[Bug 47694] Remember me on Login interface should state duration

2014-09-25 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #66 from Isarra zhoris...@gmail.com ---
*** Bug 70348 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-09-15 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #65 from Matthew Flaschen mflasc...@wikimedia.org ---
Created attachment 16479
  -- https://bugzilla.wikimedia.org/attachment.cgi?id=16479action=edit
Google 2-factor remember me text

(In reply to Matt Walker from comment #17)
 (In reply to comment #15)
  Keep me logged in satisfies this need.
 
 Keep me logged in implies perpetuity. Which is what triggers the confusion
 when someone is logged out.
 
 Look at a service like Gmail -- initially it says keep me logged in
 because it will. But if you have two factor auth; it then gives you a new
 form that specifically says Remember this computer for 30 days.

Is this still the case?  This is a different use case anyway, because it's a
distinct feature (this computer is particularly private, so I don't want to
enter my 2-factor code every time) from the regular login screen.

However, it looks like they're using (screenshot attached), Don't ask for
codes again on this computer now unless we're considering different forms.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-03-19 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

Nemo federicol...@tiscali.it changed:

   What|Removed |Added

   Keywords||i18n

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-31 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #64 from Amgine amgine.sae...@gmail.com ---
(In reply to comment #61)
 (In reply to comment #60)
  
  (In reply to comment #59)
...snip
   differ. This obviously supports the view that it would be unusual to 
   present
   this, and probably unnecessary.

The above argument is the same argument as

  Many users are bothered, as the number of featured browser extensions with
  hundreds thousands users show:
  https://addons.mozilla.org/it/firefox/addon/betterprivacy/
  https://addons.mozilla.org/it/firefox/addon/anonymox/
  https://addons.mozilla.org/en/firefox/addon/self-destructing-cookies/

And both arguments, being based on deduction, obviate this argument:

 No one here has actually presented a real-world complaint from users, about
 how
 they can't use the login form because it doesn't precisely specify the length
 of a login session. That's because it doesn't happen. 


The rest of that comment was speculative (although I happen to agree with it.)

The question is not about cookie life, but about displaying that cogently to
the user. The real question is: is this a real problem? for some users it is
because they have reported it as a problem. No one previously reported the
existence of the text as a problem; it was a change made without an outside
(user) instigation (at least, I never saw a bug report about it.)

The heat in these comments suggests it's a real issue, too.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-30 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #60 from Nemo federicol...@tiscali.it ---
I'm not sure whether this bug should be fixed or not, even though Isarra's
compromise is sensible, because I agree that in an ideal world we'd just have a
checkbox remind me forever with unanimous research telling us that N days
feels exactly like forever/what the users think forever (or forever enough)
and MediaWiki would set expiry accordingly. However, I doubt this is possible:
for some users forever is 2 years renewing at every visit (like Google), for
others 1 week is already a painfully long time. See also below.

This said, it seems Steven lacks an answer on this point:

(In reply to comment #59)
 I cannot find a _single_ good example of a login form which
 specifies
 an exact time limit on saved login sessions, even if cookie policies may
 differ. This obviously supports the view that it would be unusual to present
 this, and probably unnecessary.

As most arguments where Steven uses the word obviously, this is IMHO a very
weak and disputable one. Cookies are one of the least honest businesses of the
internet and few or no websites are straightforward with their users about them
(though this is getting better in EU thanks to recent directives): however,
MediaWiki's ethical standards are higher than the average and we shouldn't
blindly follow bad practices, however common they might be.
Best example of dishonesty has always been Google (which triggered the EU
directive):
https://www.eff.org/deeplinks/2007/07/edition-privacy-theater-googles-cookie-monster
http://edri.org/edrigramnumber5-15search-engine-privacy/
Many users are bothered, as the number of featured browser extensions with
hundreds thousands users show:
https://addons.mozilla.org/it/firefox/addon/betterprivacy/
https://addons.mozilla.org/it/firefox/addon/anonymox/
https://addons.mozilla.org/en/firefox/addon/self-destructing-cookies/

On the other hand, other users just hate logging in and whatever expiry you
pick will make someone unhappy. This bug is IMHO about acknowledging that no
expiry is perfect and that we must let the users decide. For the cost of 6
characters or so on the login form, yes.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-30 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #61 from Steven Walling swall...@wikimedia.org ---
(In reply to comment #60)
 
 (In reply to comment #59)
  I cannot find a _single_ good example of a login form which
  specifies
  an exact time limit on saved login sessions, even if cookie policies may
  differ. This obviously supports the view that it would be unusual to present
  this, and probably unnecessary.
 
 As most arguments where Steven uses the word obviously, this is IMHO a very
 weak and disputable one. Cookies are one of the least honest businesses of
 the
 internet and few or no websites are straightforward with their users about
 them
 (though this is getting better in EU thanks to recent directives): however,
 MediaWiki's ethical standards are higher than the average and we shouldn't
 blindly follow bad practices, however common they might be.
 Best example of dishonesty has always been Google (which triggered the EU
 directive):
 https://www.eff.org/deeplinks/2007/07/edition-privacy-theater-googles-cookie-
 monster
 http://edri.org/edrigramnumber5-15search-engine-privacy/
 Many users are bothered, as the number of featured browser extensions with
 hundreds thousands users show:
 https://addons.mozilla.org/it/firefox/addon/betterprivacy/
 https://addons.mozilla.org/it/firefox/addon/anonymox/
 https://addons.mozilla.org/en/firefox/addon/self-destructing-cookies/
 

We're discussing about setting a long term login cookie for users who opt-in,
not auto-renewing cookies or any number of other scummy things in the post you
link to. Users already get to decide. We're talking about how to choose the
clearest language to describe the choice they're making. Matching user
expectations by using similar language that is familiar to them from the same
generic interface on other popular sites helps users make a decision quickly
and without needing to read excess detail like keep me logged in for 180
days.  

No one here has actually presented a real-world complaint from users, about how
they can't use the login form because it doesn't precisely specify the length
of a login session. That's because it doesn't happen. Most users don't really
care exactly how many days you remember them when they're trying to finish the
login process quickly and without having to think much about it. They either
want their session to expire, or to be remembered. (Yes, we all use MediaWiki.
We're also all technical people commenting here, many of us people who submit
patches. We don't represent what most average users need and expect.)

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-30 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #62 from Raimond Spekking raimond.spekk...@gmail.com ---
(In reply to comment #61)
 
 We're discussing about setting a long term login cookie for users who opt-in,
 not auto-renewing cookies or any number of other scummy things in the post
 you
 link to. 

We are discussing a core functionality if MediaWiki. I have the feesling that
you are talking about Wikipedia and the upcoming long term cookie for it only.


 No one here has actually presented a real-world complaint from users, about
 how
 they can't use the login form because it doesn't precisely specify the length
 of a login session. 

Probably because the latest MediaWiki release with the new login form is not
very often deployed to third parties. Especially companies do not very often
update a MediaWiki installation.

And I can confirm, that some of the installations I care for are using very
different cookie lifetime settings. Between some days and some weeks. Depending
on the security rules of the company. But I am not able to link to them because
most of them are in an intranet, not public available.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-30 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #63 from Bartosz Dziewoński matma@gmail.com ---
(In reply to comment #62)
 We are discussing a core functionality if MediaWiki. I have the feesling that
 you are talking about Wikipedia and the upcoming long term cookie for it
 only.

The MediaWiki default is 180 days already, which is sensible unlike the
Wikimedia default which is currently 30 days.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-29 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

Bartosz Dziewoński matma@gmail.com changed:

   What|Removed |Added

 CC||matma@gmail.com

--- Comment #55 from Bartosz Dziewoński matma@gmail.com ---
As I said on bug 60437 already, I also think Isarra's proposal in comment 49
here is the best solution.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-29 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

Isarra zhoris...@gmail.com changed:

   What|Removed |Added

 Status|RESOLVED|REOPENED
 Resolution|WONTFIX |---

--- Comment #56 from Isarra zhoris...@gmail.com ---
(In reply to comment #52)
 Isarra's proposal is not reasonable. You want us to add logic for displaying
 the cookie expiration, while also saying though what the boundary would be
 for actually showing it is up in the air. This is not a specification for a
 patch, it's vague handwaving.

Development is not an exact science. This is why iteration is so popular. If
you've ever done anything Agile, it's all about iteration.

Now I don't know what random number is best so I'm not going to specify a
specific random number, but at this point it really doesn't matter what it is
anyway. We need the logic first, and if the logic is there, we can then just
pick anything for the cutoff number, 182 days, a year, whatever. If it turns
out to be a bad number, people will complain and we can change it. An
iteration, see?

Changing a variable is easy. We do it all the time.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-29 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

Gerrit Notification Bot gerritad...@wikimedia.org changed:

   What|Removed |Added

 Status|REOPENED|PATCH_TO_REVIEW

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-29 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #57 from Gerrit Notification Bot gerritad...@wikimedia.org ---
Change 110279 had a related patch set uploaded by Bartosz Dziewoński:
Keep me logged in on Special:UserLogin should sometimes state duration

https://gerrit.wikimedia.org/r/110279

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-29 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #58 from MZMcBride b...@mzmcbride.com ---
Hmmm, four wontfixes here:

* 2014-01-26 07:16:34 UTC comment 37
* 2014-01-26 21:23:37 UTC comment 42
* 2014-01-28 05:52:58 UTC comment 47
* 2014-01-28 08:59:43 UTC comment 52

Bartosz's patch came in at comment 57. Fun pattern. :-)

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-29 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #59 from Tyler Romeo tylerro...@gmail.com ---
Speaking directly from [[mw:Bug management/Bugzilla etiquette]], bug status,
priority, and target milestone fields summarize and reflect reality and do not
cause it.

With that in mind I ask that this edit war of sorts on this bug please stop.
It is extremely obvious that, at the very least, the outcome of this bug is
disputed. Thus closing it as WONTFIX is unproductive and aggressive.

To the contrary, I recommend that this discussion be taken to a more public
forum, e.g., the mailing list, where it is more likely to get a wider range of
responses and criticisms.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-28 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

Steven Walling swall...@wikimedia.org changed:

   What|Removed |Added

 Status|REOPENED|RESOLVED
 Resolution|--- |WONTFIX

--- Comment #52 from Steven Walling swall...@wikimedia.org ---
(In reply to comment #51)
 Agreed. I think Steven is only bothered that if we mention an expiration
 explicitly people will get used to it, barring his plans to raise the cookie
 length. Isarra's proposal should make everyone happy.

Please don't read ulterior motives in to what I'm saying on the bug. 

Isarra's proposal is not reasonable. You want us to add logic for displaying
the cookie expiration, while also saying though what the boundary would be
for actually showing it is up in the air. This is not a specification for a
patch, it's vague handwaving.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-28 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #53 from Nemo federicol...@tiscali.it ---
(In reply to comment #52)
 Please don't read ulterior motives in to what I'm saying on the bug.

You talked so much in this bug that there's no need to invent anything. :) See
in particular your comment 28; but also comment 10, comment 12, comment 23,
comment 30.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-28 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #54 from Nemo federicol...@tiscali.it ---
(In reply to comment #28)
 If it's likely that we
 change our config to be the same based on a privacy policy revision, then
 there's no need to say something extra

Before Steven says I'm reading too much into this, here he states A - B,
Isarra et al. state ¬B. But Steven's sentence is equivalent to ¬B - ¬A, hence
the logic translation of his concerns is what I said in comment 51. :)

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-27 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

Isarra zhoris...@gmail.com changed:

   What|Removed |Added

Summary|Remember me on Login  |Remember me on Login
   |interface should state for |interface should state
   |30 days only   |duration

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l


[Bug 47694] Remember me on Login interface should state duration

2014-01-27 Thread bugzilla-daemon
https://bugzilla.wikimedia.org/show_bug.cgi?id=47694

--- Comment #51 from Nemo federicol...@tiscali.it ---
Agreed. I think Steven is only bothered that if we mention an expiration
explicitly people will get used to it, barring his plans to raise the cookie
length. Isarra's proposal should make everyone happy.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
___
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l