Closed Bug 522897 Opened 10 years ago Closed 2 years ago

Plugin check page should know about blocklisted plugins

Categories

(Websites :: plugins.mozilla.org, defect, critical)

defect
Not set
critical

Tracking

(Not tracked)

RESOLVED WONTFIX

People

(Reporter: davemgarrett, Assigned: kev)

References

()

Details

If you disable the blocklist system with a blocked plugin installed and then view the plugin check page it lists it without noting a thing. This page should get information from the blocklist server and warn clearly about the known problem.
Depends on: 512787
Wow, I was just reading a post by daniel v about this on google when this  dependancy came through, Is this what we'd cover here?  Finding a specific version and reporting its blocked so research or find an update?

Daniel mentioned here something that seems relevant but was in reference to users updating the browser from 3.5 to 3.6 a few days ago:

http://groups.google.com/group/mozilla.dev.planning/browse_thread/thread/2fcd83608b62d5ce/62a9e96647481dc2

"Plugins do not announce a compatibility range, we have to assume plugins
are always compatible.

Unless you mean we should do something like put known-incompatible
plugins on the blocklist, and that the update process would check the
blocklist and if upgrading would result in an unblocked extension or
plugin getting blocked treat that as an incompatible addon.

We of course have no code to do that, and unless we switch to a slow
roll-out strategy we're not likely to find out about incompatible
plugins until it's too late to do any good (unless it's a major plugin,
which we're likely to get fixed or worked around before ship)."

Here are a few examples:

Bug 498164 was being discussed for XPCOM being kicked from 3.6
Bug 510082 Silverlight 2.0 or 3.0 is currently not working with 3.6 due to compositor changes.
Windows Presentation Foundation or Windows .Net Framework Plugin being blocklisted recently.  
Or Adobe Flash has a security issue in prior version.
All I'm suggesting with this bug is that the plugin check page
http://www.mozilla.com/en-US/plugincheck/
label any plugin it detects as being in Mozilla's blocklist if it is
http://www.mozilla.com/en-US/blocklist/
(though, the plugin check server would need to pull the information from the actual blocklist server, not that front page)

Especially with the new case of soft blocked plugins where a user can override the block, this plugin check page should know which plugin versions Mozilla has specifically singled out as particularly bad on their blocklist that they really need to be updated. The whole point of the plugin check page is to show users which plugins they need to update, and if they're still using a blocklisted one that's one they need to update.

There are also a few users who may have disabled their blocklist system, in which case this page may be the only route for them to see this information. There's also the potential case of someone simply viewing this page before their blocklist update is downloaded.
Note that for Firefox 3.6 there's apparently a severity=0 blocklist capability to indicate plugins that are out of date but not as major of a risk as usually reserved for the blocklist. I'm specifically talking about severities 1-3 here, and regardless of application version (or application at all).
Component: Plugins → plugins.mozilla.org
Product: addons.mozilla.org → Websites
What do you want, an icon or something similar to note if the user has something that's been blocked?
An icon with a label sounds good. Maybe also a red border around the entry.

Note that this would also be particularly useful with bug 525704 so users of non-Mozilla browsers could also see which plugins they have might be bad.
Morgamic: Ping.
Taking. Agreed it's necessary, and will add it to roadmap.
Assignee: nobody → kev
Given state of plugincheck, resolving wontfix
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.