tools/metrics/histograms/histograms.xml

Index: tools/metrics/histograms/histograms.xml
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index a8e775366dbdec09a4589d952ea86135511b7f11..07e0db582fa2fb69c07d1314338b59f68d9096e8 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -48045,6 +48045,18 @@ Therefore, the affected-histogram name has to have at least one dot in it.
 <enum name="SSLNonAttackCauses" type="int">
   <int value="0" label="CLOCK_PAST: System clock set early"/>
   <int value="1" label="CLOCK_FUTURE: System clock set late"/>
+  <int value="2"

[Mark P, 2014/08/05 22:07:27]

How where these buckets evaluated in the past?  Were these conditions simply not
emitted previously?


Also, I'd mildly encourage you to rename the histogram, lest four months down
the line you wonder why these types of failure modes are suddenly increasing and
why clock errors are a decreasing percentage of total errors.

[radhikabhar, 2014/08/06 00:10:18]

These buckets weren't evaluated in the past but these conditions were emitted
previously.

Done - renamed the histogram

[felt, 2014/08/06 01:00:24]

Wait, please don't rename my histogram. Mark, why do you say Radhika needs to
rename the histogram?

[felt, 2014/08/06 19:32:36]

HiOn 2014/08/06 01:00:24, felt wrote:
I don't understand the first part of your comment. Maybe this will clear it up.
Two of the conditions were emitted previously (the ones I added) and the others
were not (this CL adds them). The relative frequency in the histogram doesn't
matter because the math is done (condition)/(all SSL errors), and all SSL errors
is recorded in a different counter. This histogram was intended to expand.

[Mark P, 2014/08/06 20:19:28]

Then this should be explained in the (two) histogram descriptions.  The
description should clearly point to the "all SSL errors" histogram and remark
that many errors are not reported in this particular histogram, and that new
errors have been added to this histogram over time so one should not look the
breakdown of this histogram (one bucket divided by the sum) because that would
be misleading and inaccurate.

+      label="WWW_SUBDOMAIN_MATCH: Difference between the URL and the DNS is
+             www"/>
+  <int value="3" label="SUBDOMAIN_MATCH: The URL is a subdomain of the DNS"/>
+  <int value="4"
+      label="SUBDOMAIN_INVERSE_MATCH: The DNS is a subdomian of the URL"/>
+  <int value="5"
+      label="SUBDOMAIN_OUTSIDE_WILDCARD: The URL is outside the scope of the
+             wildcard certificate"/>

[Mark P, 2014/08/05 22:07:27]

Am I correct in assuming this will only be emitted for certificates that use
wildcards?

What are the priority of these errors?  I can imagine multiple of these errors
occur on the same certificate.  Hopefully you can put something here or in the
description that clarifies which errors get counted when.

[radhikabhar, 2014/08/06 00:10:18]

We haven't prioritized the errors and the SUBDOMIAN_OUTSIDE_WILDCARD is the only
error which is for wildcards and all these errors have been implemented such
that they are mutually exclusive. 
Before making changes, I just want to be sure - should I just add an example of
what each error is?

[Mark P, 2014/08/06 19:04:51]

I think you have implicitly.  For instance, the difference between the URL and
the DNS is www is also a case when URL is a subdomain of the DNS.  I assume
you're emitting to to the former bucket and not (also) the latter.

Likewise, I can imagine, say, self-signed certificates that also provide DNS
that's a subdomain of the URL.  You say "all these errors have been implemented
such that they are mutually exclusive" so clearly you have a rule that says in
that particular situation, only omit to, say, the latter bucket and not the
former.

This histogram should explain these rules about how you record errors that could
be categorized into multiple buckets.

+  <int value="6" label="SELF_SIGNED: The certificate is self_signed"/>
+  <int value="7"
+      label="HOST_NAME_NOT_KNOWN_TLD: The host name is not a known TLD"/>
 </enum>
 
 <enum name="SSLResponseTypesV2" type="int">