451875 - Provide "Safebrowsing is not perfect" disclaimer

Status: RESOLVED FIXED

(Camino Graveyard :: General, defect)

Description

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Bug 358299 comment 21:

> "Our Terms of Service require that if you indicate to users that your service
> provides malware or phishing protection, you must also let them know that the
> protection is not perfect. This notice must be visible to them before they
> enable the protection [...]"
> 
> Does this prevent us from defaulting protection to on? How does Firefox handle
> this, as it's not in their pref UI?

Firefox displays this information in the EULA that appears when mounting their
disk image:

"5.  WEBSITE INFORMATION SERVICES.  Mozilla and its contributors, licensors and
partners work to provide the most accurate and up-to-date phishing and malware
information.  However, they cannot guarantee that this information is
comprehensive and error-free: some risky sites may not be identified, and some
safe sites may be identified in error."

I suppose we'll have to do the same if we want to enable the feature by
default, as it's one of the only ways to non-obtrusively display the warning
beforehand.

----

My preference, partly from an general annoyance standpoint and partly from a specific QA/regression-hunting hindrance standpoint, is to show an HTML file or web page on launch (like our current cbo/welcome) the first time the user launches a version with this feature and then set a pref so they don't have to see it again.

Comment 1

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Some questions here:

1) Is there Google-approved text, or do we need to come up with our own?
2) Can we localize the text? If so, should we?

3) What do we want the UI for this to look like (first-run web page, link in chrome to cbo, etc.)

Comment 2

[Samuel Sidler (old account; do not CC)]

(In reply to comment #1)
> 1) Is there Google-approved text, or do we need to come up with our own?

We should use the text that exists in Firefox right now in about:rights. We can create a page similar to this if it's best/easiest, which is probably is.

> 2) Can we localize the text? If so, should we?

We can and we should.

> 3) What do we want the UI for this to look like (first-run web page, link in
> chrome to cbo, etc.)

I'd prefer a link by the pref (in the pane, forced to open in the current browser) and maybe a link in the About Camino window if that makes sense and I'm not sure it does.

Comment 3

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

The quote in comment 0 says we have to give the "not perfect" notice *before* users enable the protection.  

We have the "not perfect" notice as part of the hint text in prefs, but if we want the pref on by default (which I think we do), we'd have to show some sort of notice before the pref is enabled, which essentially means at first launch of a version shipping with the pref on.  That rules out Sam's suggestion for comment 2 item 3.

If it's something we're shipping in the app and want localized (which I agree we should do), we need to have the UI and text in place before b4, which is fast approaching.

Comment 4

[Stuart Morgan]

Quoting from the ToS (emphasis mine):
"*If you indicate to users* that you are providing phishing or malware protection, then you also agree that before any user begins using the service You will provide conspicuous notice that the reliability and accuracy of the service cannot be guaranteed"

It's not entirely clear to me that that prohibits using the pref pane. The part that confuses me is "to users" vs "any user"... does that mean that if user A reads our website (where we would tell people about the feature, including explaining the limitations), then we can't default to on for user B who has no idea that the user exists? That seems like it would be odd.

If it doesn't mean that, then it sounds like our obligation is simply to make sure that any user who finds out we have the feature, via prefs or our website, also gets the notice about the limitations.

Comment 5

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

What's our current consensus on this?  Is the prefPane warning sufficient?  Or the prefPane warning in association with the info page text (i.e. http://caminobrowser.org/documentation/security/safebrowsing/#about )?  Can we close this bug, or do we need more in-app UI?

(In reply to comment #3)
> If it's something we're shipping in the app and want localized (which I agree
> we should do), we need to have the UI and text in place before b4, which is
> fast approaching.

Comment 6

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Per discussion at this morning's meeting, we believe our current UI and the safebrowsing info page are in compliance.  So FIXED by bug 436968 and bug 451092.