User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 I have "never remember history" selected under Privacy, but the auto-completion will still pull entries from history as I type in the address bar. I verified that these entries are not bookmarks, by switching the location-bar suggestion option to "bookmarks"; this stops the history entries from showing up. If I switch back to "History and Bookmarks", the behavior resumes. I see a few potentially related bugs about the address-bar history not being cleared or honoring specific deletions, but none that mentions this global setting. Reproducible: Always Steps to Reproduce: 1. Have Firefox set to never remember history. 2. Visit some sites for which you don't have bookmarks. Note a few of the characters at the beginning of the URL. 3. Shut down and restart Firefox. 4. Type the first few characters of one of the URLs you noted. Actual Results: Firefox suggested URLs from history, which it was supposed to have forgotten. Expected Results: Nothing is suggested.

How does that global setting affect these about:config prefs? browser.history_expire_days browser.history_expire_sites I would have thought it'd set both those to 0. If it doesn't the question I think this bug is asking is why not?

Well, the real question is how can the address bar pull entries from history, when that history is not supposed to exist at all? Not that it should matter, but the history it's pulling is pretty old, more than a day.

Did you select Never remember history the moment you started using Firefox? Never remember history prevents Firefox from recording history -- it doesn't go back and delete history you already have. To do that, select Tools > Clear Recent History, select Everything from the dropdown, make sure Browsing & Download History is checked, and click Clear Now. Does that fix your problem?

I'm not sure when I activated "never remember history". "Clear recent history" is greyed out.

Oh right, it's greyed out because you chose Never remember history (bug 463607). Go back to the privacy options and select Remember history. Then Clear Recent History as I described. You can switch back to Never remember after that. Does that work?

adding dependancy on bug 463607 and confirming, actually could just be duped, but i want to be sure that fix will allow users to clear history while in PB mode (so that it will cover this case), and could even be worth writing a test for that. btw, if ehsan is going to fix that with a test in the above bug, feel free to just dupe. Ideally could even be smart to ask the user if he wants to clear all previous history when he toggles "Never rememeber history" (i'd expect that to be automatic, but dataloss is at a step). Adding uiwanted for this.

"Go back to the privacy options and select Remember history. Then Clear Recent History as I described. You can switch back to Never remember after that. Does that work?" Yep.

(In reply to comment #6) > adding dependancy on bug 463607 and confirming, actually could just be duped That's not what this bug is about. Gavin expected the Never remember history option to retroactively delete history. Since that's not how that option is designed to work, this could be INVALID, but since I don't think it's a strange assumption to make, I'll let Ehsan or UX make that call.

we should rephrase the pref, and/or add an option "also clear existing history"... At least if we are going to remove old history we should ask to the user to avoid dataloss, but we don't want to nag him.

(In reply to comment #8) > That's not what this bug is about. Gavin expected the Never remember history > option to retroactively delete history. Since that's not how that option is > designed to work, this could be INVALID, but since I don't think it's a strange > assumption to make, I'll let Ehsan or UX make that call. I don't think "Never remember history" means "Go back and clear the history that is already there as well", so I'd vote for WONTFIX here. But I'll let Alex weigh in as well. Until we definitely believe that this is a valid enhancement request, I'm setting this back to the Unconfirmed status.

I think Marco's suggestion (adding an option to clear history when activating "never remember") is ideal, and doesn't hamper anyone.

The interface in the privacy prefpane currently reads "you may want to _clear your recent history_, or _remove individual cookies_" while it is kind of uncommon for users to read messages (not saying that to be derogatory, it is simply true), I feel like we've established a pretty good path to the Clear Recent History window by linking to it. We could consider a custom message like: Firefox has currently recorded 57 days of history would you like to _clear everything_? and then only display that message if there actually is history stored.

would that be an additional message to the above one with a link pointing to CRH dialog with Everything option selected? PS: we don't have a method to tell how many days of history are present, but adding it would not be hard.

I'm confirming as enhancement, to investigate ways to better notify the user about what is about to happen. Comment 12 is a first possible implementation.

It would replace the text on the never remember history state ("you may want to clear all current history") So either the message about how much history exists would be displayed, or nothing would be displayed (just the first part about it being the same as private browsing).

I still vote for Marco's suggestion, with "also clear existing history" to default to TRUE. I would, in fact, expect "never remember history" to clear all history. The statement is pretty straightforward: You're saying never remember history, regardless of when that history was acquired. If the address bar is popping past URLs up, it's "remembering history" after I clearly told it not to. If I saw something last year and then yesterday you hypnotized me and said "Never remember that", you wouldn't hear me bringing it up tomorrow (assuming a successful hypnosis).

I agree that nearly all of the time users who want to turn history off also want to clear all existing history, but due to the dataloss implications we really need to make the action of deleting everything a bit more explicit than just selecting an item in a drop down. We could go as far as to add an information or (error?) icon to the message in the privacy prefpane to draw more attention to it.

Another alternative would be to clear existing history only after the browser gets closed after "never remember..." is selected. I have no problem with the prompted delete either. Once a user has picked "never remember..." none of the other options are visible, including the option to clear history when Firefox closes. This creates a confusing experience for a user who is in the above position of having disabled history, but who still sees a history items in the new tab pane or awesome bar autocomplete.

(In reply to comment #19) > Another alternative would be to clear existing history only after the browser > gets closed after "never remember..." is selected. I have no problem with the > prompted delete either. We used to have that option and we had to remove it because: 1. Clearing the history at shutdown could be arbitrarily expensive and can make the shutdown process very slow. 2. Your history will be leaked if you crash or shutdown ungracefully some other way, so we need to check for that case at startup as well, which makes the startup process slower too.

(In reply to Ehsan Akhgari [:ehsan] from comment #21) > We used to have that option and we had to remove it because: We currently have this feature. If a user picks "use custom settings...", there's the option to clear private data when Firefox closes, but this option is hidden if a user picks "never remember...". Given the apparent user expectation that "never remember..." means that there's no history (even of prior events), clearing on shutdown seems to fill this need, while avoiding the risk of accidentally picking that option and nuking one's history.

(In reply to comment #22) > (In reply to Ehsan Akhgari [:ehsan] from comment #21) > > We used to have that option and we had to remove it because: > > We currently have this feature. If a user picks "use custom settings...", > there's the option to clear private data when Firefox closes, Ah right, sorry. There was discussion about removing this feature a while back and I was in support of that proposal, and I thought that somebody was working on that patch, but apparently I was wrong. There's just no way to implement this feature efficiently. > but this option > is hidden if a user picks "never remember...". Given the apparent user > expectation that "never remember..." means that there's no history (even of > prior events), clearing on shutdown seems to fill this need, while avoiding the > risk of accidentally picking that option and nuking one's history. I don't think that addresses the concerns in comment 10 and comment 17 at all. I have yet to see an argument which convinces me that we want to delete the user's history without them explicitly asking for it. The dataloss implication outweighs the expectation that we're suspecting some users might have.

Then don't delete it. Simply NEVER REMEMBER IT, which is what the UI promises. I pointed out in comment 16 why one would expect "never remember" to stop historical data from showing up in the UI. I said never remember it. That means don't remember it in suggestions, don't remember it in history lists, or anywhere else. The user has made a very clear choice here, so why are we second-guessing it? Also, Marco already suggested a perfectly clear and convenient solution that addresses everyone's concerns: "...ask the user if he wants to clear all previous history when he toggles 'Never rememeber history.'" Put a checkbox saying "Clear all existing history" next to the button, default it to Yes, and be done with it. Is there some reason that this solution isn't workable?

(In reply to comment #24) > Then don't delete it. Simply NEVER REMEMBER IT, which is what the UI promises. That is what the current code does!

When "remember history" is OFF, Firefox still remembers it in the address bar. That's what this report is about. Also, what is wrong with Marco's suggestion? Why continually dodge this question? It's a perfectly good solution. Why not implement it? It addresses everyone's concerns. Why not implement Marco's suggestion? Do I need to ask again?

(In reply to comment #26) > When "remember history" is OFF, Firefox still remembers it in the address bar. > That's what this report is about. No, it's not! > Also, what is wrong with Marco's suggestion? Why continually dodge this > question? It's a perfectly good solution. Why not implement it? It addresses > everyone's concerns. > > Why not implement Marco's suggestion? I have nothing against that. :-)

I told FF to Never Remember History and FF agreed, so there's no ambivalence from me about old vs. new history. I don't want the history. Period. And FF promised it would forget. So it's supposed to, or the command should be renamed, or an explicit option to preserve the old should be provided. If the option is not exercised, then deletion should be immediate, total, and irrecoverable. If forgetting is potentially too slow, a solution is to put everything that would be in that history into a folder as the item is created. For example, when a URL is visited, the URL would be written only into that directory (and only momentarily read from there to anywhere else it's wanted). Then, when all is done, deleting requires only deleting or emptying the folder (and, if the operating system allows a choice, not trashing but irrevocably deleting). Then it won't be necessary to rewrite files. Deleting is probably faster than rewriting files. I tested deletion speed by copying a folder within my hard drive; it contained 648 items totalling 52.2 MB, which would be equivalent to more cookies than almost any individual user has at one time (an organizational server may have more, but those servers are likely faster than my laptop). Unrecoverable deletion took about one second. When I made about nine of those folders with the same contents, unrecoverable deletion took about one second per folder. Trashing two such folders was almost instantaneous; emptying the trash to unrecoverability took about two seconds. On a server, high-volume trash emptying can be automatically done at intervals, such as with a cron job. This kind of time frame is not too long during a restart or shutdown. For the unusual case where it is too slow, an option can offer deletion only on request, in a manner to support cron or some such.

Re comment 28 (mine): See also bug 1201354.