46400 - Netscape servers contacted for panel options

Status: RESOLVED FIXED

(SeaMonkey :: Sidebar, defect)

Description

[Ben Bucksch (:BenB)]

Split-off from bug 37877.

------- Additional Comments From Ben Bucksch 2000-07-07 19:25 -------

[...] I seem to
be fed by a Netscape server with panel opens (not just panel contents). My
custom, direct from cvs Mozilla build shows as panel options:

 What's Related
 Search
 Bookmarks
Lieblinge [(extremely bad translation of "Favorites" into German)]
  ConSors Discount-Broker
  DAB Online Brokerage
  eBay Germany
  investorworld
  lastminute.com
  TicketOnline
My Netscape Network
  Gesamtes Netzwerk
 International

I get not hit searching for "consors" on our CVS rep, so this data must be
fetched from the net. The localized content suggests an embedding in the
Netscape Network. So, this bug got security-relevant.

Please, I am here to work. I don't want to be snooped, nor distracted by
commercial stuff. If you need to test network-fetched content,
- provide an option to disable it
- set up test cases on mozilla.org servers, not Netscape servers
*before* you check it into the tree and enable it.



------- Additional Comments From Ben Bucksch 2000-07-07 19:26 -------

BTW: I wrote this *after* I took a deep breath :).



------- Additional Comments From [e-mail] 2000-07-25 10:41 -------

[...]
We should consider what might need to be done from a privacy standpoint for 
PR3. The panel list should only be requested when you try to customize, and if 
you don't have any netscape-hosted panels there shouldn't ever be a request to 
netscape.com for anything. If you think the sidebar is pinging netscape.com 
when all you have is mozilla.org panels then we've got a problem I'm interested 
in but it should be filed as a separate bug. Assign that to me for now if you 
like since I'm the manager of some privacy-related stuff like cookies.

Comment 1

[Daniel Veditz [:dveditz]]

CC'ing various others who might be interested, and nominating for nsbeta3, at 
least we should look and see what's really going on. We don't need another 
SmartDownload.

Contacting Netscape for the panel list when you customize is certainly 
reasonable (and hopefully the customization service is a pref setting that 
could be pointed elsewhere), but if you had no netscape.com panels in your 
sidebar we shouldn't ever ping netscape.com

What about the default panels like "What's Related"? Is it "obvious" they're 
there and that they need to contact Netcenter to do what they do, or is it 
another potential PR disaster?

Comment 2

[Daniel Veditz [:dveditz]]

I may have stomped on changes from Ben. The collision detector said the 
"blocks" field was all he changed and it seemed easier to just add that than 
redo all my edits. Sorry if you also made other changes (and if you did we 
should file a bug on bugzilla's collision detector).

Comment 3

[Ben Bucksch (:BenB)]

What an irony:
<quote src="http://home.netscape.com/browsers/6/su_setup.html">
My Sidebar is yours
</quote>

Comment 4

[Daniel Veditz [:dveditz]]

reassigning to morse to check the privacy implications since he is doing 
similar work already. This is an investigatory meta bug, the "+" is not 
authorizing code changes, and this bug itself can be closed when the 
investigation is complete (spawning new bugs if any changes are necessary).

Comment 5

[Daniel Veditz [:dveditz]]

(didn't actually reassign, oops)

Comment 6

[Stephen P. Morse]

I'm not completely understanding something here.  Are you saying that merely 
bringing up the sidebar but not clicking on any of its contents will cause a 
ping to netcenter?  Using a sniffer I'm not seeing that at all.  Or do I have to 
click on some content in the sidebar to effect the ping?  If so, which one?

Comment 7

[Daniel Veditz [:dveditz]]

I don't know, that's why it needs investigating :-)

Who does it ping and when?  If the sidebar's closed it'd better be nobody. If 
the sidebar is open (as it is by default) does it ping netscape? When tabs are 
loaded does it ping netscape? When you select a non-Netscape tab does it ping 
Netscape?

This needs to be tested in a commercial build moreso than in Mozilla.

Comment 8

[Ben Bucksch (:BenB)]

You have to "Customize" or "Add" panels.

Comment 9

[Ben Bucksch (:BenB)]

To be clear: Some of the contents you see in the customize dialog (i.e. the
available panels) are fetched from Netscape servers.

> this bug itself can be closed when the investigation is complete

Please please this bug open as tracking bug until the issue raised here are
resolved.

Comment 10

[Daniel Veditz [:dveditz]]

I have no problem with Mozilla hitting netscape servers when you choose 
customize. Netscape is providing a sidebar service and so far no one else is. 
There is a pref to change sidebar servers once there is an alternative, so 
maybe what you want instead is to create a different bug saying 1) mozilla.org 
should provide a sidebar service, and 2) the pref should be changed to that by 
default.

The privacy issue is if we're hitting the sidebar (or other Netscape) server at 
times other than when a user makes an explicit action that they can reasonably 
expect is getting data from the net.

Comment 11

[Ben Bucksch (:BenB)]

Daniel, I certainly do *not* expect the browser to hit the net, if I choose
"Customize Sidebar".

1. I want an option to turn off all hits to the net.
2. I want Mozilla to never hit Netscape servers unless I explicitly say "go to
Netscape" (e.g. through urlbar or links).

If mozilla.org doesn't provide a sidebar service, then turn it off by default.

Comment 12

[Stephen P. Morse]

In answer to the questions raised, here is the pinging when using the sidebar 
in the commercial product:

Bring up sidepanel itself does not cause any pings.

By default the CNN tab is opened.  That causes some pings to netcenter to get 
the content.

Similarly when you open the stocks tab.

Opening the buddylist tab or search tab does not do any pinging (signing on to 
the buddy list or using the search will do pinging as expected).

Similarly opening the what's-related tab on a blank screen does not do any 
pinging.

Comment 13

[Stephen P. Morse]

When "customize sidebar" is selected, there are several pings to netscape to get 
information on what panels are available.

Comment 14

[Stephen P. Morse]

Now for mozilla product.  By default the bookmark tab comes up open.  Bringing 
up the sidebar panel and the resulting open bookmark panel does not cause any 
pinging.

Customize sidebar does ping netcenter, just as was done in the commercial 
product, because netcenter is currently the only provider of customized content.

Comment 15

[Stephen P. Morse]

Setting the nsbeta3- to get off the beta3 radar.

Comment 16

[Ben Bucksch (:BenB)]

> Customize sidebar does ping netcenter

Yes, this is the bug.

requesting fix for ASAP.

Comment 17

[Daniel Veditz [:dveditz]]

Thanks, Steve, for looking into this.

Resetting to [nsbeta3-], which means only that it isn't important for Netscape 
to fix this before the *Netscape* beta. If you find a non-netscape person to do 
it feel free to reassign.

Reassigning to slamm to change the pref in Mozilla to some non-Netscape sidebar 
server should one ever be created. Created bug 49367 (set up a mozilla.org 
sidebar server) as a blocker of this one.

Comment 18

[Ben Bucksch (:BenB)]

> which means only that it isn't important for Netscape 
> to fix this before the *Netscape* beta.

Netscape beta is irrelevant. In fact, this bug is irrelevant for *any* NS
product. This is a Mozilla bug.

> If you find a non-netscape person to do it feel free to reassign.

Why should non-Netscape people clean the dirt of Netscape employees?

BTW: Should be pretty easy to fix for somebody who knows the relevant line.

Comment 19

[Daniel Veditz [:dveditz]]

Exactly, this is not relevant for Netscape's release, the nsbeta3- is 
telling Steve it ranks lower in priority than his nsbeta3+ bugs. Since he 
is a Netscape employee that makes a lot of sense, don't you think?

Ben, it turns out lots of non-Netscape mozilla developers think Netscape's 
sidebar service is useful, at least the ones who use the sidebar. If you don't 
use the sidebar then what does it matter what happens if you customize it?

I doubt "Netscape" gives a fig whether Mozilla points at the netscape server. 
If the mozilla community would rather set up their own server or even have the 
feature go dark then go for it. But you are the only person I've heard complain 
about this. Netscape obviously isn't going to spend effort creating a 
second alternate sidebar service ("why are you spending time doing X when you 
could be fixing the browser faster instead?" is a constant complaint), *you* 
aren't offering to create one, *no* one has shown any interest in creating one. 
So you'd rather we just turn the thing off?

I'm sure mozilla.org folks would be happy to turn the pref off if you can 
demonstrate that a majority of mozilla developers want it turned off. Maybe you 
can lobby someone on IRC to start a discussion at the mozilla conference here 
on 8/18 (tomorrow), or start one in a newsgroup.

Comment 20

[Ben Bucksch (:BenB)]

If I'm alone with this opinion, I will mark this WONTFIX and shut up. Would
still be nice, if somebody could tell me how I can prevent my local Mozilla to
contact Netscape servers.

Comment 21

[Daniel Veditz [:dveditz]]

That's easy (and easy to find in lxr), change the 
"sidebar.customize.all_panels.url" pref in all.js

Don't know what would happen if you set that to nothing, might be safer to 
point at a valid, if empty, all-panels.rdf file locally using a resource: URL. 
Also don't know if the code would choke if it couldn't find the %LOCALE% or 
%SIDEBAR_VERSION% tokens to replace, but those would presumably be bugs if it 
couldn't.

Comment 22

[Ben Bucksch (:BenB)]

> (and easy to find in lxr)

Not if you don't know what to search for.

> change the "sidebar.customize.all_panels.url" pref in all.js

Thanks.

> Don't know what would happen if you set that to nothing

Nothing, i.e. only local panels are listed, just what I want.

Taking bug, easy to fix. (Assuming it won't be WONTFIX.)

Comment 23

[Ben Bucksch (:BenB)]

I'm tempted to just remove the dynamic listing from Mozilla completely (i.e. set
the pref to null). Mozilla ships with some local panels, which will still be
listed, and others can be added via links (see tinderbox). Engineers working on
this can set their prefs to point to Netscape servers.

Comment 24

[Ben Bucksch (:BenB)]

Attachment: Fix, version 1.

Comment 25

[Christopher Blizzard (:blizzard)]

The only problem that I have with this is that we are loosing the ability to
easily test Mozilla's ability to download rdf off the net from the sidebar.
Quality is Job One.  Ben, are you offering to host another default RDF
datasource for testing?

Comment 26

[Christopher Blizzard (:blizzard)]

I've thought about this a little more.  I really want to see testing for the
networking in place.  How about a dialog that pops up that asks you if you want
to download the rdf with a button that asks if you ever want to be asked again?
 That sounds like a reasonable comprimise that lets users choose their own level
of security and still allows testing.  Ben, does that sound reasonable?

Comment 27

[Ben Bucksch (:BenB)]

Attachment: Fix, version 2. Leave a hint about the feature in the default prefs, so vendors/customizers know about it.

Comment 28

[Ben Bucksch (:BenB)]

> we are loosing the ability to
> easily test Mozilla's ability to download rdf off the net from the sidebar

Netscape engineers/Qa propably uses Netscape builds anyway, and they can have
the pref enabled. Even if not, they can enabled it in their default pref.

I sincerely doubt that individuals working on/testing Mozilla will want to test
this feature. It is mostly an ad space (just like Netscape's default bookmarks)
IMO.

> How about a dialog that pops up that asks you if you want
> to download the rdf with a button that asks if you ever want to be asked
> again?

Sounds good, any volunters? Until we have that, I'd like to disable it. Don't
make network queries without my explicit request.

Comment 29

[Daniel Veditz [:dveditz]]

CC'ing Brendan to get Mr. Mozilla's perspective

While I would much rather have a non-commercial sidebar server than Netscape's 
in the mozilla build, it would be *extremely* presumptious of you to 
unilaterally turn off this feature entirely without feedback from the mozilla 
community and mozilla.org staff. There are people--non-Netscape people--who 
*like* this feature, and the repository at sidebar.netscape.com is a pretty big 
one full of interesting stuff (Slashdot, Segfault, Hacker News Network, Perl 
News, BetaNews.com, and of course commercial sites like CNN and Wired).

This discussion needs to move out of the dark corners of this bug and into a 
newsgroup before any change is made. If you had an alternate sidebar server 
that'd be one thing, but if the choice is between Netscape's server and nothing 
then the people who want nothing can just not click on the customize button. Or 
put the pref discussed above in their prefs.js

Comment 30

[David Krause]

I think we should definitely change how this works.  First, let me say that I do
use some of the sidebars that download from netscape, namely CNN and a few other
news sites.  I think the problem here though is that it is not obvious that
clicking on customize sidebar is going to contact some server on the internet.
I think that until we have a mozilla.org sidebar server the netscape sidebars
should be available.  But, you should have to click a button that says "Download
additional sidebar panels from Netscape" in the Customize Sidebar UI.  It
shouldn't just automatically do it.  This could cause major PR problems.  If you
don't believe me just look at the recent AOL/NS SmartDownload fiasco.

Comment 31

[Brendan Eich [:brendan]]

Someone want to come up with a patch that does what David proposes, and confirms
that the user wants to download additional sidebar panels?  Until then, I see no
reason to change things.  It would be foolish to remove all panels until a
mozilla.org server is set up.  Sidebar would rust, bugs would not be found, etc.

/be

Comment 32

[Ben Bucksch (:BenB)]

> it would be *extremely* presumptious of you to unilaterally turn off this
> feature entirely without feedback from the mozilla community and mozilla.org
> staff.

This wasn't my intention.


> and the repository at sidebar.netscape.com is a pretty big
> one full of interesting stuff (Slashdot, Segfault, Hacker News Network, Perl
> News, BetaNews.com, and of course commercial sites like CNN and Wired).

Interesting. I see *none* of these. See the inital descriptiobn for the complete
list I saw.

> then the people who want nothing can just not click on the customize button

No, this is not an option. I must be able to explore Mozilla without being
scared that it does something I don't want it to do.

Anyway, how do I *remove* "What's related" from the fly-out-list, if not via
"Customize Sidebar"?

> It would be foolish to remove all panels until a mozilla.org server is set up.
> Sidebar would rust, bugs would not be found, etc.

Mozilla *ships* with some panels.


IMO, this feature doesn't fit into the free Internet world, which is
distributed. This feature is AOL(-AIM)-like, where a central server provides
(nearly) all available options - control by a single company.

I don't see evidance that the user can specify more than one panel list
provider. Also, there is no UI to change the server.

IMO, shipping with some integrated panels and giving the option to add more via
links on the websites which provide the panels is just fine.

I agree that this should be discussed on a newsgroup first. Which one?

Comment 33

[Ben Bucksch (:BenB)]

This bug does not depend on bug 47778. I have an empty string as sidebar
provider url, and never got such an error msg (which is correct). Removing
dependency.

Comment 34

[Blake Ross]

asa, I think this is that sidebar panels load from netscape site bug we were 
looking for...

Comment 35

[Ben Bucksch (:BenB)]

Filed bug 52997 about adding UI to change the panel list provider.

Comment 36

[timeless]

Marking blocking bug 37877 [yes it's not a clean block, but it could be argued 
that it might regress and reopen that unless it is fixed].

endico: weren't we going to have a directory on dmoz or something?

Comment 37

[Ben Bucksch (:BenB)]

timeless, if anything, the depedancy is the other way around. If there is no
Netscape content in the sidebar, the sidebar won't query netscape.com anymore.
Removing depending bug.

Comment 38

[Ben Bucksch (:BenB)]

Changing personal priorities. Giving away most of my bugs :-( (reassigning to
default owner).

I will still track these bugs closely. If you need my input, feel free to ask me.

New owner: Please do *not* close these bugs (as WONTFIX or whatever you may
find) unless they are fixed. Rather, reassign to <[e-mail]>, if you
don't want to work on them.

Comment 39

[shrirang khanzode]

spam : changing qa to sujay (New Sidebar QA)

Comment 40

[Samir Gehani]

-> [e-mail]

Comment 41

[Samir Gehani]

-> Future.

Comment 42

[Andreas]

Hi Ben,

you are NOT the only one bothered by this. If not for privacy reasons (which I
consider not so grave in this case) then for PR reasons: It may make a scandal
that Mozilla phones home to Netscape (by the way: why does Mozilla try to act as
a SERVER directly after the installation?).

I would prefer if this contacting Netscape could be switched off somewhere in
the settings (and maybe be switched off as a default in Mozilla, since it is not
Netscape).

By the way: I do use the sidebar - but for bookmarks only - so, why should
Netscape be contacted when I configure the sidebar?

Regards

Andreas

Comment 43

[Reed Loden [:reed]]

Has this been fixed in later edits to the file? Is this still an issue?
If so, please update this bug.

Comment 44

[Sylvestre Ledru [:Sylvestre]]

No activity for 13 years, let's close it.