216596 - No referrer (referer) options in Firefox's privacy or advanced panels

Status: RESOLVED WONTFIX

(Firefox :: Settings UI, enhancement)

Description

[amano]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030817 Mozilla Firebird/0.6.1+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030817 Mozilla Firebird/0.6.1+

There is no way in firebird to change your referrer (referer) settings via the
UI. An option to set the referrer should be included in the privacy or advanced
panels.
You can set the referrer options the about:config. Now you can choose 0, 1, or 2
for different referrer settings, but these settings will be expanded soon (see
bug #55477, which is quite irritating.
Many browser test sites (such as pc flank) check the browsers' referrer
capabilities and if there is no option for that, many firebird newbies will
believe that firebird doesn't protect their privacy (the standard setting is
always send referrer).

Reproducible: Always

Steps to Reproduce:

Actual Results:  
No referrer settings.

Expected Results:  
Referrer settings in the options menues.

Comment 1

[Steffen Wilberg]

*** Bug 216598 has been marked as a duplicate of this bug. ***

Comment 2

[Steffen Wilberg]

Confirming as enhancement in Preferences (not Menus).

Comment 3

[Mike Connor [:mconnor]]

FYI, Ben stated in another bug that the plan is to have all of the Seamonkey
security UI prefs available in Firebird by 0.8.  I guess I can go looking for
that bug, its called Security UI Review or something.

Comment 4

[u115577]

Some people think referer information is the matter of privacy. Firefox needs UI
for that.
Opera has UI in the preferences panel and "quick preferences" menu.
Implementation may be easy.

Comment 5

[u115577]

Attachment: add referer option to privacy panel

Comment 6

[Mike Connor [:mconnor]]

Anyone paranoid enough to actually want to turn this off can use about:config to
edit the pref.  This falls under the same category as the "load images from
originating site only" pref, which many users who don't understand the concept
continue to set, and continue to report "major bustage" in their browser because
some sites fail to render.  Exposing this to users who don't understand it is a
bad idea, which is why we removed it in the first place.

Comment 7

[u115577]

Disabling referer is for paranoid? No.

Nowadays referer is considered to be at the same level as Cookies. Norton
Internet Security has option too. Why Firefox (at least Mozilla Suite) has no UI
just like Cookies?

Also, see RFC 2616:
http://www.w3.org/Protocols/rfc2616/rfc2616-sec15.html

Comment 8

[Mike Connor [:mconnor]]

Norton's implementation of this has caused a lot of confusion for their users. 
Exposing a preference that a user doesn't understand isn't acceptable if they
can break sites without knowing why.

The difference between no cookies and no referrer is that one is well-handled by
web apps (at the least, sites requiring cookies will fail and provide useful
feedback) whereas referrer checking is used in a less robust way, often serving
no image, or in some cases replacement images of questionable taste.  Leveraging
the permission manager here, as with cookies, would allay that, but we're then
getting into a sixth exposed set of site permissions, and that's unmaintainable
by most users.

If someday we do something more like zones, this could be a part of that
concept, but that requires more backend work than we're going to take on at this
point.

Comment 9

[u115577]

Ok, forget Norton. Then how about Opera? As mentioned above, Opera has "Enable
referrer logging" option in "Quick preferences" menu. User can toggle the pref
in a breeze.

Firefox gives users full control over Cookies and other privacy settings. Very
good. But especially referer, it appears indifferent. I can't understand the
criteria of privacy UI implementation. I believe users who can maintain Cookies
options may be able to maintain referer pref.

Comment 10

[u115577]

# Sorry for spam

Even if most users cannot maintain this pref, implementation of the UI will be
of essential importance in Firefox's effort to provide protection of privacy.
It's marketing idea.

Comment 11

[Mike Connor [:mconnor]]

Opera targets a very web-savvy "power user" audience which is more likely to
understand this pref.  The idea that we can "forget Norton" because a different
audience didn't have problems is just plain wrong.

Sure, lots of sites rely on the referrer header, despite the HTTP spec, but IE
works, so that's unlikely to change.  Users who know what this is can find the
pref easily, users who don't understand it won't stumble across it and break
sites.  (As a note, look up how many bugs have been filed because of the
originating images pref breaking Amazon or Apple.)

Comment 12

[Ralf Hauser]

Unfortunately, the about:config options (network.http.sendRefererHeader,
network.http.sendSecureXSiteReferer) are not well documented - not in the Help,
not in http://www.mozilla.org/quality/networking/docs/netprefs.html nor
http://www.mozilla.org/docs/netlib/netPrefs.html

===> How about at least documenting them?

Comment 13

[Mike Connor [:mconnor]]

sorry for bugspam, long-overdue mass reassign of ancient QA contact bugs,
filter on "beltznerLovesGoats" to get rid of this mass change