611253 - Alipay plugin is not available in the Plugin Finder Service

Status: RESOLVED WONTFIX

(Toolkit Graveyard :: Plugin Finder Service, defect)

Description

[xuan xie]

alipay.com is a third-party payment solution like paypal in China. It has more
than 1 billion active users and play a vital role in Chinese e-commerce
activity. Alipay want when user visit the website need alipay's application, Firefox can pop-up a notice bar to intall its plugin, and the browser can guild them to download the plugin antomaticlly, just like adobe flash player.
We notice that to achieve this goal, we need to submit the plugin's rdf to PFS, but we did not find the relative document about this.

Comment 1

[xuan xie]

the url of alipay plugin

https://addons.mozilla.org/zh-CN/firefox/addon/6707/

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

Given the resolution for bug 611239 and bug 611227, do you still want to keep this open?

Comment 3

[Hong Tang]

Checking with Alipay guys, will get back to you after. Thanks.

Comment 4

[Hong Tang]

By further communicating with Alipay, they are still willing to make this happen.
I am not sure, how is it possible.

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

See https://wiki.mozilla.org/PFS for documentation on what information is needed for plugins offered in the plugin finder service. See bug 663355 and bug 622463 for examples of how to request plugin finder updates. Note that some of the information might be out of date. However, it should be a good start.

I recommend that Mozilla China learn how submit patches to the Plugin Finder Service to help the Plugin Finder Service maintainers with China-oriented plugins. In particular, I think some of the strings need to be in Chinese.

Comment 6

[Frank Jiao]

Attachment: patch for pfs.php

This is a patch for  http://svn.mozilla.org/addons/trunk/site/app/webroot/services/pfs.php

This patch make PFS support for Alipay security control.

To Brian : Thank you very much for your great help to us.

Comment 7

[Kev Needham [:kev]]

Howdy folks,

We also need vendor contacts for this plugin. Who would be the contact? 

Additionally, has anyone vetted the privacy policy, as well as perf/resource usage of the plugin?

Thanks,

k

Comment 9

[Kev Needham [:kev]]

Thanks for the contact address, and I'll make sure we channel through Mozilla Online for anything that may come up. 

For privacy policy, we want to make sure any terms that are not consistent with Firefox's is clearly stated and easy to find on the alipay site. I can't tell whether it is or not, so your help there would be great. :)

For plugin testing, I'll ask Tomcat to have a look, but if we have any known instances of memory leaks, impacts to rendering times, startup or shutdown delays, etc., it'd be good to qualify them and ideally give feedback to the developer.

Comment 10

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Kev [:kev] Needham from comment #9)
> Thanks for the contact address, and I'll make sure we channel through
> Mozilla Online for anything that may come up. 

I have marked the with her email comment hidden. I think we should avoid disclosing the contact info in bugzilla. Instead there should be some back-channel to share this data. (Probably just email between Hong and Kev.)

> For privacy policy, we want to make sure any terms that are not consistent
> with Firefox's is clearly stated and easy to find on the alipay site. I
> can't tell whether it is or not, so your help there would be great. :)

Hong, does Alipay publish a privacy policy anywhere on their site? I am guessing it is in Chinese, if so.

> For plugin testing, I'll ask Tomcat to have a look, but if we have any known
> instances of memory leaks, impacts to rendering times, startup or shutdown
> delays, etc., it'd be good to qualify them and ideally give feedback to the
> developer.

We know of some issues with the plugin and Mozilla China is working with Alipay on them. At the same time, this plugin is only used/useful for websites owned and operated by their parent company, Alibaba.

The plugin is very simple; it is just a Windows password edit control, with some anti-keylogging and crypto stuff in it.

Comment 11

[Hong Tang]

Brian, thanks for helping on explanation.

http://help.alipay.com/lab/help_detail.htm?help_id=212654&keyword=%D2%FE%CB%BD%C8%A8%B1%A3%BB%A4%D6%C6%B6%C8
This is their privacy policy website.

One thing different from Adobe plugin is, the Alipay plugin service is only apply for Alipay site not other company's site.

Comment 12

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Kev [:kev] Needham from comment #9)
> For privacy policy, we want to make sure any terms that are not consistent
> with Firefox's is clearly stated and easy to find on the alipay site. I
> can't tell whether it is or not, so your help there would be great. :)

Kev, what exactly is our privacy policy requirement regarding the plugin finder service. Do we need to have the privacy policy translated into English? Do we need to have a privacy review for each plugin?

> For plugin testing, I'll ask Tomcat to have a look, but if we have any known
> instances of memory leaks, impacts to rendering times, startup or shutdown
> delays, etc., it'd be good to qualify them and ideally give feedback to the
> developer.

I think it will be difficult for non-Chinese-reading people to test the plugin because it seems to be active only on the Chinese version of the pages. Perhaps we should document the stuff that Tomcat would normally do that Mozilla China can have somebody there do it.

Note that this is the first of many requests for these Chinese-site-specific and Chinese-language-only plugins to be added to the Plugin-finder service. We are going to use this bug as a template for future bugs. So, it is worth investing some effort into a sustainable process for dealing with them.

Comment 13

[Carsten Book [:Tomcat]]

sure i can work with people at mozilla china regarding testing etc

Comment 14

[Frank Jiao]

(In reply to Brian Smith (:bsmith) from comment #12)
> Note that this is the first of many requests for these Chinese-site-specific
> and Chinese-language-only plugins to be added to the Plugin-finder service.

Yes. This number will more than the current total in PFS.
In China,every Bank,Pay Center and Securities Company had at least two own plugins,one is Security Control for Enter Password, the other is Digital Certificate for USBKey.
And many video web site have their own P2P plugins.

Comment 15

[Hong Tang]

(In reply to Carsten Book [:Tomcat] from comment #13)
> sure i can work with people at mozilla china regarding testing etc

Yes, let us know for anything needed.
Thanks.
Hong

Comment 16

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Frank, please see Bug 402108. We should verify that the AliPay plugin installs correctly on Windows XP. We should also verify that it installs correctly on Windows Vista/7 when UAC is set to its maximum (strictest) setting.

Comment 17

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

We should do also do a test-run of blocklisting the plugin, and/or even actively block older versions of the plugin. This way, it is clear how people in Mozilla China will be able to request blocklisting of this plugin and future plugins they submit when it becomes necessary to do so.

Comment 18

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 582780 [details] [diff] [review]
patch for pfs.php

Review of attachment 582780 [details] [diff] [review]:
-----------------------------------------------------------------

Does Alipay have a plugin for Mac and/or Linux? 

Frank, when posting patches to bugzilla:

1. make sure you check the "Patch" checkbox in the form where you upload the patch.

2. Set the "review" field to "?" and put an email address of the person you want to review the patch in the field next to it. For patches to the Plugin Finder Service, [e-mail] is probably the best reviewer, according to Tomcat.

Click the "Splinter Review" link next to your attachment to read the feedback on your patch.

::: pfs.php
@@ +326,5 @@
> +        if (preg_match('/^Win/', $clientOS)) {
> +            $name = 'Alipay security control';
> +            $guid = '{e411b7af-6908-4ded-807d-b9303e5560df}';
> +            $iconUrl = 'https://img.alipay.com/common/favicon/favicon.ico';
> +            $manualInstallationURL = 'http://mozilla.com.cn/selections/addon/62/';

The Alipay website is (AFAICT) 100% HTTPS but mozilla.com.cn is not HTTPS. It would be great to make HTTPS work on mozilla.com.cn, but until then, it would be more secure to link to the page on the Alipay website where the plugin can be downloaded.

@@ +329,5 @@
> +            $iconUrl = 'https://img.alipay.com/common/favicon/favicon.ico';
> +            $manualInstallationURL = 'http://mozilla.com.cn/selections/addon/62/';
> +            $needsRestart = 'false';
> +            $InstallerShowsUI = 'true';
> +            if (preg_match('/^(?!.*(Win64|x64))Win.*$/', $clientOS)) {

This condition is redundant (AFAICT) with the condition above, which already chceks that $clientOS is Windows. So, you can make the setting of $version, $InstallerHash, and $InstallerLocation unconditional; that is, you don't need this "if."

Comment 19

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: patch for pfs.py in github

Patch to add alipay plugins (Windows & Linux) to:

https://github.com/mozilla/zamboni/blob/master/services/pfs.py

Comment 20

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The GUID for the Linux version of Alipay was generated.

Also, the patch does not add Alipay Security Control 3 (note the number "3"), Hector clarified that there was no need for this.

Comment 21

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: patch for pfs.py v2

Thanks Hector for the f2f comments, attaching a new patch.

Comment 22

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: patch for pfs.py v3

braindead if condition mistake, thanks to Hector for pointing it out.

Comment 23

[Wil Clouser [:clouserw]]

Comment on attachment 632630 [details] [diff] [review]
patch for pfs.py v3

It looks fine to me (a guy who knows relatively little about PFS) but I'll need a=kev that it's something we want to add before we commit it.

Comment 24

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 632630 [details] [diff] [review]
patch for pfs.py v3

Asking for additional review from kev.

Comment 25

[Hector Zhao [:hectorz]]

Comment on attachment 632630 [details] [diff] [review]
patch for pfs.py v3

Review of attachment 632630 [details] [diff] [review]:
-----------------------------------------------------------------

Information provided in this patch is accurate as of 13 June, 2012, so I'm feedback+ it, with my only concern included inline.

::: services/pfs.py
@@ +367,5 @@
> +                name='Aliedit',
> +                guid='{5077f3d3-629c-490b-a103-9aa8c0146951}',
> +                version='1.0.3.20',
> +                InstallerHash='sha256:1151399faffe97e676ea9a922199902e287f2feaf4142e158cff0ba874410b78',
> +                InstallerLocation='https://download.alipay.com/alipaysc/linux/aliedit/1.0.3.20/aliedit.tar.gz')

Is it necessary to include InstallerHash and InstallerLocation for a Linux tarball?

Comment 26

[Hector Zhao [:hectorz]]

Sorry for accidentally cleared clouserw's r+ flag

Comment 27

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Is it necessary to include InstallerHash and InstallerLocation for a Linux
> tarball?

clouserw / kev: Thoughts? (I'm not sure about this)

Comment 28

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: patch for pfs.py v4

Hector and I were testing patch v3 and we found some errors.

v4 fixes more excess close braces, and remove the InstallerHash and InstallerLocation fields for Linux.

Hector points out that on Linux, manual installs are required for tarballs. Setting those fields will cause a failed status to show after download (alongside Manual Install), whereas not setting them will immediately show the Manual Install button. Thus, those fields are unnecessary.

Carrying over r+ from clouserw, and asking for feedback? from Hector again.

Comment 29

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Comment on attachment 633084 [details] [diff] [review]
patch for pfs.py v4

Hector and I have tested v4 to work successfully.

Wil, could you please check this into the Zamboni github repository?

This bug can then be resolved FIXED. \o/

Comment 30

[Wil Clouser [:clouserw]]

I'll need a=kev before this lands.  There are a hundred open PFS bugs asking to be added to the service, I don't know why this would make the cut and those wouldn't.  I'm not saying it shouldn't, I'm just not involved in the decisions.

Comment 31

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The last time we tried to do this, it got stuck in some kind of privacy review uncertainty. I CC'd Alina so that she can let us know if the privacy review stuff has been sorted out.

Comment 32

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> http://help.alipay.com/lab/help_detail.
> htm?help_id=212654&keyword=%D2%FE%CB%BD%C8%A8%B1%A3%BB%A4%D6%C6%B6%C8
> This is their privacy policy website.

Alina, this privacy policy link that Hong provided from comment 11 is still a valid link.

Is it possible to let us know the status of it? Or please let us know who we should refer the review to (e.g. Legal?).

Comment 33

[Alina Hua]

I'm conducting the review this week. Will connect with Kev and provide more of an update soon. Thanks for your patience!

Comment 34

[Alina Hua]

I spoke with Kev, Asa and Jishnu today about Alipay and the broader issue of including Chinese plugins into PFS in general. I'll file a Privacy/Legal bug shortly to fork that discussion into its own ticket and place it as a dependency for this ticket.

Comment 35

[Hector Zhao [:hectorz]]

(In reply to Alina Hua from comment #34)
> I spoke with Kev, Asa and Jishnu today about Alipay and the broader issue of
> including Chinese plugins into PFS in general. I'll file a Privacy/Legal bug
> shortly to fork that discussion into its own ticket and place it as a
> dependency for this ticket.

Hi Alina,

Would you please add {htang,fjiao,bzhao}@mozilla.com to the cc list of bug 767228 (if not already) so that we in Beijing office can access it and understand the current progress? Thanks.

Comment 36

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Hector, I've added you and Frank to the cc list. Hong is already cc'ed.

Comment 37

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Unfortunately, the ball is no longer in my court for this. Unassigning.

Comment 38

[Benjamin Smedberg]

We are replacing pfs, and do not intend to provide plutonium installation support in Firefox now. WONTFIX.

Comment 39

[Kev Needham [:kev]]

Comment on attachment 633084 [details] [diff] [review]
patch for pfs.py v4

Review of attachment 633084 [details] [diff] [review]:
-----------------------------------------------------------------

r- given PFS decision (sorry, old bug, cleaning up)