775634 - SUMO should not report the latest ESR version as insecure

Status: RESOLVED WONTFIX

(support.mozilla.org :: General, defect, P1)

Description

[Alex Keybl [:akeybl]]

STR:
1) Download the 10.0.6esr from https://www.mozilla.org/en-US/firefox/organizations/all.html
2) Run Firefox 10.0.6
3) Click the Help > Firefox Help menu item

Got:
> Warning: You're using an insecure version of Firefox. To keep your computer and
> personal information safe, please update to the latest version of Firefox.

Expected: No warning

Comment 1

[Alex Keybl [:akeybl]]

James - are you the right person to look into this?

Comment 2

[James Socol [:jsocol, :james]]

Nope, but I've CCed some SUMO devs and added it to the current sprint.

Comment 3

[Will Kahn-Greene [:willkg] ET needinfo? me]

Grabbing this one.

Comment 4

[Will Kahn-Greene [:willkg] ET needinfo? me]

This warning is coming from kb content:

https://support.mozilla.org/en-US/kb/home-page-top

I'm passing this off to Verdi since he did the last set of changes to that article that (I think) is causing the problem.

Comment 5

[Verdi [:verdi] Best to slack me]

We don't have a way to distinguish the ESR version of Fx 10 from the insecure version of Fx 10, so we should show a warning. I'll work on the wording of it.

Comment 6

[Ricky Rosario [:rrosario, :r1cky]]

Since this is a content and not a code issue, I am resolving as INVALID.

Comment 7

[Alex Keybl [:akeybl]]

(In reply to Ricky Rosario [:rrosario, :r1cky] from comment #6)
> Since this is a content and not a code issue, I am resolving as INVALID.

Isn't the fact that we can't distinguish between mainline and ESR versions (comment 5) a code issue? Apologies for re-opening if not, but I don't want to lose visibility here.

Comment 8

[Ricky Rosario [:rrosario, :r1cky]]

(In reply to Alex Keybl [:akeybl] from comment #7)
> Isn't the fact that we can't distinguish between mainline and ESR versions
> (comment 5) a code issue?

That would be an issue in Firefox if anything. Is there anything in the user agent string or in window.navigator that can help us distinguish?

Comment 9

[Scoobidiver (away)]

(In reply to Ricky Rosario [:rrosario, :r1cky] from comment #8)
> Is there anything in the user agent string or in window.navigator that can help
> us distinguish?
Firefox 10 has 3 possible UA: ...Firefox/10.0.0 or ...Firefox/10.0.1 or Firefox/10.0.2.
Firefox 10 ESR based on security fixes of Firefox 11 has the following UA, ...Firefox/10.0.3, Firefox 12, ...Firefox/10.0.4, Firefox 13, ...Firefox/10.0.5, and Firefox 14, ...Firefox/10.0.6.
So there are no rules as Firefox 17.0.1 can be ESR or not.

Comment 10

[Alex Keybl [:akeybl]]

I think we just need to accept 2 major/minor version combinations as secure, latest mainline (14.0.1 right now) and latest ESR (10.0.6 right now).

Comment 11

[Scoobidiver (away)]

The Wiki in SUMO doesn't use the UA string but fx10, fx11, fx12, fx13, fx14 tags, so there's currently no way to differentiate Fx 10.0.2 from Fx 10.0.6.
If this behavior is changed by creating fx10esr, fx17esr, or fxesr, there's no automatic way to do that. It needs to be set manually every six weeks like the default version.

Comment 12

[Lukas Blakk [:lsblakk] use ?needinfo]

What's left to do here?

Comment 13

[Will Kahn-Greene [:willkg] ET needinfo? me]

I have no idea what's left to do here or why it's assigned to me.

Ricky: Any ideas?

Comment 14

[Ricky Rosario [:rrosario, :r1cky]]

I am pretty sure we aren't showing these warning anymore. Verdi?

Comment 15

[Verdi [:verdi] Best to slack me]

This isn't being shown on desktop since we haven't implemented a notice feature in our new design yet. It is being shown on the mobile version of sumo which is about to change. But the underlying issue has not been solved. We should warn users when they have an insecure version of fx but sumo has no ability to show a message to 10.0 users and not to 10.0.6 users. 

I will remove the mobile message and that will satisfy this bug. We should investigate a good way to alert users in the future.

Comment 16

[Kadir Topal [:atopal]]

Maybe I'm mistaken, but I thought we stopped reporting the minor version in the UA string, so that 10.0 and 10.0.6 UAs would look exactly the same. Can anyone confirm?

Comment 17

[Ricky Rosario [:rrosario, :r1cky]]

(In reply to Kadir Topal [:atopal] from comment #16)
> Maybe I'm mistaken, but I thought we stopped reporting the minor version in
> the UA string, so that 10.0 and 10.0.6 UAs would look exactly the same. Can
> anyone confirm?

That is correct. We have no way to tell them apart anyway.

Comment 18

[Kadir Topal [:atopal]]

Okay, then I'll just go ahead and close this bug, assuming it's better to prompt people to upgrade from ESR than not letting people know that their browser is outdated.