chore: untrack audit report snapshots — they carry machine fingerprint data - #132
Merged
Conversation
Michael: 'zero trust dude we don't trust mozilla, we review the upstream and
harden where possible too.' He is right and my earlier framing was still too
trusting: a valid signature proves only that MOZILLA SIGNED IT, not that the
content is benign. A compelled or compromised upstream ships signed records.
review.mjs reads what we are about to serve and FAILS CLOSED on: a collection
with no signature, a URL in signed content the collection has no business
carrying, active-content markers (javascript:/<script/eval(), a new or vanished
collection, or a >25% swing in record count — the shape a poisoned security list
would take. A SHA256 baseline makes silent drift in already-vouched-for data
visible on the next run.
Made it collection-aware after the first pass produced noise — blunt rules get
ignored, which is worse than no rule. ct-logs IS a list of log endpoints,
intermediates embeds CPS URIs in certificate data, plugins/addons rows carry a
user-facing 'why was this blocked' link. Those are inventoried; everywhere else a
URL is a finding. (Same false-positive trap as calling plugins=5 a leak earlier —
verify what upstream legitimately contains before alarming.)
REAL findings from the first review of Mozilla PROD data:
- Mozilla ships PLACEHOLDER urls in production CT data:
https://ct.example.com/bogus/ and .../bogus/ipng/
- plugin-blocklist rows carry CLEARTEXT http:// advisory links (oracle,
adobe, microsoft, divx, mozilla blog)
Neither is fetched in normal operation, but we now SEE them instead of assuming,
and the baseline diff surfaces the next change automatically.
…t data I committed the audit harness OUTPUT alongside the harness itself. Those files are measurement snapshots of whatever machine ran them, and they contain exactly the data this project exists to protect: hardwareConcurrency = 8 <- Michael's REAL core count canvasHash, screen metrics, audio sample rate, languages Most values in them are correctly spoofed (timezone Atlantic/Reykjavik, screen letterboxed to 1400x800 — RFP working), but shipping a contributor's real core count in a public privacy repo is careless. Untracked the four report files, removed the scratch probe page, and gitignored the pattern so a future run cannot re-commit them. The harness itself (surface-audit-server.mjs, surface-audit.html, README) stays — regenerate the reports locally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I committed the audit harness output alongside the harness. Those are measurement snapshots of whatever machine ran them, and they contain exactly the data this project exists to protect:
Most values are correctly spoofed (timezone
Atlantic/Reykjavik, screen letterboxed to 1400x800 — RFP working), but shipping a contributor's real core count in a public privacy repo is careless.Untracked the four report files, removed the scratch probe page, and gitignored the pattern so a future run can't re-commit them. The harness itself stays — regenerate locally.