Live data from Hacker News

HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

blog.mozilla.org

61–62 of 62 posts

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#61
post #60

Earlier quoted context omitted.

Your last paragraph is what I can't understand. Ignoring OS X for now (wouldn't know a thing about that): Parental control in Windows just lets me set time limits/limits on what programs/games I can run as far as I know (just double checked microsoft.com and that's what they list as well). Given that and my understanding of the Fx feature means that Fx understands that this is a machine with parental controls enabled…

You are just assuming things here. I don't know the parental control features of Windows. And I don't know when this will be enabled. But I don't see a reason why this should be always enabled as soon as parental features are used. In the end Mozilla is implementing a Microsoft proposal here. I would assume that the parental controls have a setting to enable it. So it kinda seems to me that you are building a strawma…

Hah. I'm assuming things, you attack my arguments with .. assumptions.

If you look at the code [1], you'll notice that it exists _today_. There is no feature in Windows that says 'I want to restrict this account to a "safe" internet experience' and that wouldn't make a tiny bit of sense as I expressed elsewhere. Again, if you look at the code it seems (Disclaimer: I'm neither familiar with the Fx codebase nor really a C++ guy) easy enough:

    DWORD settings = 0;
    wpcs->GetRestrictions(&settings);
    
    if (settings) { // WPCFLAG_NO_RESTRICTION = 0
      gAdvAPIDLLInst = ::LoadLibrary("Advapi32.dll");
      if(gAdvAPIDLLInst)
      {
        gEventWrite = (decltype(EventWrite)*)GetProcAddress(gAdvAPIDLLInst, "EventWrite");
        gEventRegister = (decltype(EventRegister)*) GetProcAddress(gAdvAPIDLLInst, "EventRegister");
        gEventUnregister = (decltype(EventUnregister)*) GetProcAddress(gAdvAPIDLLInst, "EventUnregister");
      }
      mEnabled = true;
    }
While I admit that I argued based on 'assumptions' (more .. based on what I know about these parental controls and what the article states), these are the facts.

If I translate that into prose (correct me..) that reads as "If the OS supports parental controls and ANY restrictions are active, then set this boolean flag to true". Now, before you argue that these still are just assumptions about how this flag is used ... let me present [2]:

    // add the "Send Hint" header
    if (mSafeHintEnabled || mParentalControlEnabled) {
      rv = request->SetHeader(nsHttp::Prefer, NS_LITERAL_CSTRING("safe"));
      if (NS_FAILED(rv)) return rv;
    }
Ignoring the weird comment: That translates into "If the user _opts in_ to use this header via a setting OR if we detected random parental control restrictions from [1], add the crappy header to the request"

The documentation of the Windows parental control API can be found here [3]. Note that there isn't a feature that says 'add a random useless header' or somesuch nonsense. Glancing over the docs it seems to be possible to register extensions to the parental control environment, and _those_ might offer a 'Get a random different version of the internet, maybe' option in theory. But that doesn't seem to be the case and the check at [1] and [2] seems rather broad.

IF this whole thing would be a configurable (by the responsible admin) feature (and .. ideally opt-in, not a crazy default), THEN I'd just laugh at the people that want that, but wouldn't complain. Based on every fact I can get my hands on that is NOT what they do.

Do you still disagree, at least with the implementation?

1: http://mxr.mozilla.org/mozilla-central/source/toolkit/compon...

2: http://mxr.mozilla.org/mozilla-central/source/netwerk/protoc...

3: http://msdn.microsoft.com/en-us/library/windows/desktop/ms71...

Re: HTTP "Prefer:Safe" – Making Online Safety Simpler in Firefox

#62
post #60

Earlier quoted context omitted.

You are just assuming things here. I don't know the parental control features of Windows. And I don't know when this will be enabled. But I don't see a reason why this should be always enabled as soon as parental features are used. In the end Mozilla is implementing a Microsoft proposal here. I would assume that the parental controls have a setting to enable it. So it kinda seems to me that you are building a strawma…

Hah. I'm assuming things, you attack my arguments with .. assumptions. If you look at the code [1], you'll notice that it exists _today_. There is no feature in Windows that says 'I want to restrict this account to a "safe" internet experience' and that wouldn't make a tiny bit of sense as I expressed elsewhere. Again, if you look at the code it seems (Disclaimer: I'm neither familiar with the Fx codebase nor really…

Nice work researching this. Yes, I'd say that always enabling it as soon as some parental control features are enabled is a bad decision. Maybe this should be a bug report. But we should also note that Mozilla follows Microsoft's implementation here.
Post reply on HN