Google API Key

classic Classic list List threaded Threaded
37 messages Options
12
Reply | Threaded
Open this post in threaded view
|

Google API Key

Doug Turner-2
This is a heads up:

Google has been moving many services to require an API key.  Mozilla's
contract with Google for geolocation support requires that we use an API
key similar to that of Chromium:
http://www.chromium.org/developers/how-tos/api-keys

I suspect other services like Safe-Browsing will eventually require an
API key as well.

The reasons behind this move are not clear/public.  I suspect that
service providers, like Google, want to prevent unauthorized access.  In
order to do this, they need some way to identify clients that are
authorized.  The way they have chosen to do this is to embed a secret
into the client and have that client present that secret during the API
usage. I know -- this isn't a great technical solution.  However, it is
what we're stuck with.  There isn't much wiggle room here. Google, and
other service providers, use API Keys.  (Please don't make it difficult
by pointing out how easy it is to find the secret in Chrome.)

People that build their own versions of Firefox can either provide their
own keys and these services will work... or they can do nothing, and
these services will not work.  Or course, all of our official builds
(nightly, aurora, beta, final) will continue working and there will be
no impact to users.

More details will follow.

Doug Turner
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Mike Hommey
On Thu, Jun 13, 2013 at 09:13:29PM -0700, Doug Turner wrote:
> People that build their own versions of Firefox can either provide
> their own keys and these services will work... or they can do
> nothing, and these services will not work.  Or course, all of our
> official builds (nightly, aurora, beta, final) will continue working
> and there will be no impact to users.

Does this mean the key won't be in the mozilla-* branches, but
integrated on the releng side?
Does it mean each and every linux distro will need its own key?

Mike
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Jonathan Kew-3
On 14/6/13 08:07, Mike Hommey wrote:
 > On Thu, Jun 13, 2013 at 09:13:29PM -0700, Doug Turner wrote:
 >> People that build their own versions of Firefox can either provide
 >> their own keys and these services will work... or they can do
 >> nothing, and these services will not work.  Or course, all of our
 >> official builds (nightly, aurora, beta, final) will continue working
 >> and there will be no impact to users.
 >
 > Does this mean the key won't be in the mozilla-* branches, but
 > integrated on the releng side?
 > Does it mean each and every linux distro will need its own key?

And does it mean each and every developer will need keys for any and all
of these services, if they're to test these features in their own builds
as they're working on them?

_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Gavin Sharp-3
On Fri, Jun 14, 2013 at 4:32 AM, Jonathan Kew <[hidden email]> wrote:
>>> People that build their own versions of Firefox can either provide
>>> their own keys and these services will work... or they can do
>>> nothing, and these services will not work.

> And does it mean each and every developer will need keys for any and all of
> these services, if they're to test these features in their own builds as
> they're working on them?

Yes. How this works for the Chromium project is described at
http://www.chromium.org/developers/how-tos/api-keys .

This is obviously a burden, and not ideal, but given the relatively
small set of people working on these features specifically, the
ability to change the API URLs for local testing, and the ability to
request your own keys to the real APIs, it seems manageable.

Gavin
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Gavin Sharp-3
In reply to this post by Mike Hommey
On Fri, Jun 14, 2013 at 3:07 AM, Mike Hommey <[hidden email]> wrote:
> Does this mean the key won't be in the mozilla-* branches, but
> integrated on the releng side?

Yes.

> Does it mean each and every linux distro will need its own key?

I imagine so.

Gavin
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Mike Hommey
In reply to this post by Mike Hommey
On Fri, Jun 14, 2013 at 04:07:00PM +0900, Mike Hommey wrote:

> On Thu, Jun 13, 2013 at 09:13:29PM -0700, Doug Turner wrote:
> > People that build their own versions of Firefox can either provide
> > their own keys and these services will work... or they can do
> > nothing, and these services will not work.  Or course, all of our
> > official builds (nightly, aurora, beta, final) will continue working
> > and there will be no impact to users.
>
> Does this mean the key won't be in the mozilla-* branches, but
> integrated on the releng side?
> Does it mean each and every linux distro will need its own key?

BTW, are these keys required to be "hidden"? (as in, only present in the
binaries, not in the source) If they are, then it's not possible to use
them for (at least some) linux distros.

Mike
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Ryan VanderMeulen
In reply to this post by Doug Turner-2
On 6/14/2013 12:13 AM, Doug Turner wrote:

> This is a heads up:
>
> Google has been moving many services to require an API key.  Mozilla's
> contract with Google for geolocation support requires that we use an API
> key similar to that of Chromium:
> http://www.chromium.org/developers/how-tos/api-keys
>
> I suspect other services like Safe-Browsing will eventually require an
> API key as well.
>
> The reasons behind this move are not clear/public.  I suspect that
> service providers, like Google, want to prevent unauthorized access.  In
> order to do this, they need some way to identify clients that are
> authorized.  The way they have chosen to do this is to embed a secret
> into the client and have that client present that secret during the API
> usage. I know -- this isn't a great technical solution.  However, it is
> what we're stuck with.  There isn't much wiggle room here. Google, and
> other service providers, use API Keys.  (Please don't make it difficult
> by pointing out how easy it is to find the secret in Chrome.)
>
> People that build their own versions of Firefox can either provide their
> own keys and these services will work... or they can do nothing, and
> these services will not work.  Or course, all of our official builds
> (nightly, aurora, beta, final) will continue working and there will be
> no impact to users.
>
> More details will follow.
>
> Doug Turner

Is there an option to build with Geolocation disabled? I don't see one
in configure.in. What happens if I build Geolocation without providing a
key?

Should we make these features default-disabled and opt-in for those with
keys? I'm not crazy about building something by default which is broken.
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Doug Turner-2
In reply to this post by Mike Hommey
Yes, this will be integrated on the releng side.  Details TBD. I have
reached out to John Oduinn last night.

Yes, every linux distro will need its own key.  This isn't a change.  
The existing Geolocation contract required non Mozilla produced builds
to have their own API, iirc.  Also, I should be clear about the future
-- application provided geolocation systems are dying.  The OS provides
this in many cases.  On the mac, we are going to use CoreLocation.  On
Windows 7, we are looking at their system services.  Linux has something
called GeoClue that we'd like to look it.  (if you know about geoclue,
contact me plz)

Thanks!
Doug

> Mike Hommey <mailto:[hidden email]>
> June 14, 2013 12:07 AM
>
> Does this mean the key won't be in the mozilla-* branches, but
> integrated on the releng side?
> Does it mean each and every linux distro will need its own key?
>
> Mike
> Doug Turner <mailto:[hidden email]>
> June 13, 2013 9:13 PM
> This is a heads up:
>
> Google has been moving many services to require an API key.  Mozilla's
> contract with Google for geolocation support requires that we use an
> API key similar to that of Chromium:
> http://www.chromium.org/developers/how-tos/api-keys
>
> I suspect other services like Safe-Browsing will eventually require an
> API key as well.
>
> The reasons behind this move are not clear/public.  I suspect that
> service providers, like Google, want to prevent unauthorized access.  
> In order to do this, they need some way to identify clients that are
> authorized.  The way they have chosen to do this is to embed a secret
> into the client and have that client present that secret during the
> API usage. I know -- this isn't a great technical solution.  However,
> it is what we're stuck with.  There isn't much wiggle room here.
> Google, and other service providers, use API Keys.  (Please don't make
> it difficult by pointing out how easy it is to find the secret in
> Chrome.)
>
> People that build their own versions of Firefox can either provide
> their own keys and these services will work... or they can do nothing,
> and these services will not work.  Or course, all of our official
> builds (nightly, aurora, beta, final) will continue working and there
> will be no impact to users.
>
> More details will follow.
>
> Doug Turner
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Ben Hearsum-2
In reply to this post by Mike Hommey
On 06/14/13 12:25 PM, Doug Turner wrote:
> Yes, this will be integrated on the releng side.  Details TBD. I have
> reached out to John Oduinn last night.

It's probably better to file a bug in mozilla.org:RelEng for this.
John's generally pretty backlogged, and this seems like it will need me
or someone else who delves in the details to figure out, anyways.
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Gervase Markham
In reply to this post by Jonathan Kew-3
On 14/06/13 12:44, Gavin Sharp wrote:
> This is obviously a burden, and not ideal, but given the relatively
> small set of people working on these features specifically, the
> ability to change the API URLs for local testing, and the ability to
> request your own keys to the real APIs, it seems manageable.

Perhaps we should consider requiring this to be true for APIs we support
in Firefox? That is to say, we should require that it be possible for
any random community member to get a (low volume) API key for testing
purposes.

Gerv

_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Matt Brubeck-3
In reply to this post by Mike Hommey
On 6/14/2013 4:57 AM, Mike Hommey wrote:
> BTW, are these keys required to be "hidden"? (as in, only present in the
> binaries, not in the source) If they are, then it's not possible to use
> them for (at least some) linux distros.

Some programs in similar situations (for example, programs like Calibre
that use Amazon Web Services) solve this by allowing users to specify
their own keys at runtime.  This isn't ideal, but it might be a feasible
way for Linux distros to enable these features without building secrets
into their packages.

Chromium allows users to provide keys at runtime through environment
variables.  If Firefox included a similar capability, then Linux distros
could create add-ons that expose it in the UI.  (This would also require
Google to provide a way for individuals to request such keys, which they
may or may not be willing to do.)
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Gavin Sharp-3
In reply to this post by Gervase Markham
On Fri, Jun 14, 2013 at 12:40 PM, Gervase Markham <[hidden email]> wrote:
> Perhaps we should consider requiring this to be true for APIs we support
> in Firefox? That is to say, we should require that it be possible for
> any random community member to get a (low volume) API key for testing
> purposes.

Indeed, it would be great if we could have a process like
http://www.chromium.org/developers/how-tos/api-keys (just with a
different "step 1"). That might be somewhat complicated to set up, but
we should try.

Doug, do you have the right contacts to ask?

Gavin
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Hubert Figuière
In reply to this post by Doug Turner-2
On 14/06/13 12:25 PM, Doug Turner wrote:
> On Windows 7, we are looking at their system services.  Linux has
> something called GeoClue that we'd like to look it.  (if you know about
> geoclue, contact me plz)

Doug,

For GeoClue there is already a bugzilla open

https://bugzilla.mozilla.org/show_bug.cgi?id=485472

With a patch.

Not sure how much it has rot. The OP for that bug is still involved on
the GeoClue part on the Gnome side.

Hub
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Doug Turner-2
In reply to this post by Gavin Sharp-3
Yes, that is a great idea.  Details will follow!

What I think is going to happen is something like:

You'll add this to your mozconfig:
     ac_add_options --with-google-api-keyfile=/builds/google-key.txt



> Gavin Sharp <mailto:[hidden email]>
> June 14, 2013 9:55 AM
>
> Indeed, it would be great if we could have a process like
> http://www.chromium.org/developers/how-tos/api-keys (just with a
> different "step 1"). That might be somewhat complicated to set up, but
> we should try.
>
> Doug, do you have the right contacts to ask?
>
> Gavin
> Mike Hommey <mailto:[hidden email]>
> June 14, 2013 12:07 AM
>
> Does this mean the key won't be in the mozilla-* branches, but
> integrated on the releng side?
> Does it mean each and every linux distro will need its own key?
>
> Mike
> Doug Turner <mailto:[hidden email]>
> June 13, 2013 9:13 PM
> This is a heads up:
>
> Google has been moving many services to require an API key.  Mozilla's
> contract with Google for geolocation support requires that we use an
> API key similar to that of Chromium:
> http://www.chromium.org/developers/how-tos/api-keys
>
> I suspect other services like Safe-Browsing will eventually require an
> API key as well.
>
> The reasons behind this move are not clear/public.  I suspect that
> service providers, like Google, want to prevent unauthorized access.  
> In order to do this, they need some way to identify clients that are
> authorized.  The way they have chosen to do this is to embed a secret
> into the client and have that client present that secret during the
> API usage. I know -- this isn't a great technical solution.  However,
> it is what we're stuck with.  There isn't much wiggle room here.
> Google, and other service providers, use API Keys.  (Please don't make
> it difficult by pointing out how easy it is to find the secret in
> Chrome.)
>
> People that build their own versions of Firefox can either provide
> their own keys and these services will work... or they can do nothing,
> and these services will not work.  Or course, all of our official
> builds (nightly, aurora, beta, final) will continue working and there
> will be no impact to users.
>
> More details will follow.
>
> Doug Turner
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Robert Kaiser
In reply to this post by Doug Turner-2
Doug Turner schrieb:
> People that build their own versions of Firefox can either provide their
> own keys and these services will work... or they can do nothing, and
> these services will not work.

This is IMHO a big argument to, one by one, try to get rid of using
those services and build on free-to-use alternatives instead.

Robert Kaiser

_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Doug Turner-2
In reply to this post by Doug Turner-2


Hubert Figuière wrote:

> On 14/06/13 12:25 PM, Doug Turner wrote:
>> On Windows 7, we are looking at their system services.  Linux has
>> something called GeoClue that we'd like to look it.  (if you know about
>> geoclue, contact me plz)
>
> Doug,
>
> For GeoClue there is already a bugzilla open
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=485472
>
> With a patch.
>
> Not sure how much it has rot. The OP for that bug is still involved on
> the GeoClue part on the Gnome side.
>
> Hub

Awesome.  I'll take a look!
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Doug Turner-2
In reply to this post by Ryan VanderMeulen

>
> Is there an option to build with Geolocation disabled? I don't see one
> in configure.in. What happens if I build Geolocation without providing a
> key?

Geolocation requests will time out, as expected per spec.
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Doug Turner-2
In reply to this post by Gervase Markham


Gervase Markham wrote:

> On 14/06/13 12:44, Gavin Sharp wrote:
>> This is obviously a burden, and not ideal, but given the relatively
>> small set of people working on these features specifically, the
>> ability to change the API URLs for local testing, and the ability to
>> request your own keys to the real APIs, it seems manageable.
>
> Perhaps we should consider requiring this to be true for APIs we support
> in Firefox? That is to say, we should require that it be possible for
> any random community member to get a (low volume) API key for testing
> purposes.

I believe that in chromium, this is actually the case now.  I'll see if
we can do exactly that for our google-api key -- allow developers to get
a low volume api key.

_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Doug Turner-2
In reply to this post by Mike Hommey


Jonathan Kew wrote:
> And does it mean each and every developer will need keys for any and all
> of these services, if they're to test these features in their own builds
> as they're working on them?

Yes.  Just like chromium.

I should also point out that there are like 3 people that need to worry
about this at this point. Most of them work for me and are all squared
away. :)
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
Reply | Threaded
Open this post in threaded view
|

Re: Google API Key

Mike Hommey
In reply to this post by Matt Brubeck-3
On Fri, Jun 14, 2013 at 09:45:03AM -0700, Matt Brubeck wrote:

> On 6/14/2013 4:57 AM, Mike Hommey wrote:
> >BTW, are these keys required to be "hidden"? (as in, only present in the
> >binaries, not in the source) If they are, then it's not possible to use
> >them for (at least some) linux distros.
>
> Some programs in similar situations (for example, programs like
> Calibre that use Amazon Web Services) solve this by allowing users
> to specify their own keys at runtime.  This isn't ideal, but it
> might be a feasible way for Linux distros to enable these features
> without building secrets into their packages.
>
> Chromium allows users to provide keys at runtime through environment
> variables.  If Firefox included a similar capability, then Linux
> distros could create add-ons that expose it in the UI.  (This would
> also require Google to provide a way for individuals to request such
> keys, which they may or may not be willing to do.)

The tradeoff would be that individual users would be identified
uniquely. That sucks.

Mike
_______________________________________________
dev-planning mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-planning
12