Intent to Implement System Add-on: SHIELD/Normandy

Michael Kelly mkelly at
Tue Sep 27 01:10:44 UTC 2016

On 9/26/16 2:05 PM, Gijs Kruitbosch wrote:
> Hi,
> From this, I'm assuming Firefox peers/owners will be asked to review the
> add-on code before landing it in m-c. Can you confirm if that's correct?
> Stating the obvious and related point: it might be worth giving them a
> heads up (if that hasn't already happened) if you're planning to dump a
> big load of code in their queue...

Yep! Likely candidates who have helped during the implementation include
rhelmer, MattN, and gfritzsche. We're going to pick one ASAP and give
them a heads up / ask when they will have time for the review.

> Secondly... are the actions / server-side things going to be subject to
> Firefox reviews, given that they directly affect the user experience of
> the product in ways that normally require such reviews? There's some
> unfortunate history in that area that I would really like to avoid
> repetitions of.

The plan is currently that they be subject to reviews, but I'm not sure
if they match what you mean by "Firefox reviews". I'm not terribly
familiar with how Firefox reviews work (and when I last asked I got
mixed answers).

The doc page at explains in a
bit more detail, but in terms of technical review measures:

- The system add-on changes will be reviewed within our team during
development, and then by a Firefox peer as we merge the changes into m-c
(I suspect double-reviews isn't long-term sustainable but AFAIK there's
no good model for non-peer system add-on developers yet). Particularly,
new functionality added to the sandbox will be approved by release
management if necessary.

- Changes to the JS code run within the sandbox will be reviewed within
our team, as that code is part of the Normandy service codebase and is
reviewed in the same manner (On Github in a pull request).

- The configuration passed to the JS code will be peer-reviewed so that
at least 2 people with access to edit recipes on the server agree to the

We work with UX and product management when implementing new user-facing
stuff, but I don't know of any official sign-off we have currently
planned for things like that. I've CC'd Matt Grimes who probably has a
better answer for that, since Strategy and Insights often drives that
part of the process.

- Mike Kelly

More information about the firefox-dev mailing list