Talk:Features/Social Help - Revision history

Quozl at 01:58, 27 May 2015

2015-05-27T01:58:28Z

← Older revision		Revision as of 21:58, 26 May 2015
Line 18:		Line 18:
	:--[[User:SAMdroid\|SAMdroid]] 21 May 2015		:--[[User:SAMdroid\|SAMdroid]] 21 May 2015

	:: Okay, thanks. I think the feature page should mention these things. Other things it could mention are:		:: Okay, thanks. I think the feature page should mention these things (done). Other things it could mention are:
	::* there is no support for deleting the cookies, (re: european union right to forget and cookie legislation),		::* there is no support for deleting the cookies, (re: european union right to forget and cookie legislation),
	::* how to disable the feature for deployments who do not have a configured server,		::* how to disable the feature for deployments who do not have a configured server (done),
	::* the requirements for the web application on the server, (e.g. it will be used in an embedded web browser that is unable to fill the display, unable to be dismissed without losing context, has no bookmark or URL entry capability, and has no HTTP AUTH capability),		::* the requirements for the web application on the server, (e.g. it will be used in an embedded web browser that is unable to fill the display, unable to be dismissed without losing context, has no bookmark or URL entry capability, and has no HTTP AUTH capability),
	::--[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 19:13, 25 May 2015 (EDT)		::--[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 19:13, 25 May 2015 (EDT)

Quozl: /* Right-click menu */ new section

2015-05-27T01:43:24Z

Right-click menu: new section

← Older revision		Revision as of 21:43, 26 May 2015
Line 40:		Line 40:

	Should the browser be restricted to the configured server? --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:31, 26 May 2015 (EDT)		Should the browser be restricted to the configured server? --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:31, 26 May 2015 (EDT)

			== Right-click menu ==

			There's a right-click menu that offers open link in new window or download linked file. Neither work. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:43, 26 May 2015 (EDT)

Quozl: /* No URL entry box, URL spoofing */

2015-05-27T01:32:45Z

No URL entry box, URL spoofing

← Older revision		Revision as of 21:32, 26 May 2015
Line 32:		Line 32:

	The embedded browser used by this feature does not show an entry box for the URL. This removes one of the critical security features of web browsers; the ability to verify that the site you are visiting is the right one, and you haven't been redirected to another.		The embedded browser used by this feature does not show an entry box for the URL. This removes one of the critical security features of web browsers; the ability to verify that the site you are visiting is the right one, and you haven't been redirected to another.

	It is possible to escape the configured server; log in, click on search icon, click on help, a search via Google entry box is shown, and the Google search results can be navigated. There is no back button, so if you reach a page that has no links you must close help and open it again.

	~~Should the browser be restricted to the configured server. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:31, 26 May 2015 (EDT)~~

	References:		References:
	* http://www.infoworld.com/article/2923879/security/urlspoofing-bug-in-safari-could-enable-phishing-attacks.html		* http://www.infoworld.com/article/2923879/security/urlspoofing-bug-in-safari-could-enable-phishing-attacks.html
	* http://en.wikipedia.org/wiki/Spoofed_URL		* http://en.wikipedia.org/wiki/Spoofed_URL

			On Sugar 0.105.1 it is possible to escape the configured server; log in, click on search icon, click on help, a search via Google entry box is shown, and the Google search results can be navigated. There is no back button, so if you reach a page that has no links you must close help and open it again.

			Should the browser be restricted to the configured server? --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:31, 26 May 2015 (EDT)

Quozl: /* No URL entry box, URL spoofing */

2015-05-27T01:31:49Z

No URL entry box, URL spoofing

← Older revision		Revision as of 21:31, 26 May 2015
Line 33:		Line 33:
	The embedded browser used by this feature does not show an entry box for the URL. This removes one of the critical security features of web browsers; the ability to verify that the site you are visiting is the right one, and you haven't been redirected to another.		The embedded browser used by this feature does not show an entry box for the URL. This removes one of the critical security features of web browsers; the ability to verify that the site you are visiting is the right one, and you haven't been redirected to another.

	~~Are there any controls~~ in ~~place to mitigate this?~~ ~~Such as restricting~~ the browser to the configured server. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:19, 26 May 2015 (EDT)		It is possible to escape the configured server; log in, click on search icon, click on help, a search via Google entry box is shown, and the Google search results can be navigated. There is no back button, so if you reach a page that has no links you must close help and open it again.

			Should the browser be restricted to the configured server. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:31, 26 May 2015 (EDT)

	References:		References:
	* http://www.infoworld.com/article/2923879/security/urlspoofing-bug-in-safari-could-enable-phishing-attacks.html		* http://www.infoworld.com/article/2923879/security/urlspoofing-bug-in-safari-could-enable-phishing-attacks.html
	* http://en.wikipedia.org/wiki/Spoofed_URL		* http://en.wikipedia.org/wiki/Spoofed_URL

Quozl: /* No URL entry box leads to insecurity */

2015-05-27T01:22:04Z

No URL entry box leads to insecurity

← Older revision		Revision as of 21:22, 26 May 2015
Line 29:		Line 29:
	:Not possible in an activity, apparently. This is done in the [[Activities/Help\|Help]] activity, and the mapping from bundle id to HTML file is also held there. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 22:09, 25 May 2015 (EDT)		:Not possible in an activity, apparently. This is done in the [[Activities/Help\|Help]] activity, and the mapping from bundle id to HTML file is also held there. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 22:09, 25 May 2015 (EDT)

	== No URL entry box ~~leads to insecurity~~ ==		== No URL entry box, URL spoofing ==

	The embedded browser used by this feature does not show an entry box for the URL. This removes one of the critical security features of web browsers; the ability to verify that the site you are visiting is the right one, and you haven't been redirected to another. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:19, 26 May 2015 (EDT)		The embedded browser used by this feature does not show an entry box for the URL. This removes one of the critical security features of web browsers; the ability to verify that the site you are visiting is the right one, and you haven't been redirected to another.

			Are there any controls in place to mitigate this? Such as restricting the browser to the configured server. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:19, 26 May 2015 (EDT)

	References:		References:
	* http://www.infoworld.com/article/2923879/security/urlspoofing-bug-in-safari-could-enable-phishing-attacks.html		* http://www.infoworld.com/article/2923879/security/urlspoofing-bug-in-safari-could-enable-phishing-attacks.html
	* http://en.wikipedia.org/wiki/Spoofed_URL		* http://en.wikipedia.org/wiki/Spoofed_URL

Quozl: /* No URL entry box leads to insecurity */ new section

2015-05-27T01:19:56Z

No URL entry box leads to insecurity: new section

← Older revision		Revision as of 21:19, 26 May 2015
Line 28:		Line 28:
	Activity developers need to know how to add help in a way that will work with Alt-Ctrl-H, where is this documented? --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 20:31, 25 May 2015 (EDT)		Activity developers need to know how to add help in a way that will work with Alt-Ctrl-H, where is this documented? --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 20:31, 25 May 2015 (EDT)
	:Not possible in an activity, apparently. This is done in the [[Activities/Help\|Help]] activity, and the mapping from bundle id to HTML file is also held there. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 22:09, 25 May 2015 (EDT)		:Not possible in an activity, apparently. This is done in the [[Activities/Help\|Help]] activity, and the mapping from bundle id to HTML file is also held there. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 22:09, 25 May 2015 (EDT)

			== No URL entry box leads to insecurity ==

			The embedded browser used by this feature does not show an entry box for the URL. This removes one of the critical security features of web browsers; the ability to verify that the site you are visiting is the right one, and you haven't been redirected to another. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 21:19, 26 May 2015 (EDT)

			References:
			* http://www.infoworld.com/article/2923879/security/urlspoofing-bug-in-safari-could-enable-phishing-attacks.html
			* http://en.wikipedia.org/wiki/Spoofed_URL

Quozl: /* How to add help to an activity? */

2015-05-26T02:09:28Z

How to add help to an activity?

← Older revision		Revision as of 22:09, 25 May 2015
Line 27:		Line 27:

	Activity developers need to know how to add help in a way that will work with Alt-Ctrl-H, where is this documented? --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 20:31, 25 May 2015 (EDT)		Activity developers need to know how to add help in a way that will work with Alt-Ctrl-H, where is this documented? --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 20:31, 25 May 2015 (EDT)
			:Not possible in an activity, apparently. This is done in the [[Activities/Help\|Help]] activity, and the mapping from bundle id to HTML file is also held there. --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 22:09, 25 May 2015 (EDT)

Quozl: /* How to add help to an activity? */ new section

2015-05-26T00:31:04Z

How to add help to an activity?: new section

← Older revision		Revision as of 20:31, 25 May 2015
Line 23:		Line 23:
	::* the requirements for the web application on the server, (e.g. it will be used in an embedded web browser that is unable to fill the display, unable to be dismissed without losing context, has no bookmark or URL entry capability, and has no HTTP AUTH capability),		::* the requirements for the web application on the server, (e.g. it will be used in an embedded web browser that is unable to fill the display, unable to be dismissed without losing context, has no bookmark or URL entry capability, and has no HTTP AUTH capability),
	::--[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 19:13, 25 May 2015 (EDT)		::--[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 19:13, 25 May 2015 (EDT)

			== How to add help to an activity? ==

			Activity developers need to know how to add help in a way that will work with Alt-Ctrl-H, where is this documented? --[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 20:31, 25 May 2015 (EDT)

Quozl at 23:13, 25 May 2015

2015-05-25T23:13:36Z

← Older revision		Revision as of 19:13, 25 May 2015
Line 8:		Line 8:
	* a privacy policy,		* a privacy policy,

	--[[User:Quozl\|Quozl]] ~~([[User talk:Quozl\|talk]]) 04:59,~~ 20 May 2015 ~~(EDT)~~		--[[User:Quozl\|Quozl]] 20 May 2015

	: Cookies are stored in the user's sugar profile directory. It is persistent between usages		:Cookies are stored in the user's sugar profile directory. It is persistent between usages.
	:		:As for your other comments, they are 100% dependent on the user's or deployment's configured server.
	: As for your other comments, they are 100% dependent on the user's or deployment's configured server.		:On socialhelp.sugarlabs.org (the default server):
	:		:* We use discourse, and email and accounts are very central to discourse. Discourse is a very good piece of software and I suppose this is a compromise I am willing to make.
	: On socialhelp.sl.o (the default server):		:* Accounts could be pre-created by deployments or kids could ask questions using a teachers account
	: * We use discourse, and email and accounts are very central to discourse. Discourse is a very good piece of software and I suppose this is a compromise I am willing to make.		:* We have a very stock standard [https://socialhelp.sugarlabs.org/privacy privacy policy], it is very simple to understand and I recommend reading it. It does have a bad policy on COPPA, which is an issue to fix.
	: * Accounts could be pre-created by deployments or kids could ask questions using a teachers account		:--[[User:SAMdroid\|SAMdroid]] 21 May 2015
	: * We have a very stock standard ~~privacy policy <~~https://socialhelp.sugarlabs.org/privacy>, it is very simple to understand and I recommend reading it. It does have a bad policy on COPPA, which is an issue to fix.
	: --[[User:SAMdroid\|SAMdroid]]		:: Okay, thanks. I think the feature page should mention these things. Other things it could mention are:
			::* there is no support for deleting the cookies, (re: european union right to forget and cookie legislation),
			::* how to disable the feature for deployments who do not have a configured server,
			::* the requirements for the web application on the server, (e.g. it will be used in an embedded web browser that is unable to fill the display, unable to be dismissed without losing context, has no bookmark or URL entry capability, and has no HTTP AUTH capability),
			::--[[User:Quozl\|Quozl]] ([[User talk:Quozl\|talk]]) 19:13, 25 May 2015 (EDT)

Quozl: add missing signature tag

2015-05-25T22:53:41Z

add missing signature tag

← Older revision		Revision as of 18:53, 25 May 2015
Line 18:		Line 18:
	: * Accounts could be pre-created by deployments or kids could ask questions using a teachers account		: * Accounts could be pre-created by deployments or kids could ask questions using a teachers account
	: * We have a very stock standard privacy policy <https://socialhelp.sugarlabs.org/privacy>, it is very simple to understand and I recommend reading it. It does have a bad policy on COPPA, which is an issue to fix.		: * We have a very stock standard privacy policy <https://socialhelp.sugarlabs.org/privacy>, it is very simple to understand and I recommend reading it. It does have a bad policy on COPPA, which is an issue to fix.
			: --[[User:SAMdroid\|SAMdroid]]