1493490 - Remove navigator.buildID usage from Bugzilla Helper

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Extensions, task)

Description

[Kohei Yoshino [:kohei]]

The non-standard navigator.buildID property will be removed in the near future to protect users from fingerprinting. Bugzilla Helper has one, which we should remove it now:

https://github.com/mozilla-bteam/bmo/blob/master/extensions/GuidedBugEntry/web/js/guided.js#L617-L618

Comment 1

[Felix Miata]

Isn't this information important to a good bug report?

Comment 2

[Kohei Yoshino [:kohei]]

I don’t think there are many cases where the exact Build ID is useful.

* Bugzilla Helper is for newbies who are often not using Nightly.
* On the non-Nightly channels, the UA string or version number is enough to recognize the browser environment. If not, engineers could ask the reporter to provide Troubleshooting Information (about:support) that contains the Build ID and other details.
* On the Nightly channel, contributors can also use the Nightly Tester Tools extension [1] to provide the Build ID if needed. But for regressions, the regression window is rather important.

[1] https://github.com/mozilla/nightlytt

Comment 3

[Kohei Yoshino [:kohei]]

Attachment: GitHub Pull Request

Comment 4

[Kohei Yoshino [:kohei]]

I’m adding some more arguments here:

* `navigator.buildID` is used only in Bugzilla Helper; regular users are not providing their Build ID or even UA string.
* For Bugzilla Helper users, their UA string will continue to be automatically provided when they file a bug.
* Many of BMO users are now Chrome users so the Build ID detection doesn’t work. In that case, engineers have to ask the reporter’s Firefox version anyway if needed.

Comment 5

[Chris Peterson [:cpeterson]]

I have a work-in-progress patch for bug 583181 that allows *.mozilla.org pages to access navigator.buildID. Comments in bug 583181 thought it would be wise to keep buildID for *.mozilla.org, just in case. AFAIK, Bugzilla Helper is the only user of navigator.buildID, but it might be useful in the future for detecting specific insecure builds.

Comment 6

[Kohei Yoshino [:kohei]]

Merged to master.