1849114 - Undetected trackers when the anti-tracking lists sync from Remote-Settings

Status: NEW

(Core :: Privacy: Anti-Tracking, defect)

Description

[Simona Badau, Desktop QA]

Found in

• Nightly 118.0a1

Affected versions

• Nightly 118.0a1

Tested platforms

• Affected platforms: Ubuntu 22 x64, Windows 11 x64, MacOS 13.

Preconditions

• Install the Remote-Settings-Devtools from here.
• Configure the browser to use the RS collection:
  ** In about:config set "browser.safebrowsing.provider.mozilla.updateURL" to "moz-sbrs://tracking-protection-list"
  **Open the Remote-Settings-Devtools:
  a. Set the environment to "Stage (Preview)"
  b. Clear ALL local data
  c. Poll Server
  ** Delete the safebrowsing directory in the profile (Local Directory).
  ** Open about:url-classifier and under “Provider” click “Trigger Update” for both google4 and Mozilla.

Steps to reproduce

1. Navigate to https://www.sohu.com/
2. In the Address Bar click on the Shield icon and observe the blocked/allowed trackers.

Expected result

• Trackers like "Cross-Site tracking cookies" and "Tracking Content" should be detected.

Actual result

• No trackers known to Nightly are detected on this page.

Regression range
This issue is not a regression

Additional notes
The issue is not reproducible on a new Nightly profile where the safebrowsing directory contains these 2 blockers:

• mozplugin-block-digest256.sbstore
• mozplugin-block-digest256.vlpset

Additional websites apart from sohu.com could be affected. We will include these websites in the report as soon as we identify them.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

:sbadau, if you think that's a regression, could you try to find a regression range using for example mozregression?

Comment 2

[cboozar]

Hi all, after much discussion with @[e-mail] and @[e-mail] I have decided the nature of this issue implies this is getting flagged just because of the reference to an old library that is no longer functional and not because the sites can actually do anything with it, since flash no longer runs in Fx (not since 2021). The specific problem being we have some old code in the browser that refers to outdates flashplugin lists that needs to be removed so it stops incorrectly displaying non-functioning trackers in the Shield panel.

Paul was nice enough to file this bug describing the need to remove the code which I think would be reasonable to do as part of the next phase: https://bugzilla.mozilla.org/show_bug.cgi?id=1850239

Therefore I recommend we ignore this bug and if there are no other issues of note we call this investigation a success and move on to creating a version of FX free of Shavar.

Comment 3

[Se Yeon Kim]

As previous owner of Shavar I agree with cboozar and the team's comment above. If I remember correctly, we kept these old lists like the flashplugin that are no longer updated still in Shavar because we wanted to support older versions of Firefox users.

Given that context, I support cboozar and the team’s decision to ignore the plugin lists as it does not pertain to newer versions of Firefox that will get ETP lists served by Remote Settings instead of Shavar.