<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>From gavin on IRC:</div><div><br></div><div><span style="color: rgb(51, 51, 51); font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; line-height: 17px; white-space: pre-wrap; background-color: rgb(192, 219, 255); ">ckarlof: re: high rate of pinning violations for fxa, is is possible the DNS cache/AWS infra IP switch issues are to blame?</span></div><div><br></div><div><font color="#333333" face="Helvetica Neue, Helvetica, Arial, sans-serif" size="4"><span style="line-height: 17px; white-space: pre-wrap;">-chris</span></font></div><div><font color="#333333" face="Helvetica Neue, Helvetica, Arial, sans-serif" size="4"><span style="line-height: 17px; white-space: pre-wrap;"><br></span></font></div><div><div>On Jun 18, 2014, at 11:38 AM, Monica Chew <<a href="mailto:mmc@mozilla.com">mmc@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Please take a look at <a href="https://pinningtest.appspot.com">https://pinningtest.appspot.com</a> in FF 32 or higher and use your best judgment of whether FxA users on Nightly would be able to file an appropriate bug if they see one of the 10-20 violations per day that we're getting now.<br><br>This bug is to improve the UI to be more informative: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1011638">https://bugzilla.mozilla.org/show_bug.cgi?id=1011638</a><br><br>And this bug is to report the entire certificate chain, including the complete domain, back to us for remediation: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=846489">https://bugzilla.mozilla.org/show_bug.cgi?id=846489</a><br><br>I don't think it makes sense to block a decision on either one of these, because they don't have firm end dates. From the violation rate, I doubt that the pinset is incorrect, most violations are probably from captive portal. However, this assumption is incorrect if people are hitting a rarely used subdomain on <a href="http://accounts.firefox.com">accounts.firefox.com</a> that is using an unknown cert issuer.<br><br>If this is not the case and the pinset is correct, we could go ahead and start enforcing pin violations and count on bugzilla reports to find errors. It's also reasonable to wait a week and see if the numbers improve (telemetry data lags 4-5 days, dates are by build date, not submission date).<br><br>Thanks,<br>Monica<br><br>----- Original Message -----<br><blockquote type="cite"><a href="http://people.mozilla.org/~mchew/pinning_dashboard/">http://people.mozilla.org/~mchew/pinning_dashboard/</a><br><br>The violation rate is a little higher than mmc would expect to see. (We're<br>still in reporting only mode, though.)<br><br>We're seeing 10-20 (would be) violations per day. The rate is higher than<br>other Moz services, but the sample size is also much smaller.<br><br>Any thoughts?<br><br>-chris<br><br></blockquote></blockquote></div><br></body></html>