394662 - re-add 'allow site permanently" / "whitelist site" button to the notification bar on extension install

Status: RESOLVED WONTFIX

(Core Graveyard :: Installer: XPInstall Engine, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

With bug 252830 as fixed, th notification bar hasn't anymore the option to permanently allow sites to install extensions. The install whitelist still exists (go to Tools > Options > Security > Exceptions) and addons.mozilla.org and update.mozilla.org included. Why is it now more hidden? If a user which is logged in into addons.mozilla.org and browses the public pages and sandbox and installs extensions from both (so maybe he doesn't notice if it is a sandboxed one), he hasn't more security (except virus check) as a user from another site.

So please remove the whitelist for extension installation (that's how ADD-01d for Firefox 3 is called and marked as 'Complete') or make it easier for the users to add a site to it.

Comment 1

[Dave Townsend [:mossop]]

My personal take is that removing the whitelist should be a wontfix. The whitelist is there for a good reason, to stop websites being able to inundate the users with the modal install dialog.

Whether we make it easy to add sites to the whitelist is a UI choice for the Firefox team and I also think it should remain as it is. The number of non AMO hosted extensions is small and it is only one extra click to install extensions from them than it is from non-whitelisted sites.

Comment 2

[RenegadeX]

(In reply to comment #1)
> My personal take is that removing the whitelist should be a wontfix. The
> whitelist is there for a good reason

Agreed.

> The number of non AMO hosted extensions is small and it is only one
> extra click to install extensions from them than it is from
> non-whitelisted sites.

It's 1 extra click EVERY time the user wishes to install an extension from the same non-whitelisted site. And there are LOTS of extensions hosted on developer's own websites and on extension-listing sites/forums. It's very easy to say "Most users will probably only ever look on AMO and therefore never encounter the 'Allow'-bar", but the very fact that a user encounters the Allow-bar indicates that they're *not on AMO*, doesn't it??!

So in my opinion, the majority of Firefox users won't care what's included on the Allow-bar as they won't ever encounter it, but those that do--will. And those who do come across the bar, however frequently or infrequently will:
-a) not be inconvenienced by the addition of an "Always Allow" button next to an "Allow Once" button.
-b) if wanting to add the site to the whitelist, be thankful that Mozilla developers had the foresight to include a simple, efficient, and useful shortcut to the Whitelist dialog(pane).

Ideally, clicking an "Always Allow" button would:
-1) automatically directly open the Whitelist dialog (bypassing the lengthy Tools->Options->....  route)
-2) automatically insert a truncated form of the requested URL, ready for editing, if required.
ex: https://addonssite.com/firefox/test.xpi would shorten to https://addonssite.com/firefox
-3) allow the user to exit the dialog with the URL added simply by clicking twice - "Allow" then "Close" (as currently possibly)
-4) automatically initialize and execute the "Install Now" modal dialog.

The above would allow users to add a site and install the blocked-xpi with as little as 5 mouse clicks--combined! The current situation is that the same procedure as above takes *15*.

As follows:
1. Click the xpi install link on the webpage. The "Allow"-bar appears at top as the site isn't presently on the whitelist.
2. Realize it's a useful site that you'd like whitelisted. Click "Allow" so that this extension can be installed.
3. Click "Install Now" in the modal extension dialog. Extension installs.
4. Click-and-drag in the URL-bar to highlight (the root of) the URL to be added to the whitelist
5. Right-click to access the context menu
6. Click Copy to copy the appropriate part of the URL to the clipboard
7. Click Tools menu
8. Click Options
9. Click Security tab
10. Click Exceptions
11. Right-click in Address field
12. Click Paste
13. Click Allow
14. Click Close
15. Click OK/Cancel

5 vs 15, 'easy and efficient' vs 'cumbersome and inefficient'
And from then on of course, it's always 'none' vs 'one'.
I know which one I'd prefer!

Comment 3

[Przemyslaw Bialik]

Description adjusted and added regression keyword as Bug 252830 replaced "Edit Options" with "Allow" (once) button.
Can "Edit Options" button with original functionality be re-added as second button on the notification bar ?
We added new feature but sacrificing another and so currently there is no quick way to add site to the whitelist like it was before (AMO still does not have monopoly on hosting extensions ;)

Comment 5

[Lucas Malor (mail: c6kfnkn2uc AT snkmail DOT c0m)]

(In reply to comment #2)
> there are LOTS of extensions hosted on developer's own websites and on 
> extension-listing sites/forums.
> 

I agree. See for example http://adblockplus.org/devbuilds/ or http://www.extenzilla.org/ (an italian site that also translates non-italian extensions)

It's true an user can allow permanently a malicious site by mistake. But this can be avoided if the "Edit permissions" button is less accessible. For example, it can be positioned to the left in the bar, instead to the right near the normal "Allow" button.

Anyway, isn't this a Firefox - Extension/Theme Manager bug?

Comment 6

[Alex Limi (:limi) — Firefox UX Team]

Making it easier to install extensions from third-party sites isn't something we want to do. They are untrusted, and have not gone through any kind of review.