - Could use the existing settings panel w/o asking users to enable 2FA
   inline.
   -

   Doesn’t solve the problem for developers who sign up after the email is
   sent.


Instead of FxA sending the emails, could AMO send an email to the user w/ a
link to the FxA settings page?

   - For either email approach, we'll want to track conversion rates.
   - Emailing 10s of thousands of users prematurely wouldn’t be awesome.
   Let’s find out more.

Setting up 2FA is time consuming and difficult


   - “There are so many steps to setting up 2FA - Downloading their
   recovery code might be problematic.”
   - Setting up on mobile is difficult.
   - AMO dev site doesn’t work well in mobile anyways.

Is it possible to present the user some UX on the AMO side saying it must
be enabled?

   - Could we use the developer bar on AMO?

For the smoothest flow, we’d have to re-use the current screens and
integrate them into the login flow somehow.


   - This requires extracting the 2FA screens from FxA's /settings page and
   integrating them into the login flow.
   - Significant effort, would need to be scheduled.
   - Will require UX support and testing.

What is the schedule to force enable 2FA on AMO?


   - Originally for this quarter, obviously it's too for that to happen.

For users without phones, we’d need to update the SUMO doc saying what to
do.

What does the "send an email asking the user to enable 2FA" approach look
like?


   - The FxA team knows how to send out of band emails, we can turn those
   around pretty quickly as long as we have copy.
   - We’d want to work together to ensure the copy makes sense and doesn’t
   scare AMO users away.

*Proposed path forward*



Use the send an email approach, iterate from there.



   -

   Send an email to AMO developers
   - The AMO and FxA teams work together to develop email copy to send to
  AMO developers.
  - The AMO team passes a list of developer email addresses to the FxA
  team.
  - The FxA team sends the email, ensuring conversion rates are tracked.
  - Target date: TBD
   -

   Show a banner on AMO
   -

   Develop inline UI to enable 2FA
   -

  First with the password
  -

  Then without the password


Stuart and Jorge, does this capture the essense of what we discussed and
decided?

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA meeting agendas for Dec 10th, 2018

[Shane Tomlinson]

We are probably all talked out from last week, but we have some meetings
today!

Today's FxA meeting at a high level:

   - Announcements // Discussion // Train-127 cut
   - Sprint Planning
   - Bug Triage
   - Estimation (last 30 mins for estimation, feel free to drop if not
   interested)

The agenda is here

.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: We desire to be a relying service

[Shane Tomlinson]

Hi Kewell,

My name is Shane Tomlinson, I am from the Firefox Accounts team.

Unfortunately we have not yet opened Firefox Accounts to 3rd party
integrations
such as yours. We may do so in the future, though we have to complete a lot
of
groundwork to be able to do so.

If you are already running your own Pontoon stack for internal use, you may
also
be able to run your own Firefox Accounts stack for authentication. Running
your
own is not trivial, but possible. Here are two links that will help you get
started [1][2].

I imagine you'll want your own branding.

If running your own Firefox Accounts stack isn't your cup of tea, you could
also consider
changing Pontoon to integrate with another OAuth/OpenID Connect provider
such
as Google [3].

Shane

[1] - https://mozilla-services.readthedocs.io/en/latest/howtos/run-fxa.html
[2] - https://github.com/michielbdejong/fxa-self-hosting
[3] - https://developers.google.com/identity/protocols/OpenIDConnect

On Tue, Nov 27, 2018 at 9:56 AM Kewell Tsao  wrote:

> Hello Mozilla,
>
> We used pontoon <https://github.com/mozilla/pontoon> project to deploy a
> website, So we need to use Firefox Accounts.
> Here is our information:
>
> *name: *StarCitizen Asia Starport
> *redirect_uri: *https://translate.starcitizen.asia/
>
> Thank you!
>
> Kewell
> ___
> Dev-fxacct mailing list
> Dev-fxacct@mozilla.org
> https://mail.mozilla.org/listinfo/dev-fxacct
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

[ACTION REQUIRED] Update fxa-auth-server, fxa-bakset-proxy, and fxa-local-dev

[Shane Tomlinson]

If you have ever run FxA servers, please read on.

Several FxA servers depended on a version of flatmap-stream that was taken
over by an attacker 
and corrupted to steal bitcoin wallets. These repos include:


   -

   fxa-local-dev  [1]
   -

   fxa-oauth-server  [2]
   (pre-Oct 24th)
   -

   fxa-auth-server  [3]
   (post-Oct 24th)
   -

   fxa-basket-proxy  [4]


If you run any of these servers, please stop them now and update to the
latest versions.

Each repo can be updated by entering their directory and typing:

> git checkout -- .

> git pull

> npm install

For fxa-local-dev, type:

> git checkout -- .

> git pull

> npm install

> ./scripts/update_all.sh

Our current information is that the malicious package was designed to steal
bitcoin wallets. If you are running a bitcoin wallet app on the same
machine as FxA, check your wallet.

Again, this is only necessary if you run any of [1][2][3][4] locally. The
Mozilla-hosted Firefox Accounts servers are not affected, and if the
Mozilla-hosted servers are the only ones you use, you are not at risk.

If you have questions, please email info...@mozilla.com, or visit the
#security channel in IRC or Slack.

Thanks,

Shane

[1] - https://github.com/mozilla/fxa-local-dev

[2] - https://github.com/mozilla/fxa-oauth-server/

[3] - https://github.com/mozilla/fxa-auth-server/

[4] - https://github.com/mozilla/fxa-basket-proxy/
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Agenda for Nov 27th, 2018

[Shane Tomlinson]

Sorry for the late email. Today we are attempting a consolidated set of FxA
meetings in order to make a better use of everyones time. There's a lot of
ground to cover:

   - Announcements // Discussion
   - Sprint Planning
   - Bug Triage
   - Estimation (last 30 mins for estimation, feel free to drop if not
   interested)


Here's the agenda
.
See everyone in a few mins!

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: Registering as a Firefox Accounts Relier while being a non-Mozilla service, developing Firefox Sync WebExtension

[Shane Tomlinson]

Hi Krysztof,

Your idea sounds interesting, one I have wondered about myself! We have not yet 
opened up Firefox Accounts to non-Mozilla services, though we hope to in the 
future. Since Sync data is so sensitive, there is likely a lot of access 
control work we'll want to do before external apps & extensions are able to 
ingest it, for example, allowing users to explicitly state which Sync buckets 
they want to share with you. Right now it’s all or nothing, something users 
might not expect.

I will reach out to you directly to ask more.

Thanks,
Shane
On 21 Nov 2018, 11:17 +, Krzysztof Zbiciński , wrote:
> Hello
>
> I wanted to create a WebExtension that would add Firefox Sync support in 
> non-Firefox browsers (Chrome, Opera, Vivaldi(?)). After some research, I've 
> stumbled upon this article in MDN:
> https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction
>
> which led me to this mailing list.
>
> I was wondering, if it is already possible to register as a relier while 
> being a non-Mozilla service? The docs are a bit unclear about this:
>
> >We are exploring the possibility of allowing non-Mozilla services to 
> >delegated authentication to Firefox Accounts, and would welcome discussion 
> >of potential use-cases on the mailing list.
>
> Kind regards,
> Krzysztof
> ___
> Dev-fxacct mailing list
> Dev-fxacct@mozilla.org
> https://mail.mozilla.org/listinfo/dev-fxacct
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Meeting Agendas for Nov 5th, 2018

[Shane Tomlinson]

It’s Monday!

Here’s the nearly empty agenda [1]. Let’s fill it out.

Shane
[1] - 
https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit#
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA context query param values - mob_ios_v1, mob_android_v1 - are they still needed?

[Shane Tomlinson]

Hi Michael,

Last May we added two new FxA `context` query parameters to support mobile 
development, mob_ios_v1, and mob_android_v1. Are these still used/needed? In 
[1], the last comment is "not actively working on this issue". In [2], I don't 
see any entries for either context leading me to believe they are unused.

If these values are no longer needed, I'd like to remove them so they can't be 
used unexpectedly.

Thanks,
Shane

[1] - https://github.com/mozilla-mobile/FirefoxData-android/issues/21
[2] - https://sql.telemetry.mozilla.org/queries/52856/source#140579





Hey Michael,


Last May we added two new FxA `context` query parameters to support mobile 
development, mob_ios_v1, and mob_android_v1. Are these still used/needed? In 
[1], the resolution of the issue is ?not actively working on this issue?. In 
[2], I don?t see any entries for either context.



If these are no longer needed, I?d like to remove them so they can?t be used 
unexpectedly.




Thanks,

Shane

[1] - https://github.com/mozilla-mobile/FirefoxData-android/issues/21
[2] - https://sql.telemetry.mozilla.org/queries/52856/source#140579




___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Meeting Agendas for Oct 22nd, 2018

[Shane Tomlinson]

It’s Monday. Meetings abound. The good news is, as of this week, we have one 
fewer meetings than last week - the FxA retro is now merged with the AS retro.

The agendas [1], as always, are a bit bare and need some discussion points.

Today’s schedule:

UX/PM/Triage/DevOps at 16:30 BST, 11:30 EDT, 08:30 PDT
Demo Session at 20:00 BST, 15:00 EDT, 12:00 PDT, 06:00 AEDT

If we want to do a mid-cycle checkin, we can do so directly after the demo 
session.

Shane


[1] - 
https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit#heading=h.dzkex5x05zsw


___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Meeting Agenda for Oct 15th, 2018

[Shane Tomlinson]

It’s Monday. Nobody in the FxA team has government ordered time off.

The agendas [1] could use some more material.

UX/PM/Triage/DevOps at 16:30 BST, 11:30 EDT, 08:30 PDT
Demo Session at 20:30 BST, 15:30 EDT, 12:30 PDT, 06:30 AEDT
AS OKR Review at 21:00 BST, 16:00 EDT, 13:00 PDT, 07:00 AEDT
FxA Sprint Planning at 21:30 BST, 16:30 EDT, 13:30 PDT, 07:30 AEDT

If you want to hold the virtual floor, add your name,
approximate time needed, and topic.

Shane
[1] - 
https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for Oct 8th, 2018

[Shane Tomlinson]

Reminder to everyone who attends the FxA Monday meetings, the late Monday
have been moved to Tuesday to accommodate our Canadian teammates!

The Web Coordination meeting will continue as normal today. The agenda is
ready to be filled out

.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: Double Passwords?

[Shane Tomlinson]

Hi Jim,

We do not utilize dual passwords, but we do offer multi-factor
authentication using a form of one time password called TOTP
.
TOTP codes are used in addition to your password and are
generated by standalone apps such as Google Authenticator

.

Shane


On Tue, Oct 2, 2018 at 6:13 PM Jim Kennedy  wrote:

> I've recently learned that I've been a victim of password theft.
>
> Does Firefox offer an authentication system involving dual passwords?
>
> If so, I'd be grateful for information.
>
> Thank you,
>
> Jim Kennedy
>
> ___
> Dev-fxacct mailing list
> Dev-fxacct@mozilla.org
> https://mail.mozilla.org/listinfo/dev-fxacct
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Monday Meeting Agendas for Oct 1st, 2018

[Shane Tomlinson]

Monday comes around once every 7 days, and it's happened already.

The agendas

are ready for some bullet point additions.

*UX/PM/Triage/DevOps* at 16:30 BST, 11:30 EDT, 08:30 PDT
*Demo Session *at 20:30 BST, 15:30 EDT, 12:30 PDT, 05:30 AEST
*AS OKR Review* at 21:00 BST, 16:00 EDT, 13:00 PDT, 06:00 AEST
*FxA Sprint Planning* at 21:30 BST, 16:30 EDT, 13:30 PDT, 06:30 AEST

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Monday Meeting Agendas for Sept 24th, 2018

[Shane Tomlinson]

We have a lot going on today! The agendas are ready to be filled in

[1].
Add your name, approximate time needed, and subject to the list.

*UX/PM/Triage/DevOps* at 16:30 BST, 11:30 EDT, 08:30 PDT
*Demo Session *at 20:30 BST, 15:30 EDT, 12:30 PDT, 05:30 AEST
*Retrospective and Mid Cycle Checkin* at 21:00 BST, 16:00 EDT, 13:00 PDT,
06:00 AEST

Today is the last retrospective of the quarter. We'll need to decide
whether to do the quarterly retro today or do that on Oct 8th.

Shane

[1] -
https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit#
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Reminder: Monday FxA meetings moved to Tuesday

[Shane Tomlinson]

This is a reminder that all Monday FxA meetings are moved to Tuesday since
it's a holiday in the UK.

I will be working on Monday so that I can use one fewer PTO days for an
upcoming vacation.

See everyone on Tuesday!

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Late FxA meetings cancelled for today

[Shane Tomlinson]

Hi all!

If you haven't noticed the cancelled invite for the today's late meetings,
here's some good news. You have some free time later today - no meetings
this evening. We had fewer items to talk about in the early meetings and
had enough time to jam through the demo session.

We decided to skip the retrospective for the past train since so many folks
would have been absent, however, Julie has created a section for today in
the Retrospective doc

so that you can jot down any notes you would like to cover in 2 weeks time.

Thanks,
Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Meeting Agendas for Aug 13th, 2018

[Shane Tomlinson]

The Monday meetings agenda

is
pretty spartan and might remain that way, a lot of our team is traveling to
Portland for RustConf and the associated team get together. Still, the rest
of us decided to get together for at least the early meetings and the demo
session.

We'll discuss in the early meeting how to handle this week's retrospective.

*UX/PM/Triage/DevOps* at 16:30 BST, 11:30 EDT, 08:30 PDT
*Demo Session *at 20:30 BST, 15:30 EDT, 12:30 PDT, 05:30 AEST

If you have anything to discuss or show off, add your name and approximate
time needed to the list!

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Monday Meeting Agendas for Aug 8th, 2018

[Shane Tomlinson]

Even though it's Wednesday, it feels like Monday to me. And it's August,
not October.

We rescheduled our Monday meetings to today, the agendas are waiting to be
filled in

!

*UX/PM/Triage/DevOps* at 16:30 BST, 11:30 EDT, 08:30 PDT
*Demo Session & OKR Review & Train-119 Sprint Planning* at 20:30 BST, 15:30
EDT, 12:30 PDT, 05:30 AEST

If you have anything to discuss or show off, add your name and approximate
time needed to the list!

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Reminder: Monday meetings moved to Wednesday next week.

[Shane Tomlinson]

This is a reminder that all of Monday, Aug 6th's FxA meetings are moved to
Wednesday the 8th. Monday is holiday in Canada, and on Tuesday Ana is
giving her intern presentation during the normal Show & Tell timeslot and
we want to show Ana our support.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Monday Meetings Agenda for July 30, 2018

[Shane Tomlinson]

I think I have the times right this week.
*UX/PM/Triage/DevOps* at 16:30 BST, 11:30 EDT, 08:30 PDT
*Demo Session & Retrospective* at 20:30 BST, 15:30 EDT, 12:30 PDT, 05:30
AEST.

Agendas for both meetings are at [1].

If you have something you want to discuss or demo, add your name to the
appropriate list and the amount of time you'll need.

Shane

[1] -
https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit#
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: FxA Monday Meetings Agenda

[Shane Tomlinson]

Vlad pointed out that the times on the first meeting are incorrect, I have
an off by 1 error.

*UX/PM/Triage/DevOps* at 16:30 BST, 11:30 EDT, 08:30 PDT

On Mon, Jul 23, 2018 at 1:42 PM Shane Tomlinson 
wrote:

> Monday is upon us!
>
> *UX/PM/Triage/DevOps* at 17:30 BST, 12:30 EDT, 09:30 PDT
> *Demo, OKR Review & Train-118 Sprint Planning* at 20:30 BST, 15:30 EDT,
> 12:30 PDT, 05:30 AEST.
>
> Agendas for both meetings are at [1].
>
> If you have something you want to discuss or demo, add your name to the
> appropriate list and the amount of time you'll need.
>
> Today's OKR Review, as an experiment, will be App Services wide. Since
> those meetings already regularly run long, we are going to try to keep all
> discussions timeboxed and moving along.
>
> Shane
>
> [1] -
> https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit#
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Monday Meeting Agendas for July 16th, 2018

[Shane Tomlinson]

It's Monday!

That means the FxA team has a bunch of Vidyo based face to face time today.

*Web Coordination and Triage* at 16.30 BST, 11.30 EDT, 08.30 PDT, 00.30
AEST.
*Show & Tell* at 20.30 BST, 15.30 EDT, 12.30 PDT, 05.30 AEST.

Agendas for both meetings are at [1].

If you have something you want to share, show off, or discuss, add yourself
to the list. Don't forget to add your estimated time as well.

Shane

[1] -
https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit#heading=h.v0h2z7imhsd3
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA meeting agendas - Web Coordination, and Show & Tell

[Shane Tomlinson]

Happy Monday everyone!

We have a couple of meetings coming up later today. Web Coordination is at
17.00 BST, 12.00 EDT, 09.00 PDT. Show & Tell, OKR Review and Train 117
planning is at 20.00 BST, 15.00 EDT, 12.00 PDT.

Please add your items to discuss and demos: [1]

As a reminder, we retrospected Q2 last week [2] and went over a LOT of
stuff. We decided to asynchronously review and individually come up with
things we'd like to try for Q3. If you have something you'd like to
suggest, write it in the doc and let's go over those next week.

Thanks,
Shane

[1] -
https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit#heading=h.ccnlv29cr2wx
[2] -
https://docs.google.com/document/d/10IholIb2cDnMzpDyiRbf7cj728tV3V1vGvjZwL-Kkp4/edit
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

REMINDER: All of today's FxA meetings are rescheduled to Tuesday

[Shane Tomlinson]

This is a reminder that all of today's FxA meetings have been moved to
Tuesday, July 3rd. Our Canadian teammates have today off to observe Canada
Day.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Demo session for June 25th, 2018

[Shane Tomlinson]

A reminder that if you have some metrics or a demo you want to show off,
add your name to the list!

https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc

Thanks,
Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Add your name for today's Show & Tell

[Shane Tomlinson]

We have an FxA Show & Tell later today.

Add to the list whatever it is you want to show off! [1]

Thanks,
Shane

[1] -
https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit#heading=h.2t4ntkz75qus
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Add your name for today's Show & Tell

[Shane Tomlinson]

For those that had yesterday off, welcome back!

If you have anything you'd like to show off during Show & Tell, add your
name to the list [1].

I'm not going to be at the early meetings today because I am doing
"presentation training" today and tomorrow here at the London office. I've
left a couple of notes in the meeting notes GDoc. I should be back home in
time for the late meetings.

Shane

[1] -
https://docs.google.com/document/d/1r_qfb-D1Yt5KAT8IIVPvjaeliFORbQk-xFE_tRNM4Rc/edit#
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Reminder, Monday meetings are moved to Tuesday

[Shane Tomlinson]

This is a reminder that all FxA related meetings for
Monday (May 28th) are moved to Tuesday
because it's a holiday for both the US and UK.

The Tuesday backend catchup is cancelled since
we'll all be meetinged out by that point.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Reminder: Monday's FxA meetings have moved to Tuesday

[Shane Tomlinson]

This is a reminder that the Monday FxA meetings are moved to Tuesday
for the next two weeks. The upcoming Monday (21st) is holiday in Canada,
the 28th is holiday in the UK.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Demo Session for May 8th, 2018

[Shane Tomlinson]

The weekly FxA Show & Tell is later
today at 12:30 PDT, 20:30 BST. If you
have something you want to show off,
add your name to the list!

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Thanks,
Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Demo Session for April 30th, 2018

[Shane Tomlinson]

The weekly FxA Show and Tell is later today
at 12:30 PDT, 20:30 BST. If you have
something you want to show off, add your
name to the list!

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Demo Session for April 23rd, 2018

[Shane Tomlinson]

We have an FxA demo session coming up later today! If you
have something you want to share, add your name to the list:

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Thanks,
Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

"Anatomy of Account Takeover" from Google engineer Grzegorz Milka

[Shane Tomlinson]

This talk by Grzegorz Milka from Google is the most relevant video to our
team I've ever seen.

https://www.youtube.com/watch?v=W2a4fRalshI

Lots of fodder for thought.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Dec 7, 2017

[Shane Tomlinson]

*Today's Theme: train-101 ship, prepare for Y'all Hands.*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Dec 4, 2017

[Shane Tomlinson]

Today's theme: Mid-train 102, train-101 release

We are down quite a few folks today, the meeting might be pretty short.
We'll still
follow the normal format - UX/PM discussion first, Ops/Dev next.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Nov 30th, 2017

[Shane Tomlinson]

*Today's Theme: Start of train-102*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Nov 27, 2017

[Shane Tomlinson]

*Today's Theme: Finishing up train-101*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Nov 13th, 2017

[Shane Tomlinson]

*Today's Theme: It's the end of train-100 *

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Oct 9th, 2017

[Shane Tomlinson]

*Today's Theme: Wrapping up train-***100

That's right. 100 trains.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Nov 6th, 2017

[Shane Tomlinson]

*Today's Theme: Train-99 deploy*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Oct 26th, 2017

[Shane Tomlinson]

*Today's Theme: Train-98 point release, train-99 wrapup*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web coordination agenda for Oct 23, 2017

[Shane Tomlinson]

*Today's Theme: train-98 deploy, train-99 mid-cycle checkin.*

30 minutes for UX/PM, 30 minutes for Ops/Dev.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Oct 19th, 2017

[Shane Tomlinson]

*Today's Theme: Start of train-99, point release for train-98*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Oct 16, 2017

[Shane Tomlinson]

*Today's Theme: The end of train-98*

30 minutes to UX/PM, 30 minutes to Ops/Dev.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for Oct 10, 2017

[Shane Tomlinson]

*Today's Theme: Train-98 midpoint*

30 minutes for UX/PM, 30 minutes for Ops/Dev.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Oct 5th, 2017

[Shane Tomlinson]

*Today's Theme: It's a new dawn, it's a new day [1] (train-98 has started).*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane

[1] - https://www.youtube.com/watch?v=Ff-0pHwyQ1g
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Oct 2, 2017

[Shane Tomlinson]

*Today's Theme: High performing team recommendations & train-97 cut*

A few weeks back Julie facilitated an exercise to learn more about what
values we hold
as members of the team. We'll set aside the first 30 minutes today for
Julie to present
the outcomes of that work. The second 30 minutes is to wrap up train-97.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: Should FxA remove support for old browser integrations?

[Shane Tomlinson]

On Mon, Sep 25, 2017 at 6:50 AM, Ryan Kelly  wrote:


> AFAICT, Firefox used context=fx_desktop_v1 up until Firefox 45 and our
> switch to webchannels in this bug:
>
>   https://bugzilla.mozilla.org/show_bug.cgi?id=1218022
>
> If then used context=fx_desktop_v2 for a while one release, when we landed
> this bug for Firefox 46:
>
>   https://bugzilla.mozilla.org/show_bug.cgi?id=1204714
>
> So IIUC dropping support for those two integrations would disable Fxa
> login on Firefox 45 and earlier, which seems reasonable to me.
>

fx_desktop_v1 and fx_desktop_v2 are the two that cause the most slowdown.
I'd also like to get rid of fx_firstrun_v1. fx_firstrun_v2 was used
beginning with Firefox 46:

https://github.com/mozilla/bedrock/pull/3851


>
> That said, I'll note that the fx_ios_v1 broker currently extends
> fx_desktop_v1:
>
>   https://github.com/mozilla/fxa-content-server/blob/
> master/app/scripts/models/auth_brokers/fx-ios-v1.js
>
> So we'll have to double-check that we don't accidentally lose test
> coverage for iOS if we remove the desktop version.
>


This also needs to be considered for fx_desktop_v2=>fx_desktop_v3 and
fx_firstrun_v1=>fx_firstrun_v2. I want to speed up development, but not at
the expense of broken supported flows.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Sept 25th, 2017

[Shane Tomlinson]

*Today's Theme: Train-96 deploy, the last full week of the quarter.*

Since it's a Monday, it's the long meeting. 30 mins UX/PM, 30 mins Ops/Dev.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: Should FxA remove support for old browser integrations?

[Shane Tomlinson]

On Mon, Sep 18, 2017 at 7:54 PM, Alex Davis  wrote:
>
> Talking to Karlof in SF on Friday, he proposed something similar. Seems
> like the second bullet would make the most sense. We stop fixing old
> versions but don't prevent users from using them. This way we can be a bit
> more aggressive with which version we want to support and it encourages
> users to update.
>


This seems to me to just maintain the status quo.

The implicit assumption in not removing support for legacy integrations is
that "keeping code around" has little to no cost. Keeping old code always
has a cost, human and monetary. Being blunt, continuing to support legacy
browsers is *already* slowing our development cycle, as a result, every
feature costs more than it needs to. Not only that, but if we leave the
code in place largely unmaintained, we have a security footgun waiting to
happen.

I advocate for a more proactive approach - I want to explicitly remove
support for fx_desktop_v1 and fx_desktop_v2. I want to remove the code. I
want to remove the tests. I argue that in the long run, this is the most
responsible thing we can do for both Mozilla and our users.

Saying "we won't fix new bugs for these integrations" is totally different
to "we no longer care whether these integrations work," which is totally
different again to "we are removing support for these integrations." The
first implies we will keep the code and the tests in place to support
existing integrations and will ensure existing behaviors do not regress.
Ensuring legacy integrations still function is exactly what's slowing down
our development cycle. My time is largely spent ensuring I haven't broken
legacy systems, TBH, this is time I'd rather spend elsewhere. This time has
an opportunity cost for this group, and it costs Mozilla real money.

If we go a step further and say "OK, we'll keep the code, but we won't run
the tests" is even worse. This keeps the complexity in place that slows
down our development process, but leaves gaping holes in our knowledge
about the integrity of the system. I can say with 100% certainty, this
*will* lead to a broken experience for the user. If we are going to
unknowingly break the user experience, let's be responsible, do so
knowingly and give an upgrade path.

Finally, what do we do if a major security problem is found in the
unmaintained code? Do we ignore it? To me, that's the worst of all, that's
downright irresponsible. We fixed security problems in Persona right up to
the end, because it was the right thing to do. It was painful. I can't
speak for Ryan, but I know I would have rather spent that time making FxA
better instead.

To use a slightly more recent example, adding "Connect Another Device" to
signin could have probably been merged a few days earlier had legacy system
support been dropped. It was a multi-day effort to ensure those legacy
integration's functional tests were up to date and that we didn't regress
any behaviors. I have a hard time believing Mozilla will see a ROI > 1 from
that work.

To me, the only the only two responsible paths are 100% support, knowing we
are going to continue to sink costs into maintenance, or 100% remove
support.

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for Sept 5th, 2017

[Shane Tomlinson]

*Today's Theme: The end of train-95*

That means only train-96 is left to ship this quarter!

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for Aug 24th, 2017

[Shane Tomlinson]

*Today's Theme: Train-95 has begun*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: Enabling "Confirm your account pref screen should no longer redirect to Sync prefs"

[Shane Tomlinson]

We could set the capability on the FxA side by inspecting the Firefox
version number too,
though we are trying to move away from UA sniffing.

Shane


On Thu, Aug 24, 2017 at 11:11 AM, Mark Hammond  wrote:

> Fair enough. I'm still not convinced that leaving artifacts around that
> say "desktop no longer does some obscure thing it once did" is valuable,
> but I'm happy to defer to you here.
>
> Cheers,
>
> Mark
>
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Enabling "Confirm your account pref screen should no longer redirect to Sync prefs"

[Shane Tomlinson]

Hi Mark and Kit!

cc dev-fxaccount because there's nothing secret here.

It's the middle of the night for Mark, I wouldn't you to have seen this
response in IRC.

Copying Mark's comments from IRC:

> re bug 1357085  [1]
- until we do kill about:accounts, can't about:accounts itself just
transition to a better a.f.c page instead of a more complex capabilities
solution?
> (ie, hard-code a new url instead of about:prefs)
...
> I'm probably missing something subtle, but Kit writes "In both cases, I
got stuck at the confirmation screen if I removed the `openPrefs` calls
from `aboutaccounts.js`." - and openPrefs is literally |window.location =
"about:preferences#sync"| - so I'm thinking |window.location = "
https://accounts.firefox.com/something-better;|

Copying in (a heavily modified version of) my response:

I'm slightly uncomfortable with that approach because it reduces the
flexibility we have on the FxA side to determine the next steps, though I'm
mulling over whether we can retain the flexibility. For example, we
recently made changes to the signup flow in the firstrun page to encourage
users to connect a second device - the UI that is displayed to the user
depends in part on the user's country. Users in the US, Canada, and GB can
send themselves an SMS, users in other parts of the world cannot. This
decision making currently occurs in the /confirm page when verification
polling has indicated the user verified their account.

If the user can send themselves an SMS, we send them to /sms, if the user
is ineligible to send an SMS, we try to send them to
/connect_another_device, and if they aren't eligible for
/connect_another_device either, we send them to /signup_confirmed. It's a
nasty decision tree. We could move that decision tree logic elsewhere, onto
an endpoint you could point at, though I suspect we'd need an endpoint for
each of signin, signup, and password reset. This seems to just shift the
complexity. I suggested the "capability" approach because we already have a
"cadAfterSignUpConfirmationPoll" capability internally [2], I was hoping to
hook into that because it's pretty dead simple on our end.

Shane

[1] - https://bugzilla.mozilla.org/show_bug.cgi?id=1357085
[2] -
https://github.com/mozilla/fxa-content-server/blob/d22f4cde9c8c9b54938e8f956b00ded1caf77a24/app/scripts/models/auth_brokers/fx-firstrun-v1.js#L30
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for Aug 21st, 2017

[Shane Tomlinson]

*Today's Theme: The Dark Side of the Moon (Train-94 cut)*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for July 31st, 2017

[Shane Tomlinson]

It's a Monday, so ~ 30 mins to UX/PM, and ~ 30 mins to Ops/Dev.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for July 27, 2017

[Shane Tomlinson]

*Today's Theme: Mid-train 93 dev cycle, train-92 testing*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for July 20th, 2017

[Shane Tomlinson]

*Today's Theme: Train-91 release, train-92 mid-cycle checkin*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for July 13th, 2017

[Shane Tomlinson]

*Today's Theme: Train-90 rollout, train-91 point release.*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for July 6th, 2017

[Shane Tomlinson]

*Today's Theme: We're back!*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: latest.dev.lcip.org is now running docker images

[Shane Tomlinson]

fxa-ci has also been migrated to a new box running docker images, now named
fxaci.dev.lcip.org.

Shane

On Fri, Jun 30, 2017 at 11:46 PM, John Morrison 
wrote:

> latest.dev.lcip.org is now running docker images
>
> John
>
> ___
> Dev-fxacct mailing list
> Dev-fxacct@mozilla.org
> https://mail.mozilla.org/listinfo/dev-fxacct
>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination for June 22, 2017

[Shane Tomlinson]

*Today's Theme: It's almost the end of train-90, almost time for SF.*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for Jun 19th, 2017

[Shane Tomlinson]

*Today's Theme: Mid-train 90. Getting ready for SF*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination Agenda for June 15th, 2017

[Shane Tomlinson]

*Today's Theme: Train-90 has started*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for June 12, 2017

[Shane Tomlinson]

Miss a week's worth of meetings, and I forget that I have to send an agenda!

*Today's Theme: The end of train-89*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

Re: Halving "Why is this required?"

[Shane Tomlinson]

+cc dev-fxacct because there's nothing secret here.

This is great! Two small nits:

Without additional context, "yet" doesn't provide any value. If there
are imminent plans to make Sync a full backup service and we can
link to an article explaining the coming changes, sure.

I'd also ditch "own" in "your own devices" - "your devices"
says the same thing.

Do you want me to put together a PR with these changes this week,
or do you think we'll do another round or two?

Shane


On Thu, Jun 8, 2017 at 6:22 PM, Alex Davis  wrote:

> Small edits added in bold:
>
> The Sync service isn’t a permanent backup *yet*, it’s simply a secure way
> to transfer saved bookmarks, history and passwords between your own
> devices. You should install Firefox and sync at least two devices to
> protect against losing your data if *you lose or replace a device, or
> forget your login.*
>
> Explanation:
> - Adding "yet" means we are working to make it better.
> - Forgetting password and resetting password are the same thing so... I
> thought it best to replace one of the two with lost/replaced device which
> could also result in lost data.
>
> Thoughts?
>
> --
> Alex Davis // Mountain View
> Product Manager // FxA & Sync
> (415) 769-9247
> IRC & Slack: adavis
>
> On Thu, Jun 8, 2017 at 6:37 AM, Ryan Feeley  wrote:
>
>> and for the header we can use "Why sync multiple devices?"
>>
>> On Wed, Jun 7, 2017 at 7:38 PM, Ryan Feeley  wrote:
>>
>>> Got it! What do you think? (Body)
>>>
>>> The Sync service isn’t a permanent backup, it’s simply a secure way to
>>> transfer saved bookmarks, history and passwords between your own devices.
>>> You should install Firefox and sync at least two devices to protect against
>>> losing your data if you forget your login or reset your password.
>>>
>>>
>>>
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for June 1st, 2017

[Shane Tomlinson]

*Today's Theme: Train-87 respin, Train-88 point release*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for May 15th, 2017

[Shane Tomlinson]

*Today's Theme: The end of train-87*

30 minutes for issues close to the hearts of Ryan and Alex
30 minutes for Ops & dev

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for May 11th, 2017

[Shane Tomlinson]

*Today's Theme: Nearing the end of train-87*

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for May 8th, 2017

[Shane Tomlinson]

Theme: Train-86 release

30 mins UX/PM, 30 mins Ops/Dev.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for May 2, 2017

[Shane Tomlinson]

*Today's Theme: The end of train-86*

Today will be a split UX/PM, the Ops/Dev meeting.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Demo Session for Feb 24th, 2017

[Shane Tomlinson]

Ryan is on PTO today and asked me to fill in for him. If you have a demo,
please add it to the list in the etherpad:

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for April 24th, 2017

[Shane Tomlinson]

Today's Theme: Train-85 has one more week.

This is the split UX/PM, then Ops/Dev meeting. 30 & 30.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct

FxA Web Coordination agenda for Apr 13, 2017

[Shane Tomlinson]

We are doing a little experiment today. Even though it's Thursday, it's
like a Friday for Phil and I. Not just any "like a Friday" either, but
"like
a Friday" of a 4 day weekend[1]. To top it off, it's sunny here in London,
and the sun has been a rare thing for the past 6 months.

Since almost everyone who attends these meetings is online now, our
experiment is to add items to the etherpad to discuss what we can
before the meeting starts, asynchronously.

We'll meet at the regular time, if we have asynchronously discussed
everything that needs to be discussed, Phil and I can get the 4 day
weekend started.

https://public.etherpad-mozilla.org/p/fxa-engineering-coordination

Shane

[1] - https://www.gov.uk/bank-holidays
___
Dev-fxacct mailing list
Dev-fxacct@mozilla.org
https://mail.mozilla.org/listinfo/dev-fxacct