422994 - Blocklist UI string clean-up needed

Status: VERIFIED FIXED

(Toolkit :: Add-ons Manager, defect, P2)

Description

[Alex Polvi]

We've been using the add-on blocklist to prevent the use of crashing extensions. However, the UI for this says "Some of your extensions aren't secure". This is not necessarily true.

Comment 1

[Alex Polvi]

Attachment: prompt when blocklist is engaged

Comment 2

[Alex Polvi]

Attachment: view from add-ons menu

yes, that's right, WoW realm status. However the important thing to note is that FDM is "disabled for your protection" via the blocklist.

Comment 3

[chris hofmann]

maybe just change the language to "Some of your extensions are unstable or insecure"

we really should take this string change even though its past string freeze...  we will never be able to convince toolbar an extension providers to join the blocklist program if their extension is assoicated with security problems, when in fact its only a crash/instability problem that has been introduced.

-chofmann

Comment 4

[chris hofmann]

just for some more background.   

We have started to use blocklisting as an effective method for improving stability have have removed 2 extensions so far that were causing lots of problems.

https://www.mozilla.com/en-US/blocklist/

beta testers are also overriding version checking and running into problems with the google toolbar and others which aren't ready for firefox 3.  ( bug 422018 )

I was amazed at the number of blog entries and advice out there that basically
says "go get the FX3 beta, and don't worry about extension compatiblity; just
flip the pref and things should be fine..."

A google search for
http://www.google.com/search?q=extensions.checkcompatibility&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a
reviles many blog posts and articles like this one...
http://kakku.wordpress.com/2008/03/11/firefox-beta-4-upgrade-now-and-run-all-your-extensions-extensionscheckcompatibility-false/

Comment 5

[chris hofmann]

Recommendations are

title bar  

  [Some of your extensions are causing problems]

dialog box  

  [Stability and security checks run by firefox have determined that one or more of your extensions may be unstable or insecure]

Comment 6

[Robert Strong (they/them - no direct email)]

It would be a good thing to get the UX Team to weigh in on the string change

beltzner? madhava? bueller?

Comment 7

[chris hofmann]

yeah!

Comment 8

[Robert Strong (they/them - no direct email)]

email sent to beltzner and madhava.

Comment 9

[Madhava Enros [:madhava]]

How about the following?  This version just shortens some of the strings and
talks about add-ons rather than extensions.



titlebar: Add-ons are causing problems


Firefox has determined that the following add-ons may be unstable or insecure.

------------
list of add-ons
------------

You should restart Firefox so that these add-ons can be disabled.

More information


... and then on to the buttons.

Thoughts?

Comment 10

[chris hofmann]

I like it.

Comment 11

[Robert Strong (they/them - no direct email)]

For title I suggest "Add-ons may be causing problems"

Comment 12

[Alex Polvi]

what about the "for your protection" line in the add-ons manager? everyone OK with that?

Comment 13

[Robert Strong (they/them - no direct email)]

(In reply to comment #12)
> what about the "for your protection" line in the add-ons manager? everyone OK
> with that?
I'm fine with it since it is followed by a link to get more information... the details as to why should be called out on the page it links to.

Comment 14

[Alex Polvi]

link goes here: http://en-us.www.mozilla.com/en-US/blocklist/

Comment 15

[Madhava Enros [:madhava]]

Rob: "Add-ons may be causing problems" works for me

Alex - I think that's fine.  It's a little... mysterious, but, as Rob says, there's a link.  People aren't going to read a long sentence there anyway.

Comment 16

[chris hofmann]

one comment:

if the plugin blocking UI looks the same we should do the same thing over there.

and one concern:

I'm a bit worried about having a large part of the user base being only two clicks away from the long and winding trail and hairy details of some of these bugs that we link to in http://en-us.www.mozilla.com/en-US/blocklist/
  
It might be better to just provide a summary of the bug and/or a small amount of detail on why it has been blocklisted, rather than shuffling people off to the bug system.

Comment 17

[Mike Beltzner [:beltzner, not reading bugmail]]

There's definitely a lot more we could and should be doing with that page. Listing which items have been blocked, a quick reason why, and whether or not an update is available, for instance. That should be filed as a bug against Websites::mozilla.com, though.

I'm not sure that this should block (feel free to renominate). It would be late l10n at this point, and I'm not sure that the semantic difference between "secure" and "stable" is worth the churn.

Comment 18

[chris hofmann]

> I'm not sure that the semantic difference between "secure" and "stable" is worth the churn.

In discussions with plugin vendors and extension developers we have already found that we are going to have a very tough time getting them to go along with blocking, even though it might be in the best interest of users.

There is a huge difference between being labled as temporarily incompatible or unstable and insecure.    The insecure label here is throwing off all kinds of alarm bells and push back from partners.

http://wiki.mozilla.org/QA/Topcrashes   shows google toolbar, siverlight, freedownload manager, internet download manager and piclens incompatibility problems are all in the top 20 reported crashes for beta4 leading many users to believe that the new version of firefox has stability problems.  None of these has as security problem (that we know of) but we do need to disable to improve the beta testing and final release user experience.


This is a small change and we really ought to do it if we are serious about streamlining the process for blocking problematic extensions and plugins and putting the pressure on getting fixes, and getting users to update to the latest versions.

Comment 19

[Axel Hecht [:Pike]]

I'm not going to comment on "worth it or not", it doesn't seem to be totally over the top to me, help changes withstanding.

What I do want to comment on is the URL, that shouldn't go to en-US, but http://%LOCALE%.www.mozilla.com/%LOCALE%/blocklist/. That might have security/js-disabling implications, not sure.

Should this page be on https, even?

These are really just implementation comments, I'm not making a recommendation for taking this or not, I can see both sides, and there might be bigger fish to fry out there. Did I say "help" yet?

Comment 20

[Dave Townsend [:mossop]]

(In reply to comment #19)
> What I do want to comment on is the URL, that shouldn't go to en-US, but
> http://%LOCALE%.www.mozilla.com/%LOCALE%/blocklist/. That might have
> security/js-disabling implications, not sure.

The details page is actually http://%LOCALE%.www.mozilla.com/%LOCALE%/blocklist/ already.

Comment 21

[Axel Hecht [:Pike]]

(In reply to comment #20)
> The details page is actually
> http://%LOCALE%.www.mozilla.com/%LOCALE%/blocklist/ already.

Nifty, thanks.

Comment 22

[Mike Schroepfer]

(In reply to comment #17)

> I'm not sure that this should block (feel free to renominate). It would be late
> l10n at this point, and I'm not sure that the semantic difference between
> "secure" and "stable" is worth the churn.
> 

If we are going to blocklist for stability than we should state as such in the header...

Comment 23

[chris hofmann]

> I'm not sure that this should block (feel free to renominate)

renominated. 

Comment 24

[Mike Beltzner [:beltzner, not reading bugmail]]

Can't do this for Beta 5, but we'll get it for RC1.

Comment 25

[Dave Townsend [:mossop]]

From a brief skim looks like we need to implement comment 9 with the title in comment 11. Someone point out if I've missed something otherwise I'll get to this sometime soon.

Comment 26

[Dave Townsend [:mossop]]

Attachment: screenshot

Comment 27

[Dave Townsend [:mossop]]

Attachment: patch rev 1

Comment 28

[Axel Hecht [:Pike]]

Comment on attachment 311766 [details] [diff] [review]
patch rev 1

For reference, I see no pitfalls from an l10n point of view in this patch.

Comment 29

[Dave Townsend [:mossop]]

Checking in toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties;
/cvsroot/mozilla/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties,v  <--  extensions.properties
new revision: 1.54; previous revision: 1.53
done
Checking in toolkit/mozapps/extensions/content/list.js;
/cvsroot/mozilla/toolkit/mozapps/extensions/content/list.js,v  <--  list.js
new revision: 1.13; previous revision: 1.12
done
Checking in toolkit/mozapps/extensions/src/nsExtensionManager.js.in;
/cvsroot/mozilla/toolkit/mozapps/extensions/src/nsExtensionManager.js.in,v  <--  nsExtensionManager.js.in
new revision: 1.283; previous revision: 1.282
done

Comment 30

[Tony Chung [:tchung]]

Dave, how can i test this fix to trigger that dialog window from comment #26?

Comment 31

[chris hofmann]

tony,  I think if you were able to get one of these installed (maybe with firefox 2?) http://en-us.www.mozilla.com/en-US/blocklist/

then upgrade to a recent firefox 3 beta

you should then see the new dialog.  That would be a good end-to-end test.

Comment 32

[Dave Townsend [:mossop]]

(In reply to comment #31)
> tony,  I think if you were able to get one of these installed (maybe with
> firefox 2?) http://en-us.www.mozilla.com/en-US/blocklist/
> 
> then upgrade to a recent firefox 3 beta
> 
> you should then see the new dialog.  That would be a good end-to-end test.

That would not quite work. What you need to do is install Firefox 3, then delete the blocklist.xml file that exists in the installation directory. Then start it with a clean profile and install one of the blocked extensions (Free Download Manager is the only extension that doesn't make Firefox fail to start up). Then leave Firefox running until it updates the blocklist, I think I've told you how to adjust timers to speed that up if necessary. When the blocklist is downloaded you should see the message.

Comment 33

[Tony Chung [:tchung]]

Verified fix on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008050606 Minefield/3.0pre.   New blocklist dialog appears.