Provide a way for users to opt-out of sending console logs

[miketaylr]

For privacy reasons, it's probably good to provide an escape hatch. Perhaps a pre-selected checkbox, that users can de-select. We probably want to also make console logs visible at report-time somehow, unsure. That could be follow up bug material.

[miketaylr]

Probably something to tackle in Q2.

[miketaylr]

Another option, recommended by :mt,

A banner reminding people that ALL this information will be public is probably what you want

[martinthomson]

That might be #2690.

[miketaylr]

I think @magsout expressed interest in working on this.

The idea is that we include a (checked by default) checkbox (somewhere in the form UI...) that says something like "Include console messages and browser config data".

And if it's checked, nothing changes from our current situation. The default behavior works like so:

If the user clicks "report site issue" from mobile or desktop Firefox, the browser sends a POST to the site, which then grabs those details from the form object and stashes the data inside a hidden input in the browser form:

https://github.com/webcompat/webcompat.com/blob/master/webcompat/form.py#L107 https://github.com/webcompat/webcompat.com/blob/master/webcompat/form.py#L122-L127

That ends up looking something like:

<input id="details" name="details" type="hidden" value="{
  &quot;mixed active content blocked&quot;: false, 
  &quot;buildID&quot;: &quot;20190204181317&quot;, 
  &quot;hasTouchScreen&quot;: false, 
  &quot;tracking content blocked&quot;: &quot;false&quot;, 
  &quot;consoleLog&quot;: [
    &quot;[JavaScript Error: \&quot;Content Security Policy: The pages settings blocked the loading of a resource at inline (script-src).\&quot; {file: \&quot;https://github.com/webcompat/web-bugs/\&quot; line: 1}]&quot;, 
    &quot;[JavaScript Warning: \&quot;Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://api.github.com/_private/browser/stats. (Reason: CORS request did not succeed).\&quot;]&quot;
  ], 
  &quot;gfx.webrender.blob-images&quot;: true, 
  &quot;gfx.webrender.all&quot;: false, 
  &quot;mixed passive content blocked&quot;: false, 
  &quot;gfx.webrender.enabled&quot;: false, 
  &quot;image.mem.shared&quot;: true, 
  &quot;channel&quot;: &quot;aurora&quot;
}">

So my thinking was if the user unchecks the new checkbox (to not provide this data), we just empty out the contents of input#details, and it will never get sent to GitHub.

Does that make sense @magsout?

[miketaylr]

(and then let's file a follow up so the user can inspect the data to make a more informed decision, or possibly even edit it)