! Please note that this is a snapshot of our old Bugzilla server, which is read only since May 29, 2020. Please go to gitlab.xfce.org for our new server !
Upload plugin should come with warning
Status:
RESOLVED: FIXED
Product:
Xfce4-screenshooter
Component:
General

Comments

Description Mikhail T. 2019-05-01 17:00:48 CEST
The image might -- indeed, is likely to -- contain private information. Especially, when it contains the shot of the entire screen. Uploading such to a public web-site, from where it can not be reliably removed, is dangerous. A user selecting this option ought to be warned about the dangers...
Comment 1 Andre Miranda editbugs 2019-05-02 20:57:20 CEST
Created attachment 8477 
imgur-notice.diff

Since 1.9.4 URLs to delete uploaded images are now available, it helps a lot but the risk of uploading sensitive information is still present.
Please let me know if the proposed patch makes sense or if the sentence could be improved.
Comment 2 Mikhail T. 2019-05-03 17:34:36 CEST
> Since 1.9.4 URLs to delete uploaded images are now available

Should the interface offer the "Delete" button right there on the GUI then?

> Please let me know if the proposed patch makes sense or if the sentence could be improved

Yes, that's about right. I would end it with "... publicly available and may be difficult to ever delete." Because, even if the delete is requested of Imgur, who knows, what they _really_ do with the image? Having worked at a similar company once, I can tell that it may be cheaper for them to just keep adding storage, then to actually go and physically delete the "deleted" data from all of the storage-replicas :(

Once you finalize the text, I can offer a Ukrainian and Russian translations too.

Also, someone -- not me -- might request a checkbox for "Do not show me this warning again!"
Comment 3 Adam R. 2019-05-08 02:09:52 CEST
I strongly suggest that inclusion of the upload feature be reconsidered. Reliance on third parties who may change their policies and behavior - or even cease to exist - at any time (as with ZimageZ) puts the stability of this component at permanent risk. Moreover, the integration of screen capture and upload runs counter to the UNIX philosophy of "do one thing and do it well" and Xfce's goal of a lightweight environment.

Other projects have faced significant opposition when core components are tied to external services: the negative reaction to Ubuntu's "shopping lens" is among the most prominent examples. Mozilla likewise faced substantial criticism for its integration of uploading into Firefox's screenshot feature.
Comment 4 Andre Miranda editbugs 2019-05-14 05:33:28 CEST
(In reply to Mikhail T. from comment #2)
> Should the interface offer the "Delete" button right there on the GUI then?
Currently it asks for confirmation, imgur may change this at some some.
We also need to handle failures, so I think it's better to just open the browser.

> Yes, that's about right. I would end it with "... publicly available and may
> be difficult to ever delete." Because, even if the delete is requested of
> Imgur, who knows, what they _really_ do with the image? Having worked at a
> similar company once, I can tell that it may be cheaper for them to just
> keep adding storage, then to actually go and physically delete the "deleted"
> data from all of the storage-replicas :(
> 
> Once you finalize the text, I can offer a Ukrainian and Russian translations
> too.
Thanks for the hints and availability for translations.

(In reply to Adam R. from comment #3)
> I strongly suggest that inclusion of the upload feature be reconsidered.
> Reliance on third parties who may change their policies and behavior - or
> even cease to exist - at any time (as with ZimageZ) puts the stability of
> this component at permanent risk. Moreover, the integration of screen
> capture and upload runs counter to the UNIX philosophy of "do one thing and
> do it well" and Xfce's goal of a lightweight environment.
I agree but cannot remove this feature until we have a proper alternative, which is discussed at Bug 14421.
Comment 5 Andre Miranda editbugs 2019-05-14 05:38:56 CEST
Created attachment 8520 
imgur_warning_popover.diff

Another attempt, even though the code is bit more verbose, I think the result is much better.
Comment 6 Andre Miranda editbugs 2019-05-14 05:40:15 CEST
Created attachment 8521 
Screenshot of last patch

> Also, someone -- not me -- might request a checkbox for "Do not show me this
> warning again!"
There is no need, that warning is shown only if the warning button is clicked.
Comment 7 Git Bot editbugs 2019-10-07 01:44:46 CEST
Andre Miranda referenced this bugreport in commit dbcfc35e38633f5467582069924ae19f13fe1bbb

Add warning notice to imgur upload option (Bug #15347)

https://git.xfce.org/apps/xfce4-screenshooter/commit?id=dbcfc35e38633f5467582069924ae19f13fe1bbb

Bug #15347

Reported by:
Mikhail T.
Reported on: 2019-05-01
Last modified on: 2019-10-07

People

Assignee:
Xfce Bug Triage
CC List:
2 users

Version

Version:
unspecified

Attachments

imgur-notice.diff (1.55 KB, patch)
2019-05-02 20:57 CEST , Andre Miranda
no flags
imgur_warning_popover.diff (3.67 KB, patch)
2019-05-14 05:38 CEST , Andre Miranda
no flags
Screenshot of last patch (15.67 KB, image/png)
2019-05-14 05:40 CEST , Andre Miranda
no flags

Additional information