[tbb-bugs] #20347 [Applications/Tor Browser]: Put "custom" option on security slider?

[Tor Bug Tracker & Wiki]

#20347: Put "custom" option on security slider?
-------------------------------------------------+-------------------------
 Reporter:  arthuredelstein                      |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  Medium                               |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-usability, tbb-security-slider,  |  Actual Points:
  TorBrowserTeam201610                           |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by arthuredelstein):

 * status:  needs_revision => needs_review


Comment:

 Replying to gk, [comment:7 comment 7]:
 > So, I played around with the patch a bit. My biggest objection to it is
 that buttons are missing. I was quite confused as every other dialog
 opening in the browser has at least a Cancel/Close button and was
 wondering whether I really should click on the red and dangerous "x" (it's
 red for a reason, right?). I finally concluded, "yes, that's obviously the
 intention" and pressed it anxiously. So, I think this is not going to fly
 with a user who is supposed to acknowledge possibly changes by clicking on
 a button that screams "Abort!!1! Danger!1!!". (the situation might be
 different for the mobile browser, though)

 I think you're right, as does another user I consulted.

 > What about just a "Close" button? I don't know but I suspect users are
 starting to ask whether the changes really got applied (if they made
 some).

 I decided to go back to using OK/Cancel instead, because makes it more
 clear that changes have been applied than a "Close" button. Also I guess
 it gives users who didn't mean to change the settings a chance to undo
 their mistake.

 > Apart from that, clicking on the slider level to adjust the slider is
 not working anymore. We should retain that option.

 Oops, I brought that back.

 Replying to gk, [comment:9 comment 9]:

 > Another thing that confused me (and might tie to my comments above): if
 I am on "low" and disable JS via the NoScript button and then click on the
 Restore Defaults one the NoSrcipt button does not change. It does not do
 so even if I close the dialog. Changes the tab or reloading the page does
 change it, though.

 I believe I have fixed this now. Turns out we need to use setTimeout to
 make sure the new pref value is fully known to NoScript before we tell it
 to update the UI. Also, now if the user toggles "noscript.global" or
 "noscript.globalHttpsWhitelist" in about:config, the UI also gets updated
 correctly.

 Here's the new version:
 https://github.com/arthuredelstein/torbutton/commit/20347+1

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20347#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online