3 ms·

I feel like having a big scary warning would be sufficient instead of making it inconvenient. It's easy for a competent user to ignore a warning that they fully

I feel like having a big scary warning would be sufficient instead of making it inconvenient. It's easy for a competent user to ignore a warning that they fully understand while it scares off those that are clueless.

scarface74 7y ago
People ignore warnings - they have since the dawn of personal computers. You remember Vista UAC? Why optimize for the 1% instead of the 99%?
- wutbrodo 7y ago
  UAC was simultaneously seemingly ubiquitous and not a particularly "scary" warning. It just sounded like bland computer jargon to the uninformed. I was envisioning something like the https warnings that Chrome gives: a clear warning sign that uses emotionally loaded terms like "go back to safety" and hides the proceed link under the fold. That being said, it's entirely possible that I'm overestimating the intelligence of the average user and that many of them wouldn't blink even in the face of a warning made up to look scary.
stordoff 7y ago
It's also easy to ignore a warning you don't understand. I know from helping family they don't particularly care what warnings say - they have work to do, and they do know clicking OK makes it go away.
aswan 7y ago
The issue isn't about having a sufficiently scary warning. It is that the browser has to store the fact that the user has agreed to this warning somewhere (ie, presumably in the user's profile). That means any other software running on the computer with regular user permissions can make the same modification to the profile and then install an unsigned extension without the user's consent. Typically, when Mozilla finds out about software installing extensions without user consent, the extension is added to the blocklist, but if the extension is unsigned it can just claim that it is ublock origin or adblock plus or some popular extension, leaving no practical way to block it. This is described in greater detail at https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/ https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte... (in full disclosure, I am a Mozilla employee)
- wutbrodo 7y ago
  Ah thanks, that's useful context. I was responding primarily to the claim that convolutedness is necessary to protect unsophisticated users, which I interpreted as meaning that the complexity of the UI scares users off. But this is a separate technical limitation that makes a lot of sense.

scarface74 7y ago

People ignore warnings - they have since the dawn of personal computers. You remember Vista UAC? Why optimize for the 1% instead of the 99%?

wutbrodo 7y ago
UAC was simultaneously seemingly ubiquitous and not a particularly "scary" warning. It just sounded like bland computer jargon to the uninformed. I was envisioning something like the https warnings that Chrome gives: a clear warning sign that uses emotionally loaded terms like "go back to safety" and hides the proceed link under the fold. That being said, it's entirely possible that I'm overestimating the intelligence of the average user and that many of them wouldn't blink even in the face of a warning made up to look scary.

stordoff 7y ago

It's also easy to ignore a warning you don't understand. I know from helping family they don't particularly care what warnings say - they have work to do, and they do know clicking OK makes it go away.

aswan 7y ago

The issue isn't about having a sufficiently scary warning. It is that the browser has to store the fact that the user has agreed to this warning somewhere (ie, presumably in the user's profile). That means any other software running on the computer with regular user permissions can make the same modification to the profile and then install an unsigned extension without the user's consent. Typically, when Mozilla finds out about software installing extensions without user consent, the extension is added to the blocklist, but if the extension is unsigned it can just claim that it is ublock origin or adblock plus or some popular extension, leaving no practical way to block it. This is described in greater detail at https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/ https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte... (in full disclosure, I am a Mozilla employee)

wutbrodo 7y ago
Ah thanks, that's useful context. I was responding primarily to the claim that convolutedness is necessary to protect unsophisticated users, which I interpreted as meaning that the complexity of the UI scares users off. But this is a separate technical limitation that makes a lot of sense.