5 ms·

I've been developing and releasing consumer software for a few years now, and the key rule about popup messages is: Nobody reads them. A significant number of

I've been developing and releasing consumer software for a few years now, and the key rule about popup messages is: Nobody reads them. A significant number of users will, upon seeing any kind of message that does not mean something totally obvious to them (as a non-techie), just click cancel. Either they panic or they don't understand or they don't care. For example our software used to have a particular kind of error that as clearly as possible stated that it could be solved by visiting a URL and installing some update. Cue lots of support messages: "I see some error, what do I do?" Browsers are consumer software. If it asks "this webpage wants to use your camera", that's just about obvious enough. However if it asks "this webpage wants to run plugins", user thinks "WTF are plugins" and presses cancel, then wonders why their video is not playing. (Reasonable question from the user's perspective: why didn't the browser say "this webpage wants to play video"?) If it asks "this webpage wants to access your WebGL renderer string" or "this webpage wants to know your hardware information" or something, the user thinks "WTF" and presses cancel, then Google Maps can't work around a graphics driver bug on their system and the map glitches up. So as far as is possible, consumer software should not prompt the user for anything, and if it does, it should be totally obvious to someone with little to no technical knowledge.

amelius 10y ago
You are generalizing. Perhaps some users do care about what a popup says?
- softawre 10y ago
  He explained clearly that a browser is "consumer software". That is generic software. If you're writing an application where your users care about what a popup says, then you should use them.
- Throwaway23412 10y ago
  I think you missed the point of his comment. It's not merely that users don't care. It's that most users don't even understand what a popup is saying. The average user doesn't know what a cookie or a plugin is.
  - pdkl95 10y ago
    That kind of misunderstanding is the fault of the speaker, not the listener. The current paternalistic trend of removing agency from the user and making choices for them is lazy and perpetuates ignorance. Write better popups that do a better job explaining the problem, educating the user, and expressing the necessary information so the user can make an informed choice.
    - Jemmeh 10y ago
      A good explanation doesn't matter-- users frequently don't even read the message. They just hit the button, because they just want to get on to whatever it is they want to be doing.
- onion2k 10y ago
  You are generalizing. Perhaps some users do care about what a popup says? The point is that if the browser asks for permissions and the majority (or even just a significant minority really) say no because they don't understand the question then it has a tremendously negative impact on every application that could be built using that browser feature. It's better for progress if browser vendors make an intelligent call when and where browser's let applications access things. Personally I'd rather browsers did ask permission, but in a way that affords application developers a way to explain why they need access. The difficulty would be how to stop rogue apps trying to scare users in to accepting things.
  - drdaeman 10y ago
    > but in a way that affords application developers a way to explain why they need access I think this just won't work. Most developers will end up with "need this to work correctly" excuse and proceed in all-or-nothing manner. Maybe with a small room for compromise, but not much. Heck, we already have this quite common with OAuth, when many sites ask you for your name, your contact/friends list, permission to post on your behalf and your first newborn's soul - in "grant all of this or go away" manner. This will only continue the unnerving trend to train common users to mindlessly agree to whatever they're asked (already happened to license agreements, didn't it?) for because they'll be continuously told that it's "necessary". https://news.ycombinator.com/item?id=12026876 https://news.ycombinator.com/item?id=12026876
    - ryandrake 10y ago
      Sad but true. My guess is that if the alternative to "run the site/app letting it violate your privacy" is "run the site/app, NOT letting it violate your privacy", users will choose the second one. If the alternative is GTFO, they'll just run the app fully exposed.
      - drdaeman 10y ago
        Actually, there's the third option - heavy sandboxing with privilege spoof. Let the app think it gets access to all it wants. E.g. fake battery stats, never ringing buzzer, empty or fake contact list, throwaway email address, geolocation in random place (around the world or city of user's choice), random per-installation device IDs, etc.
allsystemsgo 10y ago
> I've been developing and releasing consumer software for a few years now, and the key rule about popup messages is: Nobody reads them. Really? For mobile applications, users are very wary of them. Granted, they can't do anything until they either accept or deny location (or whatever other thing the app is asking for) data. It'd take getting used to but, I think it'd be something users would appreciate long term.
- AshleysBrain 10y ago
  I should have specified - we build desktop software! But I think the principle of "don't ask the user questions they can't answer" still stands.
apatters 10y ago
This comment reflects a general philosophy of making things as simple as possible in consumer UX for the past 10-20 years. That principle is generally sound and arises from a problem where UI was being created by developers for developers, and as a result was often needlessly complicated and obtuse. Businesses realized that simpler UI geared toward less technical users could expand their markets as well as increase user engagement. Taking this philosophy to the extreme, however, has led to problems. At its most draconian, the implementation of "simpler is always better" results in features being removed or never implemented, walled gardens being created, and the gradual erosion of the general purpose computer. No it's probably not the right mass market UX, but I am TOTALLY down for a browser which asks me, "This site wants to access (insert some data about me like my browsing habits, Facebook account ID, or stuff that contributes to a unique browser footprint). Allow or disallow?" and then lets me say NO. So I don't want to dismiss the idea that simpler is better: for mass market UX designed to reach as many users as possible, this is a key principle. But at the same time I believe we need to start considering the fact that in UX one size might not fit all, even when it may not maximize corporate profits. Maybe shipping your software with a 'developer mode' toggle is the right way to do it!
- ryandrake 10y ago
  > Maybe shipping your software with a 'developer mode' toggle is the right way to do it! Well, Firefox's incognito mode goes in the right direction. It's nice to be able to put the browser in a mode where it does the right thing without prompting (where right = respects the user's privacy by default). It would be even better if incognito mode was the default and instead users had to go out of their way to put their browser into "unsafe mode" in order to expose all these nasty bits to web sites.
  - AshleysBrain 10y ago
    Yeah, I think locking down the private browsing/incognito modes is a good compromise. Things like the battery level, WebGL render string etc. (anything that can be used to improve tracking) could return fake data in incognito mode, but real data in normal mode. IMO that's the best compromise between "keep my information private" and "things work usefully by default". I don't know if browsers already do that though?
ryandrake 10y ago
Not only do users not read pop-ups, but the more words you put on them, the less likely it is they'll read. The browser should 1. if at all possible make the best* choice for the user by default, 2. provide a setting somewhere power users go so they can change that choice. Popping up a dialog should be like punting--do it only when no other options are sufficient. * Obviously what's "best" is the tricky part

amelius 10y ago

You are generalizing. Perhaps some users do care about what a popup says?

softawre 10y ago
He explained clearly that a browser is "consumer software". That is generic software. If you're writing an application where your users care about what a popup says, then you should use them.
Throwaway23412 10y ago
I think you missed the point of his comment. It's not merely that users don't care. It's that most users don't even understand what a popup is saying. The average user doesn't know what a cookie or a plugin is.
- pdkl95 10y ago
  That kind of misunderstanding is the fault of the speaker, not the listener. The current paternalistic trend of removing agency from the user and making choices for them is lazy and perpetuates ignorance. Write better popups that do a better job explaining the problem, educating the user, and expressing the necessary information so the user can make an informed choice.
  - Jemmeh 10y ago
    A good explanation doesn't matter-- users frequently don't even read the message. They just hit the button, because they just want to get on to whatever it is they want to be doing.
onion2k 10y ago
You are generalizing. Perhaps some users do care about what a popup says? The point is that if the browser asks for permissions and the majority (or even just a significant minority really) say no because they don't understand the question then it has a tremendously negative impact on every application that could be built using that browser feature. It's better for progress if browser vendors make an intelligent call when and where browser's let applications access things. Personally I'd rather browsers did ask permission, but in a way that affords application developers a way to explain why they need access. The difficulty would be how to stop rogue apps trying to scare users in to accepting things.
- drdaeman 10y ago
  > but in a way that affords application developers a way to explain why they need access I think this just won't work. Most developers will end up with "need this to work correctly" excuse and proceed in all-or-nothing manner. Maybe with a small room for compromise, but not much. Heck, we already have this quite common with OAuth, when many sites ask you for your name, your contact/friends list, permission to post on your behalf and your first newborn's soul - in "grant all of this or go away" manner. This will only continue the unnerving trend to train common users to mindlessly agree to whatever they're asked (already happened to license agreements, didn't it?) for because they'll be continuously told that it's "necessary". https://news.ycombinator.com/item?id=12026876 https://news.ycombinator.com/item?id=12026876
  - ryandrake 10y ago
    Sad but true. My guess is that if the alternative to "run the site/app letting it violate your privacy" is "run the site/app, NOT letting it violate your privacy", users will choose the second one. If the alternative is GTFO, they'll just run the app fully exposed.
    - drdaeman 10y ago
      Actually, there's the third option - heavy sandboxing with privilege spoof. Let the app think it gets access to all it wants. E.g. fake battery stats, never ringing buzzer, empty or fake contact list, throwaway email address, geolocation in random place (around the world or city of user's choice), random per-installation device IDs, etc.

allsystemsgo 10y ago

> I've been developing and releasing consumer software for a few years now, and the key rule about popup messages is: Nobody reads them. Really? For mobile applications, users are very wary of them. Granted, they can't do anything until they either accept or deny location (or whatever other thing the app is asking for) data. It'd take getting used to but, I think it'd be something users would appreciate long term.

AshleysBrain 10y ago
I should have specified - we build desktop software! But I think the principle of "don't ask the user questions they can't answer" still stands.

apatters 10y ago

This comment reflects a general philosophy of making things as simple as possible in consumer UX for the past 10-20 years. That principle is generally sound and arises from a problem where UI was being created by developers for developers, and as a result was often needlessly complicated and obtuse. Businesses realized that simpler UI geared toward less technical users could expand their markets as well as increase user engagement. Taking this philosophy to the extreme, however, has led to problems. At its most draconian, the implementation of "simpler is always better" results in features being removed or never implemented, walled gardens being created, and the gradual erosion of the general purpose computer. No it's probably not the right mass market UX, but I am TOTALLY down for a browser which asks me, "This site wants to access (insert some data about me like my browsing habits, Facebook account ID, or stuff that contributes to a unique browser footprint). Allow or disallow?" and then lets me say NO. So I don't want to dismiss the idea that simpler is better: for mass market UX designed to reach as many users as possible, this is a key principle. But at the same time I believe we need to start considering the fact that in UX one size might not fit all, even when it may not maximize corporate profits. Maybe shipping your software with a 'developer mode' toggle is the right way to do it!

ryandrake 10y ago
> Maybe shipping your software with a 'developer mode' toggle is the right way to do it! Well, Firefox's incognito mode goes in the right direction. It's nice to be able to put the browser in a mode where it does the right thing without prompting (where right = respects the user's privacy by default). It would be even better if incognito mode was the default and instead users had to go out of their way to put their browser into "unsafe mode" in order to expose all these nasty bits to web sites.
- AshleysBrain 10y ago
  Yeah, I think locking down the private browsing/incognito modes is a good compromise. Things like the battery level, WebGL render string etc. (anything that can be used to improve tracking) could return fake data in incognito mode, but real data in normal mode. IMO that's the best compromise between "keep my information private" and "things work usefully by default". I don't know if browsers already do that though?

ryandrake 10y ago

Not only do users not read pop-ups, but the more words you put on them, the less likely it is they'll read. The browser should 1. if at all possible make the best* choice for the user by default, 2. provide a setting somewhere power users go so they can change that choice. Popping up a dialog should be like punting--do it only when no other options are sufficient. * Obviously what's "best" is the tricky part