Page MenuHomePhabricator

[mediawiki.feedback.js] Add checkbox to submit user-agent info
Closed, ResolvedPublic

Description

resources/mediawiki/mediawiki.feedback.js is a little-known built-in software feedback feature that's used by a couple of extensions, notably UploadWizard and VisualEditor.

It posts feedback to a wiki page. It used to also post user-agent information for debugging alongside the feedback. The user-agent information from posted feedback was removed in:

https://gerrit.wikimedia.org/r/#/c/26417/

While the fact that user-agent information is published was disclosed, there was concern that it would be preferable to add an explicit checkbox. The following text has been vetted by legal:

  • I understand that my user agent information includes information about my exact browser and operating system version and will be shared publicly alongside my feedback. I agree to provide feedback in accordance with the Terms of Use.

On WMF sites, that would link to https://wikimediafoundation.org/wiki/Terms_of_Use - not sure we have a standard MW message that would apply here.


Version: 1.21.x
Severity: enhancement
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=33365

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 1:08 AM
bzimport set Reference to bz41291.

I have a change ready for this, will push soon.

Posting here my review about the proposed label associated to the new checkbox:

(...) The message is associated to a checkbox saying 2 very different things:

  1. Willing and knowledge about sharing browser information
  2. Acceptance of Terms of Use

This makes me think that I HAVE TO mark the checkbox in order to actually submit my feedback, and that along my feedback the User Agent will be visible, and if I don't mark that checkbox it means I don't agree with the Terms of Use and feedback won't be submitted.

This is not what actually happens: Leaving the check unmarked still allows the user to submit the feedback, but without providing the User Agent information.

If the actual behavior is the desired one, the message needs to be split, or at least provide clear "feedback" that the checkbox is totally unrelated to Terms of Use acceptance.

Patch amended with form validation and requirement of checkbox being ticked.

Patch in Gerrit (link in comment 2) still needs review.

I very much agree this is needed, especially for https://commons.wikimedia.org/wiki/Commons:Upload_Wizard_feedback where many sections are made of little use for lack of any browser information.

However I think there ought to be a much simpler solution: why can't the dialog just add the requested user-agent information in the text area? Instead of being blank, the "message" could be prefilled with "~~~~ (using Firefox 30)" or similar (when configured to do so). The user would have a very obvious way to remove the information by deleting it from the message; if they don't, it will be covered by https://meta.wikimedia.org/wiki/Privacy_policy#Because_You_Made_It_Public

(In reply to Nemo from comment #6)

However I think there ought to be a much simpler solution: why can't the
dialog just add the requested user-agent information in the text area?
Instead of being blank, the "message" could be prefilled with "~~~~ (using
Firefox 30)" or similar (when configured to do so). The user would have a
very obvious way to remove the information by deleting it from the message;
if they don't, it will be covered by
https://meta.wikimedia.org/wiki/Privacy_policy#Because_You_Made_It_Public

Though that sounds attractive, I'm told that that would not be appropriate, informed consent.

(In reply to James Forrester from comment #7)

Though that sounds attractive, I'm told that that would not be appropriate,
informed consent.

How is it different from posting on a talk page? Surely such a difference can be eliminated.

(In reply to Nemo from comment #8)

(In reply to James Forrester from comment #7)

Though that sounds attractive, I'm told that that would not be appropriate,
informed consent.

How is it different from posting on a talk page? Surely such a difference
can be eliminated.

When you post on a talk page you write every byte that gets inserted (except for ==s for new sections and PST substitutions). That's very different from auto-inserting private data (their user agent string) and hoping that they recognise it as such and remove it if they're not comfortable with that level of privacy intrusion.

(In reply to James Forrester from comment #9)

When you post on a talk page you write every byte that gets inserted

Definitely not,

(except
for ==s for new sections and PST substitutions).

as you say yourself,

That's very different from
auto-inserting

and how about the preload parameter?
If pre-save transform is consider radically different from preload, we could use a new magic word OMGREALLYSCARYPRIVATEDATABUTPLEASESHAREIFYOUWANTTOHELPTHESOFTWARE.

(In reply to James Forrester from comment #9)

When you post on a talk page you write every byte that gets inserted (except
for ==s for new sections and PST substitutions).

Now that you mention that, I'd say that if you're not logged in, your IP address is also included on the page history.

Change 192749 had a related patch set uploaded (by Mooeypoo):
[wip] Refactoring mw.Feedback to work with OOUI elements

https://gerrit.wikimedia.org/r/192749

Change 32700 abandoned by Jforrester:
Feedback includes browser info, given user permission

Reason:
Being done as part of Id1967a83a.

https://gerrit.wikimedia.org/r/32700

Jdforrester-WMF reassigned this task from Nischayn22 to Mooeypoo.
Jdforrester-WMF set Security to None.

Change 192749 merged by jenkins-bot:
Refactoring mw.Feedback to work with OOUI elements

https://gerrit.wikimedia.org/r/192749