43501 - Move Cookies, Images, Forms, Passwds under Privacy & Security [was security policies]

Status: VERIFIED FIXED

(SeaMonkey :: Preferences, defect, P5)

Description

[Henri Sivonen (:hsivonen)]

The cookie prefs should be part of security policies. Users are likely to want to set cookie 
policies along other security policies. The user should be able to set special cookie 
policies for sites like Bugzilla and a general policy for other sites.

Comment 1

[sairuh (rarely reading bugmail)]

hopefully all security and privacy oriented preference panels will be moved
under a parent category called Privacy and Security --analogous to the one under
the Tasks menu. would that help?

Comment 2

[sairuh (rarely reading bugmail)]

->mcafee...or should it be ben?

methinks this blocks bug 38966.

Comment 3

[sairuh (rarely reading bugmail)]

*** Bug 77100 has been marked as a duplicate of this bug. ***

Comment 4

[Viswanath Ramachandran]

chris and vishy: don't think this should be a mozilla0.9.1 item. we have more 
critical stuff to do. what is the impact of not doing this? we're inclined to
minus this or at least move to mozilla0.9.2. 

Comment 5

[sairuh (rarely reading bugmail)]

*** Bug 78079 has been marked as a duplicate of this bug. ***

Comment 6

[sairuh (rarely reading bugmail)]

ugh! the Back button *killed* my comment...trying again...

i'm confused as to why this has been minused for catfood and future'd while it
still has nsbeta1+.

so, i'm renominating. this has been a long-standing issue: too many
subcategories under the Advanced parent category. now that there's a Privacy and
Security parent category, we should move all these subcategories under there. it
just seems silly not to do so, unless the work to do it is actually difficult
[let me know if it is!]. should this be reassigned to another engr, if this is a
matter of not enough cycles? thx!

Comment 7

[Jussi-Pekka Mantere]

More keyword nominations.

Comment 8

[timeless]

Attachment: first iteration

Comment 9

[Stephen P. Morse]

Could someone please explain what this bug report is saying.  I've never been 
able to understand it.

Are we talking about adding a new entry to the prefs panel called "security 
policies"?  If so, can someone please post a spec showing where that entry will 
go in the pref tree and what the items under that entry will be.

Comment 10

[timeless]

PSM created a Privacy/Security category, so people want all of that stuff 
grouped into it.  [warning, my patch probably doesn't work, not sure why, 
overlays are wierd things]  However, i'm just a reader, i don't read minds, so 
i could be wrong.  Basically, Advanced isn't a great place for this stuff.  As 
for the one thing i moved in preftree, i have no idea what that is, i'd guess 
it's CAPS.

Comment 11

[Stephen P. Morse]

timeless wrote:
> PSM created a Privacy/Security category

Where is this catagory.  I don't see it in my prefs panel.  My build is of a 
tree that I pulled yesterday.  That's why I am confused by this bug report.

Is this only in the commercial tree (my build is for bugzilla)?  If so, this 
should be a bugscape bug report and not a mozilla one.

Do you get this only if you have "BUILD_PSM=1" environment variable set?  As of 
a few weeks ago (I guess when PSM2 hit) I haven't been able to get a successful 
build unless I removed that variable.

Comment 12

[Terry Hayes]

The new Privacy/Security category is only present if PSM is installed (or built
with the browser).  PSM adds this as an overlay.  Since the proposal is to move
other items to this category, it will have to be present in the basic product
rather than coming from PSM.

I'm currently working on prefs for PSM, so I volunteer to work on this.  I also
have bug 70651 open.  I can turn that one into work to add the category, and
leave this one to move the current Advanced items.  (and make this bug depend on
70651).  Comments or objections?

Comment 13

[sairuh (rarely reading bugmail)]

terry, that sounds good to me. thx!

Comment 14

[Terry Hayes]

Attachment: Second round - includes changes to PSM

Comment 15

[Stephen P. Morse]

Terry,

Could you please post a description of what the preftree will look like with 
your patch.  Thanks.

Comment 16

[Terry Hayes]

I think the patch has the right stuff.  Maybe ben or timeless could review?

I'd also like to get positive comments on this layout from morse and german if
possible, since they were part of early discussions on this feature.  Thanks.

Comment 17

[Terry Hayes]

Attachment: window snapshot of the new layout

Comment 18

[Stephen P. Morse]

It seems strange to have PSM (certificates) at the top level and  
cookies/images/passwords/forms as subitems under that.  A more consistent thing 
is to have PSM as one of the subitems as well.  But then you'll have to 
figure out what to put on the top level.

Comment 19

[timeless]

german's right. but I don't know what to put their either :(

One posibility is CAPS but that's really a bit advanced.

Comment 20

[timeless]

s/german/morse/ sorry

Comment 21

[Matthew T (active 1999-2002)]

> > A more consistent thing is to have PSM as one of the subitems as well.  But
> > then you'll have to figure out what to put on the top level.
>...
> I don't know what to put their either :(

This is the point where you rediscover what I've been saying for the past one 
and a half years -- that the prefs shouldn't *have* panels for category 
branches as well as category leaves. Not only does it cause illogical 
hierarchies such as this one, but the small size of the twisties makes it 
unneccessarily difficult to get to the child categories, and the branch/twisty 
distinction has very poor discoverability.</rant>

What on earth is `Images' doing in the `Privacy and Security' category? If 
someone asks me how to turn images off in Mozilla, and I tell him to look in 
the `Privacy and Security' category of prefs, he'll think I'm joking.

Comment 22

[Terry Hayes]

The image manager is considered a privacy feature, since it's purpose (or at
least one purpose) is to keep your browser from fetching images from ad servers
which may track your movements.  Notice that "Image Manager" appears underneath
"Privacy and Security" in the task menu.

I just noticed that I used "Security and Privacy" rather than "Privacy and
Security" in my patch.  I'll fix that.

As for panels on the categories, I'll go with what people what.  I can certainly
move the items that have in the category panel to another place, such as
"Security Managers" or something.

Comment 23

[Stephen P. Morse]

Images are already in the privacy-and-security section of the task menu.  The 
rationale is that images can bring in cookies.  Also images can be used as web 
bugs.  So loading of imnages does have privacy implications.

Comment 24

[Stephen P. Morse]

Oops, mid-air collision.  But it shows that Terry and I are on the same 
wavelength.

Comment 25

[Bob Lord]

If it makes more sense to move Manage Certificates and Manage Security Devices 
to a a sub-pref panel, I'd be fine with that.  

It makes some sense to leave "Reset Security Settings" attached to the "Privacy 
and Security" panel, but it's scope would have to cover all the sub-pane prefs.

Comment 26

[Matthew T (active 1999-2002)]

Yes, I'm very well aware of why the image prefs are in the `Privacy & Security' 
category. But that's only because, like Terry and Morse, I know about Web bugs 
and cookies and stuff. For the average Joe in some European country where 
Internet access is charged by the megabyte, who just wants to turn images off, 
having this pref in the `Privacy & Security' category makes no sense at all.

Comment 27

[Bob Lord]

mpt: what is your counter-proposal?

Question: will the image manager tab ship with the Netscape build?  If not, then
perhaps the debate over where it should go should center on more advanced
Mozilla developers. Average Joe will not be using the Mozilla binaries.  In that
case, it seems appropriate to call out the security aspects of image management,
especially since that's how it's grouped in the Tasks/Privacy and Security
pulldowns.

Comment 28

[timeless]

Either Navigator or Appearance. Navigator under the assumption it's a web 
browser function. Appearance because it also affects Mail.

Comment 29

[Matthew T (active 1999-2002)]

I agree with Timeless that `Appearance' would probably be the best place for 
image prefs for now, after `Fonts' and `Colors'. Ultimately I think there 
should be a `Display' branch which deals with all aspects of content display 
(fonts, colors, images, cookies, filters, style sheets, etc), distinct from the 
branches dealing with individual applications. (I have a truckload of ASCII art 
if you want to see it.)

Comment 30

[Terry Hayes]

I need a decision on this stuff.  Here's the plan.

1) I'm going to move Images under "Privacy and Security" to be consistant with
the Task menu.  If you don't like it file a bug on that (both prefs and tasks)
2) I'm going to leave the certificate and device managers on the first page. 
That's the way it appears now.  If you don't like that, open a new bug.

I'd like an r= from ddrinan on the PSM changes and an r/sr= from ben on the
whole (since it's prefs related).

Comment 31

[David P. Drinan]

Patch looks good to me. 
r=ddrinan.

Comment 32

[Stephen P. Morse]

Please don't check this in with certificates on the first page.  It looks really 
silly to have cookies et al as a subframe under certificates.

Comment 33

[Terry Hayes]

Attachment: New proposed patch

Comment 34

[Terry Hayes]

Attachment: screenshot of new proposal (with certificate panel)

Comment 35

[Terry Hayes]

I've modified this proposal:
1. There will be no content (by default) on the Privacy and Security pane
2. Added a Certificates panel to hold "Manage" buttons and
3. Moved choice of auto/manual cert select from SSL (which was long) to the
Certificates panel

Comments?

Comment 36

[sairuh (rarely reading bugmail)]

unsure if this has been clearly addressed: when this is checked in, how will the
preferences appear in builds without psm? the reason i ask is that by default
[at present] my linux mozilla debug doesn't build with psm by default. [there's
prolly a bug on that whose number i'm not remembering at the moment.] tia!

Comment 37

[Terry Hayes]

Without PSM, the prefs will appear as in the screenshot, except that there will
be no SSL or Certificates panel.  The Privacy and Security heading will still be
there, with the items moved from Advanced underneath.

Comment 38

[Terry Hayes]

Need sr for this latest patch (blizzard, ben ?)

Top level-panel for P&S will remain blank for now.  A preference reset function
may be proposed for that location (as a separate project).

Comment 39

[Christopher Blizzard (:blizzard)]

sr=blizzard

Comment 40

[sairuh (rarely reading bugmail)]

hrm, blank toplevel panel if psm isn't built?

mpt, german, d'you have suggestions for that?

Comment 41

[Jeremy Loeb (gone)]

I am creating a mock-up for what we might do with that top-panel... The ideas 
are to use it for a "reset all security & privacy prefs" button, and below to 
keep a summary of what the user's prefs are set to. also would be nice to 
include a slider like microsoft has, so that the user can choose from 3 or 4 
buckets of pref selections.

Comment 42

[Bob Lord]

My guess is that it's too late to add features like "security sliders" and
"reset all security prefs".  We would not make 0.9.1, and we probably don't have
time to do the work for 0.9.2 either.

Are there any other Privacy/Security prefs that are squeezed into some other
panel that might find a nice home on this top panel?

Comment 43

[Jeremy Loeb (gone)]

Two things:

The recent build that I am using (ID: 2001051404) still has most of the privacy
and security categories under "advanced" rather than under "Privacy and
Security" (which now still only has SSL as a subcategory). I just want to make
sure we are still planning on making this change and including passwords,
cookies, etc. under Privacy and Security.

The second thing is that I see a "Reset Settings" button already in this build.
Can we retain that for the top panel? 

Comment 44

[Bob Lord]

First, the builds from this morning have the changes.  They seem to all be there.

Second, the "Reset Settings" was a feature we planned to reset just the crypto
features.  I'm not sure if we'll have time to get it in.  Also, if we move it to
the top panel, then we probably need to make it apply to all the prefs in the
subordinate panels. That would be a pretty cool feature, but I know my team
can't commit to that work. 

Thoughts?

Comment 45

[sairuh (rarely reading bugmail)]

jeremy, bob, et al. i've spun off a separate bug for the blank toplevel Privacy
and Security panel issue, for easier tracking [at least for me :) ]: bug 81526.
adding necessary dependency...

Comment 46

[Terry Hayes]

*** Bug 75129 has been marked as a duplicate of this bug. ***

Comment 47

[Alex Bishop]

*** Bug 88526 has been marked as a duplicate of this bug. ***

Comment 48

[Blake Ross]

What do my images have to do with my privacy and security?

Because of this move, few people are going to find the image preferences, 
specifically the much wanted looping pref (see bug 88526).  I think we should 
move back this panel for rtm.

Comment 49

[Blake Ross]

Okay, I read through this bug.  I see the location of Images has already been 
discussed, and agree that Appearance is the best place we have for it for now.  
It doesn't make sense in Mozilla builds, and makes even less sense in Netscape 
builds because they don't have the image manager.

I don't understand why we need a separate bug for tasks and prefs.  But then, I 
don't understand why we knowingly put Images where it is, all for the 
purpose of being consistent with the horrible Tasks menu, just so we could worry 
about it later.  Now it's later; we already have bugs on the Task menu, let's 
use this one -- which caused this regression -- to fix the location of the 
Images panel...

Comment 50

[Jussi-Pekka Mantere]

Removing nsenterprise nomination.

Comment 51

[Stephen P. Morse]

Don't understand why this bug report is still open.  Cookies and images have 
long since been moved from the advanced section to the privacy/security section.  
Closing this one out as fixed.

Comment 52

[Markus Gerstel]

...