UI discussion for Firefox 4.0b7

[patrickjdempsey]

The padlock IS needed if you want Joe Average to understand when he is on a secure page. Why drop the industry standard? Makes no sense.

You should really read this. It was removed for a reason.
https://bugzilla.mozilla.org/show_bug.cgi?id=598973#c2

No information was lost, just a recognizable icon of misinformation.

For secure connections maybe, but what about pages with broken or incomplete encryption? Aside from the *one time* waiver which by default is set to never show up again, users may be on sites with "https" connections assuming they are totally secure and not see any indication to suggest otherwise. The old broken lock icon at least gave some persistent visual indication of incomplete or broken encryption. I for one will continue to offer users of my themes with colored urlbar backgrounds representing the encryption states of sites even if the devs consider it useless, because personally I like seeing it myself.

[Bluefang]

AFAIK if a user is on a mixed-content page, the location bar identity box shows the page as gray (unencrypted), indicating that the site is insecure. Only fully encrypted sites will have a blue (encrypted) or green (encrypted & verified) identity box.

[Erunno]

AFAIK if a user is on a mixed-content page, the location bar identity box shows the page as gray (unencrypted), indicating that the site is insecure.

Which has the potential to cause unnecessary confusion as there are valid reasons for not encrypting certain resources such as static images yet people are still "safe" due to the parts which matter being transfered encrypted but Firefox will now have a visual indicator which puts this on the same level as "not encrypted at all".

[Bluefang]

And IMHO that is where it should belong. There are 3 problems that I see with mixed content:

1. AFAIK no browser actually gives details beyond the mixed encryption warning. Unless the user is scrupulous enough to actually check the page contents, there's no information provided on what content is encrypted and what isn't.

2. Session info leaking. If the page's cookies aren't marked as for encrypted connections only, they'd be leaked through the unencrypted requests/responses. I suppose it's also possible that other sensitive data could be included in the request/response headers as well, such as the referrer, which could contain session ids.

3. Man-in-the-middle attacking the unencrypted connections. This is particularity worrisome with Object, JavaScript, or AJAX content.

SSL is all about trust in where the information came from and that it was unchanged during transmission. If a page is loading insecure content, then I consider it contaminated and warranting further investigation. So IMHO, I consider this an improvement over the SSL lock icon / mixed content warning. A false sense of insecurity is much better than a false sense of security.

If sites want to reduce the overhead of serving static images, one solution is to composite them into one image and then serve that single image secured. This is what Google does for its site icons.
https://encrypted.google.com/images/srpr/nav_logo27.png

[Rocketman]

A profile can be corrupted a number of ways, and not all of them have something to directly do with Firefox its self. For example the computer/Firefox could crash, corrupting files. A 3rd part program, such as CCleaner, could damage the profile. If you use a profile with both Firefox 3.6 and 4.0 it can get messed up. Add-ons can also potentially damage the profile. Migrating between major Firefox versions (i.e. 3.6 -> 4.0) can also cause unexpected results.

Yes, there could be a bug in Firefox its self that causes profile damage, but more often than not, that is not the case.

I didn't migrate a profile between versions. I created a new profile when I first installed FF4. I haven't used CCleaner or another such 3rd party program. Has FF itself ever crashed? I think we all know the answer to that one. So far this morning, the toolbar has stayed as I set it. Will check again after I get home from work.

[Erunno]

And IMHO that is where it should belong. There are 3 problems that I see with mixed content:

Good points! I retract my objection.

[patrickjdempsey]

SSL is all about trust in where the information came from and that it was unchanged during transmission. If a page is loading insecure content, then I consider it contaminated and warranting further investigation. So IMHO, I consider this an improvement over the SSL lock icon / mixed content warning. A false sense of insecurity is much better than a false sense of security.

That's why I liked the "unlocked" icon. It's out there saying, "you think you are on an https site and that means you are safe but there's a possibility that you are not". The lack of any indication (gray identity button) doesn't really speak loud enough to this effect to me, as that requires the user to understand how Firefox works well enough to make the distinction.

[Kole89]

I made a little add-on for things that annoyed me in Firefox 4, I hope it'll be useful to someone.

https://addons.mozilla.org/en-US/firefox/addon/258712/

[stimpy84]

1/3/4. Toolbar buttons/items should not be moving around on their own. If changes you're making are not sticking, you likely have a profile problem.
http://kb.mozillazine.org/Corrupt_localstore.rdf
http://kb.mozillazine.org/Profile_Manager

I'm experiencing problems with my toolbars resetting to default on two separate machines (Windows 7 Professional and Ubuntu 10.10). I've followed those guides (also manually deleting "localstore.rdf" from my profile and recreating the toolbar), but after two (?) restarts, Firefox 4b7 resets everything.

Typically, what I change is:

• I move the Bookmarks Toolbar Items next to the address bar
• I remove the search bar
• I remove the bookmark dropdown button
• I remove the home button
• I hide the add-on toolbar

Occasionally, the feedback button adds itself to my toolbar, which makes me suspect that it may be the culprit. I've tried disabling the "Feedback" add-on, and it makes no difference.

[patrickjdempsey]

Do you have other extensions running? Specifically, do you have any extensions that automatically add anything to the toolbars, or any that you have forced to be compatible? Also, are you using the same profile for 4.0b7 and 3.6? If you are that could cause problems.

[stimpy84]

Do you have other extensions running? Specifically, do you have any extensions that automatically add anything to the toolbars, or any that you have forced to be compatible?

No, none. Like I said, I've disabled Feedback as that appears to add itself to the toolbar. Other than that, the only ones that appear in the add-on bar (which shouldn't be causing this, as the only entry in localstore.rdf related to the add-on bar is whether it's visible or not) are:

• Xmarks
• Firebug
• Greasemonkey

Also, are you using the same profile for 4.0b7 and 3.6? If you are that could cause problems.

No, I have separate profiles for all of my Firefox installations (2.0, 3.0, 3.5, 3.6 and 4.0; I'm an add-on developer) and this behavior only occurs on 4b7, both Windows 7 and Ubuntu. On Ubuntu, I am in fact only running 4b7.

I will experiment with the reproducibility and will report back.

[patrickjdempsey]

Try in Firefox Safe Mode:
http://kb.mozillazine.org/Safe_mode

If the problem goes away in Safe Mode then one of your extensions is causing it. Disabling half of them at a time and restarting makes it pretty easy to narrow down the culprits. If you need further assistance you should create your own topic, as this topic is more about general UI features.

[stimpy84]

Simply restarting Firefox only causes the Add-on Bar to reappear. It does not otherwise reset the toolbar.

However, it appears that I'm noticing this more than most because the toolbars reset when installing an add-on. I haven't determined if the kind of add-on being installed is relevant. I will continue debugging!

[stimpy84]

I installed a few generic add-ons: , DownThemAll!, TryAgain and Open in Browser; each time, the toolbar resets. I occasionally restored the working localstore.rdf and tried restarting without installing anything, in which case it didn't reset.

In short, installing any add-on causes the localstore.rdf to become corrupted.

[JayhawksRock]

Try in Firefox Safe Mode:
http://kb.mozillazine.org/Safe_mode

If the problem goes away in Safe Mode then one of your extensions is causing it. Disabling half of them at a time and restarting makes it pretty easy to narrow down the culprits. If you need further assistance you should create your own topic, as this topic is more about general UI features.

Also any extension that has any of the following components needs to be "unpacked" because FF 4 beta 7 and up runs extensions from the .xpi and these
components won't run inside of an archive.

Binary XPCOM components
DLLs loaded with ctypes
Search plugins
Dictionaries
Window icons

An extension NOT updated to FF4 beta 7 probably does not have the unpacking code built in.

The work around is add to about:config > extensions.alwaysUnpack set to true
Restart and reinstall the extension.

Also, I have noticed that any extension that has an Icon for the "old statusbar" might cause the toolbars to reset.