@Wugapodes - thanks for submitting this review. Is the goal in working upon and reviewing this extension to eventually get it into WMF production? If so, does it have any sponsoring WMF team or collective of individuals within Tech or Product? if there isn't a WMF sponsor and target deployment date, the Security-Team will have to triage this task as a lower priority for now. Thank you!

@Jcross Thanks for the triage. That is the goal, yes, however no WMF team is sponsoring this project yet so T244075 has been stalled. You should probably triage this task as lowest priority or stall it (depending on your workflow) until I can talk more with WMF stakeholders. Thanks!

@chasemp this was moved to "Watching" on secscrum - who should be contacted to conduct the review? Application Security Reviews says that "Workboard is tracked at secscrum."

@DannyS712 - per our SOP under Submission and Timelines, we'll still need some additional information before we can re-triage and schedule this review, namely the target date for deployment (Community-Tech as the deployment sponsors will need to confirm this) and a branch and commit sha signifying the development stopping point for the review, as we cannot review a moving target. If that's just 3515ac6, that's fine - please feel free to add it to the task description.

We are untagging as there is currently no path to production that we are aware of. Should this change, please feel free to tag us back in and we will triage.

This task is a Security Readiness Review request, so this task should be tagged with Application Security Reviews which allows to find all and any security readiness review requests by looking at tasks tagged with Application Security Reviews.
If this task is not an actionable review request, then please set its task status to "stalled". Once this task becomes actionable, please change back the task status to "open".
Thanks.

That Herald rule makes no sense.

@Jcross, I am volunteering to be the deployment sponsor for this extension for the Beta cluster. I'm not currently a WMF staff member, but I am a code deployer. I have also done an initial review of this extension at T244075#6981581 and believe it poses very low risk.

@ori We will discuss at our next AppSec scrum and provide an update next week. Thanks!

Hey @ori -

Thank you for doing this work, we appreciate your efforts in trying to get this extension to production. Unfortunately, the Security team is unable to assign a risk rating based upon a review not performed by a member of the Security team or an approved vendor.

Current deployment policy states that a formal security review is not a hard blocker for beta deployment, but we would ask that a sponsoring team and/or manager at the Foundation be willing to accept at least a medium risk for the deployment of the ChessBrowser extension at this time. Please note that while the Security team would like to accommodate this review request, we likely cannot accept it for this quarter (ending July 1st, 2021) and it would remain a lower priority given our current security review SOP prioritization framework.

Please let us know if there is a sponsoring team and/or manager willing to accept at least a medium risk for deployment of this extension. Once we hear from you we will move ChessBrowser forward with our regular scheduling and prioritization process. Thank you!

@Jcross, thank you for taking up and considering this request — I appreciate it. I think we can ask around for a team to sponsor this project, but I want to make sure I understand what exactly we'd be asking for. What, practically speaking, does it mean for a team/manager to "accept at least a medium risk for deployment of this extension"?

If there's no hard-and-fast definition, here's what I propose:

The team and/or manager agree to:

• Code-review wmf-config changes that enable the extension or alter its configuration.
• Be on-hand for troubleshooting during the actual deployment to Beta.
• If severe bugs are discovered, ensure that the extension is disabled.

I am deliberately leaving out any mention of the sponsoring team being on the hook to actually fix bugs, since I think that isn't necessary, would kill any chance of us finding a sponsor. I think I and the extension's authors can address bugs. If severe defects are discovered and we're unresponsive the sponsor would simply disable the extension.

Finally, the permission to go ahead with enabling this extension (if granted) would be understood to apply only to the Beta cluster and does not extend to prod wikis.

How does that sound?

Thanks, @ori . These assumptions sound correct to us and make a beta deployment for this extension low risk. While the Security Team is not in the business of giving thumbs up/thumbs down approvals, low risk is automatically accepted by the Foundation thus unblocking beta deployment. I hope this is helpful and helps you to move forward with the project.

Its now sounding like maybe you don't need a sponsoring team for beta deployment, but at any rate we at Community-Tech have discussed this project again and are happy to help see it through production, including listing us as the code steward if necessary. Some of us have done a cursory code review and also believe it be low-risk. Let us know if/when you need anything. @dmaza is our interim engineering manager (and fellow chess player!) if you need manager endorsement.

@sbassett : currently, the beta deployment task, T244075 depends on this task.
iiuc, there is kind of agreement that the extension can be deployed to test wiki, maybe under some conditions.
can you please update the beta task, and clarify if it can progress despite declining this task, and if so, what needs to be done?
maybe it's clear to everyone but me...
peace.

Hey @Kipod - per the latest deployment doc (specifically item 4), while security readiness reviews are recommended for beta deployment, they aren't necessarily a hard blocker as they would be for production deployment. The Security-Team cannot always accommodate every review request (and the desired completion date) we receive, but as long as someone is willing to accept a default risk rating (in this case, Community-Tech) then beta deployment can proceed.