7 ms·

I don't get it. It's a site designed for public sharing -- the word "showcase" is right on the front page, as username223 points out. I just loaded it up and wa

by cwyers 10y ago

I don't get it. It's a site designed for public sharing -- the word "showcase" is right on the front page, as username223 points out. I just loaded it up and walked through uploading a file to it. It's incredibly explicit about what it's doing. Under "Visibility," it says: "Public on the web Anyone can find it on the web. Search engines will find the doc, giving it a larger audience." It's not unambiguous. It's very clear. The only way you can't tell what it's doing is if you just pay no attention whatsoever to what you're doing. It's not the default sharing method from either Office 365 (web, traditional or Android/iOS) or OneDrive. You have to opt into using it at all at an IT department level if you have a corporate Office 365 department. You really just can't stop users from footgunning themselves when they're on the open Internet.

richforrester 10y ago
Yes. And no. It is very clear, to you. To me. To other people? The evidence doesn't support that claim. So again: was it clear enough? Apparently not. You can argue about this as long as you want, but interpretation of an interface is not complete until you get the context. Ours is that of someone who's either looking for it, or aware of the possibility of its existence. If you're neither, perhaps you'd need to be able to see other people's documents as well. Perhaps you need a big ol' warning sign with tick-boxes before you dismiss it. Maybe the default should be hidden, and sharing made optional. I realise this doesn't make much sense for a "sharing" feature, but maybe it's been labelled wrong. "Sharing" doesn't necessarily (read: "by definition") mean "everyone in the whole world can browse your stuff". So imo, two parties to blame. Yes. It's the user's own fault. No. It's not clear enough.
- cwyers 10y ago
  > It is very clear, to you. To me. To most other people? The evidence doesn't support that claim. I'm not sure that's clear? The headline says "hundreds" of sensitive documents are on there. How many documents are on there total?
  - richforrester 10y ago
    I'll remove the word "most". Point holds.
    - cwyers 10y ago
      Okay, but what's the acceptable defect rate for users not being able to understand the UI? Because I don't think it's possible to design a UI so unambiguous that a user, no matter how determined, cannot manage to misunderstand it.
      - iamben 10y ago
        Surely the acceptable rate depends on the system? A UI defect in something that could launch missiles, for instance, would be a disaster. As for the design here - how about a big red banner with "by ticking here this document will be available to the public and can be found through search engines" or similar?
        kalleboo 10y ago
        Anyone given access to a missile system will also be trained in it's usage, so the bar for usability of a missile system is much lower (e.g., it can assume knowledge of military terminology)
        richforrester 10y ago
        Doesn't mean less care should be given to the interface. Doesn't mean they aren't subject to the monotony of repeating actions each and every day. While they should be able to react quickly, I'm also sure that they have to switch to "able to react quickly mode", and won't always be ready to launch missiles at the push of a single button!
      - intopieces 10y ago
        >but what's the acceptable defect rate for users not being able to understand the UI? Acceptable defect rate is the defect rate that does not result in an Ars article pointing out the defect rate of your product.
alphabettsy 10y ago
There are Public, Limited, and Organizational visibility options, the Public option should have a clear enough warning and not be the default.
- cwyers 10y ago
  That would sort of defeat the point of having a site designed around public sharing, wouldn't it? It doesn't seem like good UI to have the default be something other than what the typical usecase for the UI is supposed to be.
  - alphabettsy 10y ago
    I'm not sure how requiring an explicit change from private to public would create an undue burden, also it would most likely reduce the potential harm that certainly comes from unintentionally publicly sharing something. Assuming a particular number of users are going to be too stupid, careless or rushed to set the privacy option, I think I'd err on the side of caution. What's worse: Not having the document available to all, but accessible by the link? or having the document available to all and the link unwittingly? It is of course the users fault, but that doesn't mean the devs can't take extra steps when a flaw is pointed out.
    - jzwinck 10y ago
      The worst for the owners of the sharing site would be for the site to fail in the marketplace because grandma couldn't figure out how to share her photos with her grandkids and gave up on it. Some people would benefit from more safety features but nobody wants to ride in a car with a full roll cage and a helmet.
      - alphabettsy 10y ago
        Well it's not a photo sharing site, it's a document sharing site under the MS Office branding. Funny you should bring up auto safety when we've now got at least 4-6, and sometimes as many as 13 airbags in the average new car despite the fact they'll often never be used, and all because of the drivers. Certainly lane departure and collision avoidance systems aren't there for the people using vehicles properly.
ams6110 10y ago
> The only way you can't tell what it's doing is if you just pay no attention whatsoever to what you're doing. You've just described a very common type of non-technical user.
- jamescostian 10y ago
  In my experience, the least technical users are the ones who read more than the rest of us. While I just want to click the "Next" button or whatever is in its place until something like "Cancel" takes its place, my grandpa wants to read every word to make sure everything is happening correctly, and even asks me questions about what the words mean. He doesn't like to proceed until he's sure that everything will work just the way he wants it. As GP said, users got a very obvious warning. It's not like there was a 1000-word long essay greyed out which contained the words "oh and this is all public" in a random location. This isn't about how technical users are, it's just a user error that anyone could make. I would be extremely surprised if you told me that, for example, there are less than a hundred Google Docs with sensitive information that are publicly viewable. In fact, I would probably call anyone above the age of 20 a liar if they said that during their entire life they had never, ever shared something they didn't mean to share. Even when it comes to things we're very familiar with, like our own mouths, we sometimes share more than we intend to.
  - croon 10y ago
    Sure, but for every user like you, there are 5 users that think they are like you, only less pattern recognizing and keep pressing "Next" even when it installs trojans/searchbars/uploads stuff publicly/etc.
  - lucideer 10y ago
    It seems like it should be this way, but I've often found another level of cautious user. My mother has stopped using her computer for a week while waiting for me to come visit so I could tell her how to proceed past a popup she hasn't read. Typically, I'll come home, she'll ask me to help her with a problem, show me the popup and ask me what she should do next. I'll instruct her to read it, which she hasn't yet, and then once she does, she'll make a decision and ask me if it's the correct course of action before proceeding. I think generally non-technical users are just pretty diverse, and I'd wager there's more non-readers than readers... That said, in this case, I'm not sure what more MS can do beyond simply not offering this service.
Spooky23 10y ago
When we deployed O365 to 100k+ people, we ran into a few things like this. A big one was the meaning of "everyone" in OneDrive. Many people thought that it meant "everyone on my team", and posted all sorts of wacky stuff.
- bigger_cheese 10y ago
  My work switched pretty recently (December last year) that is one thing I've noticed that has really annoyed me is that all the Office apps have One Drive set as the default location to save anything. I've never used One Drive, I don't want to use One Drive but every time I hit save in word or excel it defaults to "One Drive" I have to physically click "This PC" button and browse to my local disk to save a copy locally every single time. No one in my building uses one drive, no one asked for one drive but Microsoft keeps trying to shove it down our throats. It feels like an anti-pattern like the forced windows 10 "upgrade" for home users. According to word I have Office 365 ProPlus version - I note there is no option to save to docs.com.
  - nu5500 10y ago
    I am curious what your resistance is to OneDrive. Personally, I try to put as much in there as I can as I frequently switch machines that I am working on. I keep my work code in there as well (Git repo and all) and it's convenient when switching between VMs or when needing to wipe my workstation and start fresh. I encounter many co-workers though who like to do things "the old way" and just email copies of documents around and then spend time merging them back together instead of sending a link to their OneDrive. Just more files for me to juggle on my computer. No thanks.
    - bigger_cheese 10y ago
      There are a few reasons, partly because of corporate policy which says no sensitive documents on cloud. Partly because I need to access stuff offline so prefer to have a local copy. For example if I have to take my laptop travelling with between sites I may not have access to a internet connection. Your right that a large part is familiarity - we use Sharepoint (which I also hate) to share documents between teams rather than email.
walrus01 10y ago
I have unfortunate news for you: If you read http://reddit.com/r/talesfromtechsupport http://reddit.com/r/talesfromtechsupport , you will very quickly learn how much attention the ordinary corporate PC user pays for warnings and error messages. I don't ordinarily link to reddit, but the stories on that page are the perfect illustration of just how blissfully ignorant and clueless many people are.

by cwyers 10y ago

richforrester 10y ago

Yes. And no. It is very clear, to you. To me. To other people? The evidence doesn't support that claim. So again: was it clear enough? Apparently not. You can argue about this as long as you want, but interpretation of an interface is not complete until you get the context. Ours is that of someone who's either looking for it, or aware of the possibility of its existence. If you're neither, perhaps you'd need to be able to see other people's documents as well. Perhaps you need a big ol' warning sign with tick-boxes before you dismiss it. Maybe the default should be hidden, and sharing made optional. I realise this doesn't make much sense for a "sharing" feature, but maybe it's been labelled wrong. "Sharing" doesn't necessarily (read: "by definition") mean "everyone in the whole world can browse your stuff". So imo, two parties to blame. Yes. It's the user's own fault. No. It's not clear enough.

cwyers 10y ago
> It is very clear, to you. To me. To most other people? The evidence doesn't support that claim. I'm not sure that's clear? The headline says "hundreds" of sensitive documents are on there. How many documents are on there total?
- richforrester 10y ago
  I'll remove the word "most". Point holds.
  - cwyers 10y ago
    Okay, but what's the acceptable defect rate for users not being able to understand the UI? Because I don't think it's possible to design a UI so unambiguous that a user, no matter how determined, cannot manage to misunderstand it.
    - iamben 10y ago
      Surely the acceptable rate depends on the system? A UI defect in something that could launch missiles, for instance, would be a disaster. As for the design here - how about a big red banner with "by ticking here this document will be available to the public and can be found through search engines" or similar?
      - kalleboo 10y ago
        Anyone given access to a missile system will also be trained in it's usage, so the bar for usability of a missile system is much lower (e.g., it can assume knowledge of military terminology)
        richforrester 10y ago
        Doesn't mean less care should be given to the interface. Doesn't mean they aren't subject to the monotony of repeating actions each and every day. While they should be able to react quickly, I'm also sure that they have to switch to "able to react quickly mode", and won't always be ready to launch missiles at the push of a single button!
    - intopieces 10y ago
      >but what's the acceptable defect rate for users not being able to understand the UI? Acceptable defect rate is the defect rate that does not result in an Ars article pointing out the defect rate of your product.

alphabettsy 10y ago

There are Public, Limited, and Organizational visibility options, the Public option should have a clear enough warning and not be the default.

cwyers 10y ago
That would sort of defeat the point of having a site designed around public sharing, wouldn't it? It doesn't seem like good UI to have the default be something other than what the typical usecase for the UI is supposed to be.
- alphabettsy 10y ago
  I'm not sure how requiring an explicit change from private to public would create an undue burden, also it would most likely reduce the potential harm that certainly comes from unintentionally publicly sharing something. Assuming a particular number of users are going to be too stupid, careless or rushed to set the privacy option, I think I'd err on the side of caution. What's worse: Not having the document available to all, but accessible by the link? or having the document available to all and the link unwittingly? It is of course the users fault, but that doesn't mean the devs can't take extra steps when a flaw is pointed out.
  - jzwinck 10y ago
    The worst for the owners of the sharing site would be for the site to fail in the marketplace because grandma couldn't figure out how to share her photos with her grandkids and gave up on it. Some people would benefit from more safety features but nobody wants to ride in a car with a full roll cage and a helmet.
    - alphabettsy 10y ago
      Well it's not a photo sharing site, it's a document sharing site under the MS Office branding. Funny you should bring up auto safety when we've now got at least 4-6, and sometimes as many as 13 airbags in the average new car despite the fact they'll often never be used, and all because of the drivers. Certainly lane departure and collision avoidance systems aren't there for the people using vehicles properly.

ams6110 10y ago

> The only way you can't tell what it's doing is if you just pay no attention whatsoever to what you're doing. You've just described a very common type of non-technical user.

jamescostian 10y ago
In my experience, the least technical users are the ones who read more than the rest of us. While I just want to click the "Next" button or whatever is in its place until something like "Cancel" takes its place, my grandpa wants to read every word to make sure everything is happening correctly, and even asks me questions about what the words mean. He doesn't like to proceed until he's sure that everything will work just the way he wants it. As GP said, users got a very obvious warning. It's not like there was a 1000-word long essay greyed out which contained the words "oh and this is all public" in a random location. This isn't about how technical users are, it's just a user error that anyone could make. I would be extremely surprised if you told me that, for example, there are less than a hundred Google Docs with sensitive information that are publicly viewable. In fact, I would probably call anyone above the age of 20 a liar if they said that during their entire life they had never, ever shared something they didn't mean to share. Even when it comes to things we're very familiar with, like our own mouths, we sometimes share more than we intend to.
- croon 10y ago
  Sure, but for every user like you, there are 5 users that think they are like you, only less pattern recognizing and keep pressing "Next" even when it installs trojans/searchbars/uploads stuff publicly/etc.
- lucideer 10y ago
  It seems like it should be this way, but I've often found another level of cautious user. My mother has stopped using her computer for a week while waiting for me to come visit so I could tell her how to proceed past a popup she hasn't read. Typically, I'll come home, she'll ask me to help her with a problem, show me the popup and ask me what she should do next. I'll instruct her to read it, which she hasn't yet, and then once she does, she'll make a decision and ask me if it's the correct course of action before proceeding. I think generally non-technical users are just pretty diverse, and I'd wager there's more non-readers than readers... That said, in this case, I'm not sure what more MS can do beyond simply not offering this service.

Spooky23 10y ago

When we deployed O365 to 100k+ people, we ran into a few things like this. A big one was the meaning of "everyone" in OneDrive. Many people thought that it meant "everyone on my team", and posted all sorts of wacky stuff.

bigger_cheese 10y ago
My work switched pretty recently (December last year) that is one thing I've noticed that has really annoyed me is that all the Office apps have One Drive set as the default location to save anything. I've never used One Drive, I don't want to use One Drive but every time I hit save in word or excel it defaults to "One Drive" I have to physically click "This PC" button and browse to my local disk to save a copy locally every single time. No one in my building uses one drive, no one asked for one drive but Microsoft keeps trying to shove it down our throats. It feels like an anti-pattern like the forced windows 10 "upgrade" for home users. According to word I have Office 365 ProPlus version - I note there is no option to save to docs.com.
- nu5500 10y ago
  I am curious what your resistance is to OneDrive. Personally, I try to put as much in there as I can as I frequently switch machines that I am working on. I keep my work code in there as well (Git repo and all) and it's convenient when switching between VMs or when needing to wipe my workstation and start fresh. I encounter many co-workers though who like to do things "the old way" and just email copies of documents around and then spend time merging them back together instead of sending a link to their OneDrive. Just more files for me to juggle on my computer. No thanks.
  - bigger_cheese 10y ago
    There are a few reasons, partly because of corporate policy which says no sensitive documents on cloud. Partly because I need to access stuff offline so prefer to have a local copy. For example if I have to take my laptop travelling with between sites I may not have access to a internet connection. Your right that a large part is familiarity - we use Sharepoint (which I also hate) to share documents between teams rather than email.

walrus01 10y ago

I have unfortunate news for you: If you read http://reddit.com/r/talesfromtechsupport http://reddit.com/r/talesfromtechsupport , you will very quickly learn how much attention the ordinary corporate PC user pays for warnings and error messages. I don't ordinarily link to reddit, but the stories on that page are the perfect illustration of just how blissfully ignorant and clueless many people are.