Change 247616 had a related patch set uploaded (by Wikinaut):
fix T96546 incognito mode partial fix search history on/off

https://gerrit.wikimedia.org/r/247616

It's my first commit to Wikipedia projects since a long time, and my first for the Android App. Bear with me, if I made something unusual, or wrong, and please help me to fix it. I am willing to listen and learn.

Just a question for discussion:
another question is, whether the default setting for "remember search history" should be true (currently), or false.

@Florian regarding the original OTRS request https://ticket.wikimedia.org/otrs/index.pl?Action=AgentTicketZoom&TicketID=8300787 (I don't have access to it), I would like to know whether it was really requested to also disable saving of articles.

Why do I ask ?

Because any user of the app can determine whether they want to save an article, and the set of saved articles can be deleted manually. So I really do not see a reason, why we need a further option "allow/disallow saving of articles" - which would be possible of course.

Please let me know, what the original requester wanted, or if you can, ask the person, whether (what I implemented now) is enough to disable the automatic search history.

In T96546#1740477, @Wikinaut wrote:

Because any user of the app can determine whether they want to save an article, and the set of saved articles can be deleted manually. So I really do not see a reason, why we need a further option "allow/disallow saving of articles" - which would be possible of course.

Such an option would be pointless; articles aren't saved automatically, so you're right :) And that wasn't what I meant with the task description (I'll edit it and make it more clear). Read it more like "Add an option to disable save of recent search queries and recent articles". So there should be an option to disable the article history, not the save page functionality :) I hope that makes the scope of this task more clear.

Change 247616 had a related patch set uploaded (by Florianschmidtwelzow):
Incognito mode: search history on/off

https://gerrit.wikimedia.org/r/247616

@Florian ah, now I understand. I did not know, that this history of recently visited articles (German: "Verlauf") exists. Will start fixing this, too.

Main test build failed. (why?)

tox-flake8 SUCCESS in 6s
apps-android-wikipedia-test FAILURE in 40s
apps-android-wikipedia-lint FAILURE in 1m 21s (non-voting)

Can we chat ? When and which chat, I'm on #mediawiki-dev

@Wikinaut: Ja, genau das meinte ich :P

It seems you already fixed the errors.

In T96546#1741309, @Wikinaut wrote:

Can we chat ? When and which chat, I'm on #mediawiki-dev

Sure, but not now :) If I'm online, I'm mostly in #wikimedia-mobile, #wikimedia-dev, #wikimedia-operations, #wikipedia-de, MediaWiki-General and some other channels, too.

@Florian: yep. Fixed.

Question: would you suggest _one_ option (for de/activate search history and de/activate article history), or two separate options ?

I think one option for both would make sense to not confuse the user too much, but that seems to be a question for Design :)

@Florian

can you help me, how can I add this question to the Design board (add such a flag) ?
I cannot find the present issue on the Design board.

Simplly use the "Associate Projects" action instead of comment :) You could click "Edit Task", too, and add the project there.

the patch is https://gerrit.wikimedia.org/r/247616 . I don't know why gerrit-bot has not added it here automatically.

In T96546#1742043, @Wikinaut wrote:

the patch is https://gerrit.wikimedia.org/r/247616 . I don't know why gerrit-bot has not added it here automatically.

???

\/

In T96546#1741098, @gerritbot wrote:

Change 247616 had a related patch set uploaded (by Florianschmidtwelzow):
Incognito mode: search history on/off

https://gerrit.wikimedia.org/r/247616

@Florian: ok. Currently I notice a problem with the code on my tablet, but not in the Emulator. Perhaps a side-efffect from new (incorrect?) recent updates in the master branch. Will investigate.

Comments from gerrit:

@Dbrant

Many thanks for the patch, Wikinaut!

Regardless of the quality of the code, this will need to stew for a bit. At a minimum, we'll need to have our Design team comment on these changes. (Indeed, this task was in the "Open questions" column in our work board, meaning that it wasn't quite ready to be acted upon)

In general, we try to avoid adding new preferences unless absolutely necessary, and only if it adds value to the user. The latter point is not immediately clear with this feature. Who is the user that cares about going out of their way to turn off saving of search and/or browsing history? (especially when we provide a prominent "delete" button in both cases)

If we decide to move forward with this functionality, I can think of a couple changes that would make this feature more intuitive:

• Combine the two preferences into one. If the user doesn't want her search history recorded, I would guess that she also doesn't want the resulting page visits recorded, either.

• Take the preference out of Settings, and put it directly into the History or Search fragments (i.e. have a nice Material switch that says "Record history"). This way, all of the interactions that have to do with history are in one place, and are maximally discoverable.

But, again, we'll float this by the Designers, and combine their feedback with the above ideas.

@Wikinaut

Sorry, I do care about the history, for example, if you share a device in a family, or a group of users, I do not want to know what others have searched - for controversial terms or so. So the porn mode (incognito mode) is definitely something good to have.

I will wait for comments from the Design team, and from Florianschmidtwelzow (who know the OTRS report of one other "porn mode" requester), and Niedzielski.

Adding Design for some input.

Btw.: I would prefer one preference for both options. The "original" requester in OTRS[1] doesn't give a clear preference to one or two options.

[1] Who requested this function for iOS btw, but it would be great to have it in Android, too :)

Change 247616 abandoned by Wikinaut:
Incognito mode: search history/article history on/off

Reason:
This change (with the two separate options) is now abandoned, but followed-up in a new branch implementing this in a single option see single https://gerrit.wikimedia.org/r/#/c/248075/

https://gerrit.wikimedia.org/r/247616

Change 248075 had a related patch set uploaded (by Florianschmidtwelzow):
Incognito mode: (search and article) history on/off

https://gerrit.wikimedia.org/r/248075

Change 248075 had a related patch set uploaded (by Wikinaut):
Incognito mode: (search and article) history on/off

https://gerrit.wikimedia.org/r/248075

A decision to drop this patch is not a good decision. I explained that already in the commit comment:

"I think, that your decision is not a good decision, because - if you use a phone or tablet in a community, for example, it's not nice to see search terms and history of previous users - it violates their privacy."

I see the value of the idea but I think we need a much heavier app refactor-- both from a design and code perspective-- to make the kinds of promises "incognito mode" entails. For example, our caching architecture is not at all privacy oriented. Another example from design is our tab workflow which is a veneer on the single WebView used and doesn't have the UX to intelligently manage privacy tabs in my opinion. I personally think this is a nice feature but it would be an anti-feature if we went halfway on it, and the investment is too great to go all the way right now.

What about a compromise solution? What if we expose a button in preferences, "Erase all app data permanently"? I haven't implemented something like this before so I don't know how practical it is. It's another implementation that cannot be partial. It really has to blow away everything or not be in the app at all. If this sounds good to you, please make sure to follow up here before implementation to avoid any back and forth later.

Lastly, I wanted to say that I really appreciate your contributions and genuine interest in making the app better.

Yes, that's basically my feeling on this. It's not that Incognito Mode isn't a useful feature; it's that it doesn't fit very well with the current UX of the app. We would have to refactor things pretty radically in order for this feature to fit naturally.

@Wikinaut
Regarding your use case of the app being used in a "community" setting (i.e. some sort of "kiosk mode" for the app): There's nothing that would prevent someone in the community from going to Settings, and disabling incognito mode, which would negate the whole feature. The app, as it is today, is inherently for personal use, and is intended to be personalizable for an individual user. If we decide to expand the app into community usage, we would need to implement all kinds of extra security and lockdown (parental control?) features that are not on our roadmap.

The idea of having a "delete all data" button might also be useful, but it's kind of equivalent to going into your system Apps Settings, and selecting "Clear app data".

Change 248075 abandoned by Sniedzielski:
Incognito mode: (search and article) history on/off

Reason:
Per discussion in T96546, we can't accept this change right now :( Thanks for all your efforts and we hope you'll keep making great contributions elsewhere in the app!

https://gerrit.wikimedia.org/r/248075

Change 248075 restored by Wikinaut:
Incognito mode: (search and article) history on/off

Reason:
I temporarily restored this change to enable updates (rebase, improvements).

https://gerrit.wikimedia.org/r/248075

Change 248075 abandoned by Wikinaut:
Incognito mode: (search and article) history on/off

Reason:
This is the improved change: when you enter the search screen, the input is always empty, i.e. no previous strings are shown.

If you like to test or deploy it, then please cherry-pick the last patch set.

As there is currently no consensus to deploy it, I abandon the change. Perhaps it can find its way into the beta ?

https://gerrit.wikimedia.org/r/248075

@Wikinaut, I tried the latest patchset and I think it should stay on hold. I really like the idea but we need 1) new UI and UX for a real incognito mode and 2) true privacy. For this feature, we can't compromise on either. If you're interested it, my personal recommendation is to clone the repo and continuing to make improvements towards these ends. This will unblock your development efforts and also allow users happy with incremental improvements towards privacy to get them easily. The other devs on the team do this for prototyping features that aren't fully baked or may be controversial. For example, Wikipedia Lite[0]. I really appreciate your enthusiasm for the feature and hope it can grow sufficiently to be accepted. Thanks again for your continued effort!

[0] https://github.com/dbrant/apps-android-wikipedia/tree/lite

In T96546#1789838, @Niedzielski wrote:

@Wikinaut, I tried the latest patchset and I think it should stay on hold. I really like the idea but we need 1) new UI and UX for a real incognito mode and 2) true privacy.

I am sorry, but I really do not understand, what else is required, that is my point. The present implementation is already a giant leap forward, if one shares a device - I do not see where data of a previous user is "leaked" unintentionally to the next user.

Just give me a concrete example, what is missing.

For #1, some examples that come to mind are:

1. The previously visited page is restored when reopening the app.
2. There's no way to mix incognito and standard modes.
3. Non-incognito mode functionality like saving pages is still available.
4. There's no visual indication of different modes except on the settings screen.

For #2, some examples of privacy violation include:

1. Cached data. Consider this use case:
   1. Search for "banana".
   2. Go to the banana article.
   3. Search for "pineapple".
   4. Go to the pineapple article.
   5. Terminate the app.
   6. Banana data is retained in various caches including SharedPreferences and networking,
2. The tab backstack is never cleared.

This is a _big_ feature that requires significant auditing of existing code, likely heavy codework, but most of all, deep thought. If that's not convincing, consider what "incognito mode" really means. I think this term was likely derived from the Chromium / Chrome browser where it is extremely well supported. That's the kind of implementation we'd want and it wouldn't be trivial.

ad #1.1 I will fix this, too.
ad #1.2 A mix of incognito and standard was unwanted - I coded that: initially one could decide not to remember search history and article history with separate settings - but as said, it was unwanted.
ad #1.3 I think that saving pages is an intended action of a user, and should be available, but could technically of course be disabled as well.

@Wikinaut Before spending significantly more time on this, I would strongly encourage you to create your own fork of the app, where you may continue to flesh out a completely privacy-centered version of the app at your own pace.

@Dbrant yes, thanks for the idea for doing it in a fork in parallel to my other projects https://github.com/Wikinaut/wikipedia-app .

Follow up from recent post at enwiki VPT: https://en.wikipedia.org/w/index.php?title=Wikipedia:Village_pump_(technical)&oldid=1046669053#Question_about_the_Wikipedia_app_for_iOS- and really no reason this concept should only be about the port of this for only one set of devices so adding ios-app in here as well.

This ticket is specific to Android and includes many years of Android development history. To make the work as clear as possible for iOS I have created and triaged: T292019