MozillaWiki - User contributions [en]

Mobile/UI/Designs/TouchScreen

2008-01-23T00:02:51Z

HeikkiToivonen: /* Comments */

== Touch Screen UI Design ==

The Touch Screen UI design has the following goals:

* 1-2 taps for most frequent activities
* Finger taps -- no stylus required
* Familiar (to desktop users) where possible
* Intuitive

The design proposal described below attempts to meet all these goals.

=== Main Screen ===

[[Image:MobileFF-TouchUI-Main.png|frame|Main Screen]]

The main browser screen is shown at right.

The toolbar at the bottom contains the most frequently used functions - back/forward, zoom in/out and tabs. This toolbar cannot be hidden, and is generally present in all browser screens. The buttons may sometimes change depending on the screen.

Web page content is displayed in the center panel, and can be scrolled/panned directly by dragging. Scrollbars are normally not shown to maximize screen real estate, but can be shown during scrolling to provide a visual cue of the overall page size.

At the top of the screen is a title bar with a hideable toolbar beneath. This toolbar has a reload button, a URL bar, and a bookmark button.

This UI layout enables quick 1-touch access to the most frequent browser activities.

==== Comments ====
It may be tough to tap the title bar with your finger without hitting the URL bar by mistake.

One thing to consider is simply scrolling the title bar off the top of the screen when you scroll down through the page, as the iPhone does.

=== Maximized Main Screen ===
[[Image:MobileFF-TouchUI-Main-max.png|frame|Maximized Main Screen]]

The URL toolbar may be hidden by tapping on the title bar. This increases the display area for the web page.

Tapping the title bar again re-displays the URL bar.



==== Comments ====

=== URL Entry Screen ===

[[Image:MobileFF-TouchUI-Url-entry.png|frame|URL Entry Screen]]

Tapping the URL textfield opens a new screen as shown to the right. This screen displays a textbox at the top that displays the currently entered text. The user may enter a search term or a URL.

Below the URL/search-term text field is a panel that display hints from browsing and search history and bookmarks that match the entered text. The number of hints shown depends on the display height but in any case the height of each entry field will be sufficient to allow easy touch access. '''Note:''' Clicking on any hint will immediately launch that URL.

The system provided software keyboard is displayed below the hints panel. This is optional and is displayed only on touch screen devices that do not have an integrated QWERTY keyboard.

The toolbar at the bottom has a new set of buttons. The "cancel" button returns to the main screen, the "go" button launches the URL entered, and the "search" button invokes the user-defined web search engine with the text entered as the search term(s).

==== Comments ====

=== Page Load Screen ===

[[Image:MobileFF-TouchUI-Loading.png|frame|Page Load Screen]]

When the user clicks "Go" or "Search" in the URL entry screen, the browser displays the page loading screen.

This screen is essentially identical to the Main screen, except that the "reload" button is now a "Stop" button, and allows the user to cancel the request.

Page download progress is displayed in the URL box.

==== Comments ====
Changing of the reload to stop has a really nasty effect; talk to any iPhone user and you will likely encounter them griping about it. The issue is that you start a page load, decide to stop, and while that command is moving your hand to click the stop button the button changes to reload, so you end up reloading the page you tried to stop loading. Very confusing, and annoying. --Heikki

=== History on Main Screen ===

[[Image:MobileFF-TouchUI-Main-history.png|frame|History on Main Screen]]

To allow easy access to browsing history, the URL box includes a history chevron at the right.

Tapping the history chevron displays the most recently viewed pages. The list is displayed with the most recent page at the top.

'''For discussion:'''
* The toolbar icon at the bottom can show different buttons that allow the user to sort the history list in other ways - name, frequency of access, etc.
* The title bar and URL bar can be removed in this screen to make more room for history items.

==== Comments ====

=== Bookmarks ===

[[Image:MobileFF-TouchUI-Bookmarks.png|frame|Bookmarks]]

The bookmark button allows one tap access to bookmarks. The bookmarks are displayed as a list that can scrolled easily by dragging.

This design assumes that mobile users do not typically have many bookmarks that are organized in folders.

Double-tapping the bookmark icon will add the current page to the list of bookmarks. This can be done either in the Main Screen, or in the Bookmark screen.

'''For discussion:'''
* The toolbar at the bottom can show different buttons for bookmark-specific functions such as sorting by name or frequency, display folders, etc.
* The title bar and URL bar can be removed in this screen to make more room for bookmark items.

==== Comments ====

=== Tabs Screen ===

[[Image:MobileFF-TouchUI-Tabs.png|frame|Tabs Screen]]

Tapping on the "tabs" button in the Main Screen brings up the Tabs Screen. This screen displays thumbnails of up to 4 tabs and allows the user to tap and select a tab.

The back and forward buttons in the toolbar can be used to scroll/pan across additional tabs if present.

Tapping on the + icon at the center creates a new tab, and automatically selects it, returning to the Main Screen.

'''For discussion:''' Scroll/Pan can also be done by dragging the screen. The toolbar can also display a different set of buttons that are more relevant to the tab operations.

==== Comments ====

== Mockup ==

A XUL mockup is available at [[http://wiki.mozilla.org/images/b/b1/Touchscreenbrowser.zip]]. Not all features described above are working, and the XUL/JS code is experimental.

To run the mockup please type:

<code>
firefox -app <path to where its unzipped>/touchscreenbrowser/application.ini
</code>

=== To do ===

* Main Screen
** History chevron in URL box
** Scrollbars while panning
** Zoom-to-fit on page load
*** Is there a simple way to do this?
* URL Entry Screen
** Selecting from a hint
** Scrolling hints via dragging
** Software keyboard
** Search button
* Page Load Screen
** Progress bar
* History on Main Screen
* Bookmark Screen
* Tabs Screen

Bugzilla Talk:Languages

2007-05-03T02:23:23Z

HeikkiToivonen: On Python cons

== On Python cons ==

* Not having curly-braces on "if" statements and other blocks makes long blocks hard to read.
** I think this is mostly a red herring. First, you should not write long blocks to begin with. Second, I've used Python almost exclusively in a large project for over three years and this has rarely been a problem.

* Poor Unicode handling--strings are ASCII by default, and are Unicode only if you prepend them with u, like u"string".
** I think u"" can easily be enforced as a coding policy. Depending on how ambitious your Unicode needs are, Python Unicode may not be enough for you. For Chandler we created PyICU to fix cases where Python's natural Unicode support falls short.

* No standard way of installing modules like CPAN.
** There is: Python eggs. These are pretty new, though, so not all projects make eggs or upload them to cheeseshop (equivalent to cpan).

* Python has no equivalent to Perl's "taint" mode.
** I know of some attempts at this, and I believe Zope has a sandbox thingy as well, so the situation is probably not as bleak as you think.

Community:SummerOfCode07:Brainstorming

2007-03-15T17:01:59Z

HeikkiToivonen: /* Suggestion List */

Projects with a confirmed mentor and approved by the Mozilla project SoC administrator will be moved to [[Community:SummerOfCode07]]. Potential students should look at that page to find project ideas for which we'd like submissions.

==Ground Rules==

* '''Be specific'''. It's hard to understand the impact of, or the size of, vague proposals.
* '''Consider size'''. The student has eight weeks to design, code, test and document the proposal. It needs to fill, but not overfill, that time.
* '''Do your research'''. Support the idea with well-researched links.
* '''Don't morph other people's ideas'''. If you have a related idea, place it next to the existing one, or add a comment.
* '''Insert only your own name into the Mentor column''', and then only if you are willing to take on the responsibility. Potential mentors [http://code.google.com/soc/mentor_step1.html sign up here].

([http://weblogs.mozillazine.org/gerv/archives/2006/05/making_a_soc_project_list.html More thoughts on making a good list])

==Suggestion List==

Last year's ideas: [[Community:SummerOfCode06|General]], [[Thunderbird:Summer_Of_Code_2006|Thunderbird]]

Please use this format for submitting ideas.
{| border="1" cellpadding="3" width="100%" valign="top"
|- align="center"
| style="background-color: #efefef;" | '''Title'''
| style="background-color: #efefef;" | '''Abstract - links to details/bugs/etc'''
| style="background-color: #efefef;" | '''Reporter'''
| style="background-color: #efefef;" | '''Mentor(s)'''
| style="background-color: #efefef;" | '''Comments'''
|-
| valign="top" | JPEG 2000
| valign="top" | [https://bugzilla.mozilla.org/show_bug.cgi?id=36351 Add JPEG 2000 support to Mozilla]
| valign="top" |
| valign="top" |
| valign="top" |
|-
| valign="top" | Camino: Tabspose
| valign="top" | Expose for tabs, but in the browser window ({{bug|312007}})
| valign="top" | pinkerton
| valign="top" | pinkerton
| valign="top" | I've wanted to do this for years...
|-
| valign="top" | Make SeaMonkey Not Suck As A News Reader
| valign="top" | Basically, get some traction on some of the highlights of {{bug|176238}}/{{bug|12699}} , in particular: "clickable references" ({{bug|62033}}) and headers in general ({{bug|23114}}), a more usable subscribe dialog ({{bug|40260}}), reordering of the folder pane ({{bug|150274}}, maybe even hierarchical?). For bonus points, a correct implementation of the nntp/news protocols ({{bug|89939}}) would be really cool!
| valign="top" | Mnyromyr
| valign="top" | Mnyromyr
| valign="top" | UI stuff would be for SeaMonkey, but should be portable to Thunderbird easily. Both would profit from backend fixes.
|-
| valign="top" | Real Mail Templates
| valign="top" | Currently, mail templates are too static, their interaction with mails you respond to etc. is almost zero ({{bug|21210}}, {{bug|107876}} and others). It would be an enourmous progress if we could have variables like $$EMailAddress$$, $$QuotedBody$$, $$Date$$, $$CustomVariable(with Parameter)$$ in a template which get filled in when replying or composing.
| valign="top" | Mnyromyr
| valign="top" | Mnyromyr
| valign="top" | UI stuff would be for SeaMonkey, but should be portable to Thunderbird easily. Both would profit from backend fixes.
|-
| valign="top" | Score Filter
| valign="top" | A score filter ({{bug|151622}}) would associate an integer with every message. This integer could then be changed by filter actions like "Increase by x", "Set to Y", etc. and have itself filter criteria like "If score is lower than A", "If score has value B", etc. Several other message properties alterable by filter actions (like isJunk or isThread) would need to be made usable as filter criteria for that for full points. In toto, this would allow for very fine-grained message control.
| valign="top" | Mnyromyr
| valign="top" | Mnyromyr
| valign="top" | UI stuff would be for SeaMonkey, but should be portable to Thunderbird easily. Both would profit from backend fixes.
|-
| valign="top" | Metalink
| valign="top" | A simple XML format for downloads ({{bug|331979}}) that lists mirrors and checksums, along with other useful metadata such as mirror location. Listing multiple URLs for a file increases availability while the checksums guarantee integrity and let downloads be repaired automatically. You can also filter downloads by location and other things. This is currently supported by over ten download managers.
| valign="top" | Antini
| valign="top" |
| valign="top" |
|-
| valign="top" | Auto verify MD5/SHA1 hashes & PGP signatures
| valign="top" | Automatically verifying MD5/SHA1 hashes, and optionally PGP signatures, of downloads. When you have downloaded a file, the download manager should try to download filename.md5, filename.sha, filename.asc and run the associated tool on the downloaded file to verify. Mark the entry as red or something in the download manager, and change the Open link to Info link, if the file did not verify. The Info link would open a page explaining what is wrong. It could perhaps have a open or preferably just delete file button. More difficult case would be to get the md5/sha1 signature if it is just embedded on the page where the download link is, but you could try some heuristics... (see also bug 292481).
| valign="top" | HeikkiToivonen
| valign="top" |
| valign="top" | PGP signature support would probably be easiest to build on top of Enigmail extension.
|-
| valign="top" |
| valign="top" |
| valign="top" |
| valign="top" |
| valign="top" |
|-
|}

Cross Site XMLHttpRequest

2007-02-21T00:32:34Z

HeikkiToivonen: /* Details */

Cross-Site XMLHttpRequest allows a web page to read information from other web servers using norm XMLHttpRequest. In the past this has not been permitted since the other server may be sitting inside a corporate firewall or may be a server where the user is logged in.

To solve this problem it is suggested that the accessed server can signal back to the browser that it is ok for other sites to access certain pages on the server. Firefox checks for this and only returns the response to the page if the server explicitly allows it. Otherwise the browser will throw away the response from the server and throw an exception.

== Details ==

There are currently two draft specs from w3c for how this should work. The signaling for when a document is accessible is spec'ed in the access-control draft spec [http://www.w3.org/TR/access-control/]. This states that the site can insert <?access-control?> processing instructions into XML files that says which sites can access the file. It also allows for http-headers to be added to allow access to be controlled to any file type.

The PI contains lists of URL patterns that describe which URLs can access the file. These patterns can contain wildcards, but follow strict parsing rules rather than being general URLs.

Additionally [http://lists.w3.org/Archives/Public/public-webapi/2006Jun/0012] is a draft spec for how XMLHttpRequest should interact with the access-control spec. This spec describes some headers that should be included when making a cross site request. (Though I personally wonder if this part should be moved into the access-control spec.) It also describes how to deal with http methods other than GET and POST.

What about [http://lxr.mozilla.org/mozilla/source/extensions/webservices/docs/New_Security_Model.html]?

== Suggested Implementation ==

A goal of the implementation is that it should be reusable for other things than XMLHttpRequest. For example document.load should be able to do the same cross-site loads with the same restrictions. As should XSLT and XBL.

To do this we'll set up an [http://lxr.mozilla.org/mozilla/source/netwerk/base/public/nsIStreamListener.idl nsIStreamListener] that sits between the normal nsIStreamListener and the [http://lxr.mozilla.org/mozilla/source/netwerk/base/public/nsIChannel.idl nsIChannel]. Once onStartRequest is called we check for access control headers. If the headers deny access we cancel the channel with a network error failure. If headers allow access we pass through all calls to the outer caller.

If headers don't say either way and the content type is an XML one (do we have a good way to determine that?) we set up a parser and ourselfs as sink. We'll then listen to notifications until the first start-element notification. At the same time we have to store all incoming data that is fed to the parser. If the access control PIs doesn't indicate that access should be granted we cancel the channel.

If access control is granted we forward calls to the outer caller and stream the buffered data to it.

=== Issues ===

* We have to check that the code in onStartRequest in the original streamlistener doesn't do things that are too late to do once the delayed onStartRequest is called.

* Is it possible to cancel with a network error if we get a 404 or 401 or similar? This would be a good way to avoid making it possible for the site to check for the existence of files on the server or check if the user is logged in or not.

== Security worries ==

* The first thing that worries me is that you can make POST submissions to any url and include XML data as payload. It is already possible to make POST submissions to any url, but the only possible payload is plain/text encoded form data or multipart/mixed encoded files and form data. With Cross-Site XMLHttpRequest it would be possible to send XML data. In particular there is worry that this would make it possible to do SOAP requests to any server. Note that while the page would be unable to access the data returned by the SOAP request, that isn't necessary if the request itself is "transfer all users money to account 12345-67". To avoid this we could either use the model as for non-GET-non-POST requests defined in the XHR spec [http://lists.w3.org/Archives/Public/public-webapi/2006Jun/0012], or we could use something like [http://lxr.mozilla.org/mozilla/source/extensions/webservices/docs/New_Security_Model.html]

* Should we try to follow these specs even when accessing files on the same domain? From the sites point of view they can't rely on that anyway since all browsers don't support the access-control spec (and old versions never will).

* We have to make sure to not notify the onreadystatechange listener or any other listeners until we've done all access control checks. Otherwise it would be possible to check for the availability of files on other servers though you couldn't actually read the content.

* We have to make sure to not put data in .responseText until we've passed access control checks even for XML files.

* We have to make it impossible to distinguish between a access-control-failed error and network errors such as 404s. Can the implementation "recancel" a canceled channel?

* Should we check for PIs even if HTTP headers has said that access is granted? It'll always be possible to circumvent those headers using .mimetypeOverride which'll make us not treat the doc as XML and thus we won't even look for PIs. Alternatively we could ignore the .mimetypeOverride when checking for PIs but that might be a problem with poorly configured servers (which is the whole reason for .mimetypeOverride)

* We should make sure to make it impossible to set authentication headers since that would make it easier for a site to attempt (distributed) brute force hacking against authenticated servers. Note though that such hacking would be significantly complicated by the fact that the server must be password protected but still have files that it grants access to a 3rd party server, which doesn't really make a lot of sense.

Community:SummerOfCode06

2006-04-18T23:50:48Z

HeikkiToivonen:

Add your ideas here for Projects for the Google [http://code.google.com/summerofcode.html Summer of Code 2006]

We will be reviewing ideas posted here the week of 4/17 and putting together proposals the following week. Please note if you are interested in being a Mentor for one of these projects, or suggest someoneone who could serve as mentor. Mentor requirements are here - http://code.google.com/soc/mentorfaq.html

Thanks

Chris Hofmann

- Complete Torrent-Integration: [http://firepuddle.mozdev.org/] (started in last year's SoC)

- Complete Skype-Integration for Thunderbird (started in last year's SoC)

- Work on Venkman to bring it some good updates/bugfixes/new features. Maybe work to do a 1.0 release? (https://bugzilla.mozilla.org/show_bug.cgi?id=141097)

- XUL editor plugin for [http://www.eclipse.org Eclipse] that leverages the XULRunner component and JS debugger from the [http://www.alphaworks.ibm.com/tech/ajaxtk Eclipse Ajax Toolkit Framework] to create a XUL UI development tool. ([[User:Beltzner|Beltzner]] 09:31, 17 April 2006 (PDT))

- "Advance the XUL platform" projects (to be defined) e.g. implement <menugroup>,
fix menu bugs, etc. [[User:Ben|Ben]] 10:38, 17 April 2006 (PDT)

- Multi-threaded (accelerated) Download Manager
([https://bugzilla.mozilla.org/show_bug.cgi?id=40106]) with possible [http://www.metalinker.org Metalink] (Mirrors/P2P/checksums) support.

- Automatically verifying MD5/SHA1 hashes, and optionally PGP signatures, of downloads. When you have downloaded a file, the download manager should try to download filename.md5, filename.sha, filename.asc and run the associated tool on the downloaded file to verify. Mark the entry as red or something in the download manager, and change the Open link to Info link, if the file did not verify. The Info link would open a page explaining what is wrong. It could perhaps have a open or preferably just delete file button. More difficult case would be to get the md5/sha1 signature if it is just embedded on the page where the download link is, but you could try some heuristics...

Community:SummerOfCode06

2006-04-18T23:49:16Z

HeikkiToivonen: Verify downloads

Add your ideas here for Projects for the Google [http://code.google.com/summerofcode.html Summer of Code 2006]

We will be reviewing ideas posted here the week of 4/17 and putting together proposals the following week. Please note if you are interested in being a Mentor for one of these projects, or suggest someoneone who could serve as mentor. Mentor requirements are here - http://code.google.com/soc/mentorfaq.html

Thanks

Chris Hofmann

- Complete Torrent-Integration: [http://firepuddle.mozdev.org/] (started in last year's SoC)

- Complete Skype-Integration for Thunderbird (started in last year's SoC)

- Work on Venkman to bring it some good updates/bugfixes/new features. Maybe work to do a 1.0 release? (https://bugzilla.mozilla.org/show_bug.cgi?id=141097)

- XUL editor plugin for [http://www.eclipse.org Eclipse] that leverages the XULRunner component and JS debugger from the [http://www.alphaworks.ibm.com/tech/ajaxtk Eclipse Ajax Toolkit Framework] to create a XUL UI development tool. ([[User:Beltzner|Beltzner]] 09:31, 17 April 2006 (PDT))

- "Advance the XUL platform" projects (to be defined) e.g. implement <menugroup>,
fix menu bugs, etc. [[User:Ben|Ben]] 10:38, 17 April 2006 (PDT)

- Multi-threaded (accelerated) Download Manager
([https://bugzilla.mozilla.org/show_bug.cgi?id=40106]) with possible [http://www.metalinker.org Metalink] (Mirrors/P2P/checksums) support.

- Automatically verifying MD5/SHA1 hashes, and optionally PGP signatures, of downloads. When you have downloaded a file, the download manager should try to download filename.md5, filename.sha, filename.asc and run the associated tool on the downloaded file to verify. Mark the entry as red or something in the download manager, and change the Open link to Info link. The Info link would open a page explaining what is wrong. It could perhaps have a open or preferably just delete file button. More difficult case would be to get the md5/sha1 signature if it is just embedded on the page where the download link is, but you could try some heuristics...

Necko:SSL v2 Sites

2005-05-21T04:36:23Z

HeikkiToivonen: low cipher section

This is a list of websites known to only support SSL v2 - that is, if you turn it off, you get an error message saying that you can't access the site, or any attempt to connect to the site causes a long hang. In order for a site to be added to this list, it should be quickly accessible with SSL v2 enabled, but you should get an error message or a hang with SSL v2 disabled.

We may later attempt to contact and evangelise these sites, but at the moment this is merely a recording exercise.

* [https://webmail.komtel.net/horde/imp/ https://webmail.komtel.net/horde/imp/]
* [https://gnunet.org/drupal/?q=node/61 https://gnunet.org/drupal/?q=node/61]
* [https://www.umsu.de/ https://www.umsu.de/] and friends at 1&1, e.g.:
** [https://www.pro-regenwald.de/ https://www.pro-regenwald.de/]
* [https://register.btinternet.com/ https://register.btinternet.com/]
* [http://www.cpucityshop.co.uk/ http://www.cpucityshop.co.uk/]

Not SSL v2 but low security ciphers (other places to discuss these?):

* [http://www.comcastsupport.com/sdcxuser/lachat/user/userchatstart.asp http://www.comcastsupport.com/sdcxuser/lachat/user/userchatstart.asp]
** I have disabled SSL v2, all SSL v2 ciphers, everything with less than 128 bits, MD5 and this is the only site in over a year that I have seen that does not work.

Other useful links:

* [http://weblogs.mozillazine.org/gerv/archives/008157.html Gerv's original blog post]
* [http://my.opera.com/forums/showthread.php?s=83e643b69072bab8644e3553610305c0&threadid=91417 Opera forum post]
* [http://www.netcraft.com Netcraft] may have SSL v2 server prevalence info
* [http://www.securityspace.com/s_survey/sdata/200504/protciph.html SecuritySpace] has another survey, although I don't think they have figures for SSL v2 <b>only</b>.