New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 664835 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner:
Last visit > 30 days ago
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug
Team-Security-UX



Sign in to add a comment

Flash runs automatically even though set to ask

Project Member Reported by sdy@chromium.org, Nov 13 2016

Issue description

Version: 56.0.2918.0
OS: macOS 10.12.1 (tested so far)

What steps will reproduce the problem?
(1) Visit a website with Flash.

What is the expected result?
Flash doesn't run unless the site is whitelisted or I explicitly allow it to run.

What happens instead?
Flash runs right away, but certain actions trigger the "do you want to run Flash?" bubble.

If I repeatedly kill Flash from the task manager and reload the page, eventually it will start behaving correctly (Flash won't run unless I approve it). See attached screen recordings.
 
flash_ask.png
39.4 KB View Download
flash_runs_though_blocked.mov
21.2 MB Download

Comment 1 by sdy@chromium.org, Nov 13 2016

Demo of it behaving correctly after a few kills.
flash_not_running_after_repeat_kill.mov
1.1 MB Download
Cc: pinkerton@chromium.org lafo...@chromium.org shrike@chromium.org
Labels: M-55
I've seen unpredictable behavior here as well. Sometimes i see pages not asking and just failing (telling me to install flash), other times i see flash running when set to ask, without asking.

I also see this on M55. 

Comment 3 by gov...@chromium.org, Nov 14 2016

Cc: pbomm...@chromium.org

Comment 4 by gov...@chromium.org, Nov 14 2016

Cc: mmoss@chromium.org

Comment 5 by mmoss@chromium.org, Nov 14 2016

Cc: -mmoss@chromium.org
I doubt I have anything to add to this. This seems like an issue for whoever implements the Flash plugin, or the Content Settings feature.

Comment 6 by mmoss@chromium.org, Nov 14 2016

Cc: mmoss@chromium.org
Oh, never mind, I see it's releaseblock.
Cc: -mmoss@chromium.org ericde@chromium.org
For sites where the site engagement is sufficiently high (i.e. > 30) we will not prompt (i.e. we will allow Flash to run and not change the site's behavior).

You can check the calculated site engagement score for the sites you visit at chrome://site-engagement.

Comment 8 by sdy@chromium.org, Nov 14 2016

Interesting. In that case, there may just be UI issues:

- There's no indication that Flash will run — the site info bubble still says "ask".
- Certain actions trigger a permissions prompt.

Comment 9 by gov...@chromium.org, Nov 14 2016

This bug has been reported as M55 Beta blocker for this week Beta release on Wednesday (11/16). Please have the fix ready and merged to M55 branch latest before 4:00 PM PT tomorrow, Tuesday (11/15/). Thank you.
Cc: mmoss@chromium.org

Comment 11 by sdy@chromium.org, Nov 14 2016

Cc: -mmoss@chromium.org
Labels: -ReleaseBlock-Beta
Since it sounds like this may be less severe than I thought, I'm going to remove the beta blocker status. Feel free to re-add it.
Cc: raymes@chromium.org
When url policies (see attached image) exempt a site, in the Site Permissions bubble we change the text to say "Allow (by policy)." 

Perhaps we could make this clearer, for cases where site engagement kicks in, by having similar text in that bubble saying ~ "Allow (by engagement)"... would need UX input.

Timing wise, it would probably make sense to target such a change for M56+ timeframe, since the site engagement ramping won't happen in earnest for most sites until Feb, 2017.
When simplifying the strings during the recent Material Page Info overhaul, we considered "Automatic", but ended up with "Detect".
Cc: ranjitkan@chromium.org
Gentle ping, M55 is set to target stable soon. 

@ lgarron: Kindly have a look into it and please provide an update on it. Following up as issue is reported as P1.

Thanks.!
I just realized something.

Is everyone who is seeing this a Googler? There is a forced whitelist of sites applied to all logged-in Googler accounts that includes sites such as pandora.com, bbc.com, hulu.com, and twitch.tv .
sdy@, pinkerton@, any chance this might only be happening on sites listed at chrome://settings/contentExceptions#plugins ?

I can't find the existing Chromium bug about this, but see b/28124167 for the Google-internal bug.

Comment 16 by sdy@chromium.org, Nov 21 2016

lgarron@: I definitely noticed this first on a site that's not on the list (see the screen recording), and I'm 99% sure it was on a personal computer+profile.

Comment 17 by ericde@google.com, Nov 21 2016

Components: Internals>Plugins>Flash>PreferHTML5
@sdy : it would be great to know :
1) if site was already on chrome://settings/content, under Flash, and allowed
2) what site's chrome://site-engagement score is.

Thanks.

Comment 18 by sdy@chromium.org, Nov 22 2016

ericde@: Sure, happy to help.
1) It wasn't whitelisted; I checked at the time.
2) I had just ordered a pizza (5-10 minutes of interaction). I haven't been back there since I filed the bug, but I can check its current score later if that would be helpful.
Owner: lgar...@chromium.org
Status: Assigned (was: Untriaged)
[mac triage] taking this out of the triage queue, assigning based on the possibility this is UI/wording issue, but I've only spent one triagths of a time unit reading. Please reassign or triage further as appropriate.
Owner: lafo...@chromium.org
I'm not the right person for this bug, although it's still unclear whether this is a wording issue or a bug.

Passing the hot potato to laforge@.
Components: -Internals>Permissions Internals>Permissions>Model

Comment 22 by vabr@chromium.org, Dec 2 2016

Components: Privacy
Flagging for privacy because this is about a content setting.
Owner: raymes@chromium.org
Hey Raymes,

Do you recall where the discussion about "by policy" or "by site engagement" landed?  Is this a WontFix?
Owner: ericde@chromium.org
I don't feel too strongly. If we do anything, I don't think it's worth doing something complicated because as the SE threshold goes up, people will see Flash automatically running less and less. So I think the most we would want is to have a string like "Run automatically". 

I'll leave this to ericde@ to decide, but I would be fine with WontFix.

Comment 25 by ericde@google.com, Jan 26 2017

Status: WontFix (was: Assigned)
getting back to this after a while...I think this is a wontfix for now. the SEI threshold is set pretty high for googlers, and will be ramping up over time as raymes@ mentions in #24 above. 

@sdy : if you disagree, please reopen and we can have a separate discussion.

Sign in to add a comment