208734 - what's related - alexa - should *not* work by default - users should have to enable it explicitly due to privacy reasons

Status: NEW

(SeaMonkey :: Sidebar, defect)

Description

[Willi Mann]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3.1) Gecko/20030527 Debian/1.3.1-2
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3.1) Gecko/20030527 Debian/1.3.1-2

I have been using Mozilla for more than one year now. But I did not know that it
contains code that sends visited websites to a third party location. (OK, only
if "What's related" is the current sidebar, but that might happen accidently) 

Mozilla should per Default not contact any third party sites unless it's
transparent to the user who's contacted. A good example for this is the all
search related stuff where you see which search engine is used. 

The "what's related" should be disabled by default. The user should be able to
see that the content comes from alexa by a submission of his browsing operations. 

As enhancement: The user should be able to select that only the Domain Name is
sent to alexa.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Actual Results:  
Mozilla doesn't tell about the provider of the What's related- sidebar.

Expected Results:  
==>Details

Comment 1

[Jo Hermans]

It shouldn't do that. It's only supposed to do that when it's open. Can you
confirm that ? If that's the case, then it's bug 139894.

Comment 2

[Willi Mann]

Sorry for being unclear. Mozilla does work correctly in the sense that only if
you click on What's related, it uses alexa. The problem is that the user doesn't
know, who provides this service. And as this is a third party domain where it's
not clear what happens with the submissions, that should not work in a standard
distribution. 

It's not a funktional problem, it's a privacy problem. 

Comment 3

[Jo Hermans]

Last time this was discussed : bug 93630

Comment 4

[Boris Zbarsky [:bzbarsky]]

This is a policy issue, not a code issue. Ccing some mozilla.org people.

Comment 5

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

*** Bug 208851 has been marked as a duplicate of this bug. ***

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I'm assuming this bug was filed because of the report at
http://www.heise.de/newsticker/foren/go.shtml?read=1&msg_id=3580899&forum_id=43471&showthread=1

Comment 7

[Willi Mann]

Yes and No. The problem is not the existence of the code, it is that the user
doesn't know who is contacted. It's absolutly clear, that Mozilla has to contact
someone to get a "What's Related"-Info, the problem is that most of the
Mozilla-Users don't know who is someone. 
The solution is 
a) to document it better. (e.g. Provided by Alexa on that sidebar, simpliest way)
b) To have a switch where you have to explicitly enable any third party helper
contact (dunno if Mozilla has any other code that contacts third party sites). 

If you do at least one of this solutions, you make the big OPENSOURCE-project
Mozilla more transparent. 

Comment 8

[benc]

NEW: 
Will: what is the exact change in behavior you want?

Comment 9

[Carsten Klein]

Here is a small "patch" for 

chrome/comm.jar/content/communicator/related/related-panel.js 

which shuts down the observing and reporting behaviour of the what's related
side-panel. Remember that this observing and reporting behaviour is enabled as
soon as the what's related sidebar has been loaded and initialized. Therefore, I
include the Init() function of this object with the tell-tale code commented out:

You will have to change your file accordingly, or disable the what's related
sidebar, if you don't like fiddling with the mozilla code.

------ snip

function Init()
{
	// Initialize the Related Links panel

	// Install our navigation observer so we can track the main client window.

	oContentWindow = window._content;
	oFrame = document.getElementById('daFrame');

	if (oContentWindow && oFrame) {
		var oObserverService =
Components.classes["@mozilla.org/observer-service;1"].getService();
		oObserverService =
oObserverService.QueryInterface(Components.interfaces.nsIObserverService);

		oNavObserver = new NavObserver(oFrame,oContentWindow);
		oNavObserver.TrackContext(''+oContentWindow.location);

		if (oObserverService && oNavObserver) {
/*
stop spying on me...

			oObserverService.addObserver(oNavObserver, "StartDocumentLoad", false);
			oObserverService.addObserver(oNavObserver, "EndDocumentLoad", false);
			oObserverService.addObserver(oNavObserver, "FailDocumentLoad", false);
*/
		} else {
			oNavObserver = null;
			dump("FAILURE to get observer service\n");
		}
	}
}

Comment 10

[Daniel Wang]

*** Bug 108944 has been marked as a duplicate of this bug. ***

Comment 11

[Scott M. Stolz]

For some webmasters, it is beneficial to have What's Related report to Alexa.  It helps increase your ranking on Alexa, which many people use to evaluate a site's worthiness.  I didn't know FireFox had an Alexa plugin, so I was forced to continue to use IE.  Now that I see FireFox does in fact support Alexa and report my usage to them, then I can now switch to FireFox.

I agree that it should be properly labelled as being powered by Alexa, and people should have an option about installing it.  But as far as whether or not it should default to sending information to a third-party such as Alexa, I don't have a problem with it defaulting to that as long as: 1.) I am told that up-front when I install it, and 2.) I have the option to disable it or uninstall it at will easily.