Page MenuHomePhabricator

<Security Initiative> P2P Proxy API
Closed, InvalidPublic5 Estimated Story PointsSecurity

Description

Request Type: Research
Request Title: P2P Proxy API

Request Description: We are talking with trust and safety about an access controlled APIs for spammy IP feeds provided by a vendor. We’d like to understand if we can leverage existing API frameworks for this. Could we get some of your time to talk about requirements and potential solutions?

Details:

  • Indicate Priority Level: Choose: Critical, High, Medium, Low
  • Main Requestors: Security (Scott Bassett), Toby
  • Ideal Delivery Date: <TBD>
  • Stakeholders: community, admins, security, trust & safety

Required Documents:

Related PHAB Tickets{T265845}
Product One Pager<add link here>
Product Requirements Document (PRD)<add link here>
Product Roadmap<add link here>

Optional Documents:

Product Planning Document (Business Case)<add link here>
Product Brief<add link here>
Other Links<add links here>

Details

Risk Rating
Low
Author Affiliation
WMF Product

Event Timeline

DAbad set the point value for this task to 5.Aug 24 2021, 3:35 PM
L235 set Security to Software security bug.Aug 25 2021, 7:09 PM
L235 added projects: Security, Security-Team.
L235 changed the visibility from "Public (No Login Required)" to "Custom Policy".
L235 changed the subtype of this task from "Task" to "Security Issue".

I'm going to make this a security-protected issue for now for the reasons given in T265845#7309052 as a precaution. If this was the wrong call please feel free to reverse, but I'd rather be safe than sorry.

DAbad changed the task status from Open to Stalled.Oct 14 2021, 3:08 PM
DAbad triaged this task as Medium priority.

Given the current priorities and scope of this request, after reviewing with Technology leadership this request has not been prioritized to be picked up this quarter.

The Steering Committee will periodically review for reprioritization.

Given the current priorities and scope of this request, after reviewing with Technology leadership this request has not been prioritized to be picked up this quarter.

The Steering Committee will periodically review for reprioritization.

Ok, I think most of the related work for this has been moved to T290917 anyways, which is being actively worked upon by members of the Security-Team et al. So this task can likely be declined as invalid.

DAbad renamed this task from <Research> P2P Proxy API to <Security Initiative> P2P Proxy API.Dec 8 2021, 9:29 PM

Just FYI, as mentioned within my previous comment, some progress has been made on this and related work within T290917 and its sub-tasks. We were extremely fortunate to have @STran as an engineering resource (via x-departmental collaboration and their choice in allocating their 20% time) this past quarter to further work on a sort of MVP for a centralized security API service, with a generic data feed product as its first API. I'm happy to debrief where we're at on these efforts and what a product roadmap could look like for this service.

Aklapper added a subscriber: sdkim.

Removing inactive task assignee.

If I understand the task description correctly, this work is actively underway in iPoid-Service, see T339284: Deploy ipoid for progress on deployment. The first use case is displaying data in the IP Info extension, but further on, we can look at how other tooling in the ecosystem can access data provided by iPoid-Service.

I'd suggest declining or marking this task as a duplicate of T325147

If I understand the task description correctly, this work is actively underway in iPoid-Service, see T339284: Deploy ipoid for progress on deployment. The first use case is displaying data in the IP Info extension, but further on, we can look at how other tooling in the ecosystem can access data provided by iPoid-Service.

I'd suggest declining or marking this task as a duplicate of T325147

+1 to declining or marking invalid. This task was essentially superseded by the proof-of-concept work that sprung out of T290917.

sbassett lowered the priority of this task from Medium to Low.Aug 24 2023, 4:07 PM
sbassett changed Author Affiliation from N/A to WMF Product.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed Risk Rating from N/A to Low.