798176 - Figure out whether plugins marked as vulnerable and updatable should link to blocklist page or Plugin Checker

Status: RESOLVED WORKSFORME

(Toolkit :: Add-ons Manager, defect)

Description

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Bug 772897 added UI to the Add-ons Manager for click-to-play plugins, marked by the blocklist. The messaging is that these plugins are vulnerable and either do or do not have an update. 

In both cases, it currently links to the blocklist details page - which does link to the vendor's site to update the plugin. However, there's some question as to whether the updatable plugins should link to the Plugin Checker page instead.

Comment 1

[Kamil Jozwiak [:kjozwiak]]

We've had a wave of blocks that happened in the past week or so due to the Hacking Team leak which affected both Flash and Java. During this time we ended up confusing a lot of users with our blocklisting UI & UX. Users clicked on the "Update" link via about:addons and were expecting some type of update page but were routed to a blocklist detail page. Some users had a hard time finding the "All users are strongly recommended to check for updates on our plugin check page." text link on the blocklist detail page.

This is a good time to revisit this and perhaps come up with a better UX that won't end up confuse users. Pointing the "Update" link from about:addons to the Plugin Checker is a good start. I also think that the Plugin Checker needs some improvements, but we can leave that for another bug.

This is pretty important because when we do go live with blocklists, we always have that risk of losing some users who get confused with our blocklisting mechanism/process every time we push blocks. Users who can't figure it out will simply leave and install another browser.

Comment 2

[Robert Kaiser]

It's definitely a paper cut. A link saying "update" should go to something that at least very obviously offers an update, not to something that says "hey, something is blocked".

Mossop, who can make a decision here and/or move this forward?

Comment 3

[Dave Townsend [:mossop]]

I guess Kev as product manager for add-ons could make a call. We don't have anyone actively working on add-ons right now so any implementation work would mean stealing away from other projects or waiting for an add-ons team to be spun up.

Comment 4

[0jacobnk.bugz]

This was more than a paper cut for me, as the Plugin Check page isn't working for me (and hasn't for months) -- it just shows a spinner forever between "Plugin Status" and "Back to the Top".

So, no information on how to get an updated plugin was reachable from within Firefox -- I started from Adobe's front page instead.

(Firefox on Windows. The plugin in question was Adobe Flash Player, which I had not run for so long that it was so outdated that Firefox blocked it; since I think its update check is only triggered as a side effect of a Flash animation running, this meant that the plugin was never going to update itself.)

Comment 5

[Benjamin Smedberg]

All new blocks are being issued with an update link that points directly to the vendor's update site via the "InfoURL" property. I believe that all links now point to this URL. We are not going to point to plugincheck, and in fact we are going to remove plugincheck links from the product entirely.