1049194 - Show SHA256 in Download Manager

Status: RESOLVED WONTFIX

(Firefox :: Downloads Panel, defect)

Description

[vulcain]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0 (Beta/Release)
Build ID: 20140805030300

Steps to reproduce:

In ist version 32, Firefox could check if a downlaoded file is a malware or not. For that, Firefox make an hash of this filed and see if this hash is listed as a malware.
The hash is SHA-256: https://wiki.mozilla.org/Security/Features/Application_Reputation_Design_Doc#High-level_overview

A lot of software give the SHA-256's hash (or md5sum). The goal is to give for the user an information if the file is corrupted during the downlaod or not, specialy when the file is big and the connexion is under 1 Mb/s
Exemple: http://download.documentfoundation.org/libreoffice/stable/4.2.6/rpm/x86_64/LibreOffice_4.2.6_Linux_x86-64_rpm.tar.gz.mirrorlist
http://www.openoffice.org/download/index.html
https://help.ubuntu.com/community/UbuntuHashes

On Linux (and on Mac OS if my memory is good), you could check easy with sha256sum, but it's more difficult on Windows: you must install a software. Some extensions could give you the SHA-256:
https://addons.mozilla.org/fr/firefox/addon/hashr/
https://addons.mozilla.org/fr/firefox/addon/md5-reborned-hasher/

But if Firefox have natively inside why use an extension ??


Actual results:

Actually in Firefox 34 we could not see the SHA-256 in Download Manager. We have only the name of the file, the url, the status, the time.

For example:
+-----------------------------------------------------------------------------------------------------+
| Firefox Setup.exe                                                                                                   |
| 30,8 Mo  -- mozilla.org -- 20:50 --                                                                          |
+-----------------------------------------------------------------------------------------------------+


Expected results:

Firefox should give SHA-256 in Download Manager if he use it to send informations for malware's protections.

+-----------------------------------------------------------------------------------------------------+
| Firefox Setup.exe                                                                                                   |
| 30,8 Mo  -- mozilla.org -- 20:50 --                                                                          |
| ae3f161fff8980f810eb847f684666ce90a0708f6bc4474e342099c8c61b806f       |
+-----------------------------------------------------------------------------------------------------+

Comment 1

[vulcain]

Attachment: Screencast of Download Manager

Screen cast of Download Manager: no informations of SHA-256 given

Comment 2

[vulcain]

Attachment: Expected: with SHA-256.png

Expected feature: Download Manager with SHA-256 information

Comment 3

[Gian-Carlo Pascutto [:gcp]]

Most users will have no idea what the gibberish is, let alone how to use it.

>But if Firefox have natively inside why use an extension ??

It's the other way around: why should Firefox do something natively if it can be handled so well, and in this case arguable far better, by an extension? If the user wants SHA512 or MD5 or SHA3, they'd still need an extension, etc.

Comment 4

[vulcain]

> It's the other way around: why should Firefox do something natively if it
> can be handled so well, and in this case arguable far better, by an
> extension? If the user wants SHA512 or MD5 or SHA3, they'd still need an
> extension, etc.

Add an extension is less user friendly than a native feature. A lot of peaople don't have a speed connexion for downlaod big file. So during the file could be corrupted and SHA-256 information could show that.

Comment 5

[Marco Bonardo [:mak]]

I don't think exposing this in the ui will ever happen, it's an advanced feature most users wouldn't understand and would create UI cluttering with low benefit (what would you do, copy it from the ui? compare visually? it looks unefficient method)
If we could check the integrity by ourselves without user intervention (something like bug 292481), that should happen, otherwise I agree that an add-on is the right choice. Even for an add-on it wouldn't be useful to just print out the hash that way, it would be better if it would provide a contextual menu option that can compare the known hash with a user-given one, no reason to expose the hash. If there is any API addition that might be useful to create a good add-on, it can be evaluated.

I agree there is space to improve towards file corruption handling, but I don't think this is the right solution.

Since this bug is explicitly about showing the hash in the UI I'd call it a wontfix.

Comment 6

[vulcain]

(In reply to Marco Bonardo [:mak] (Away 15-31 Aug) from comment #5)
> what would you do, copy it from the ui? compare visually? it
> looks unefficient method)

It's a good argument.

Thanks you for the time you take to explain this.
I will follow bug 292481 and Bug 992096