4 ms·

Very interesting article, although if the message displayed to the end-user really was left at "You are using an unsupported environment variable: SSLKEYLOGFILE

Very interesting article, although if the message displayed to the end-user really was left at "You are using an unsupported environment variable: SSLKEYLOGFILE..." that would be truly awful UX with some potentially disastrous consequences.

Ajedi32 7y ago
Why? What "disastrous" consequences are you envisioning from a message like that? Note that the rest of the message (the part you omitted) explains in plain English what the part you quoted means to the average user.
- 2T1Qka0rEiPr 7y ago
  Someone gets nefariously MITM'd and instead of giving the user an informative message, they're presented with something which means nothing to the lay-person.
  - Ajedi32 7y ago
    But as I said, the rest of the text on that bar clearly explains what the message means, in terms a layman can easily understand. Is there anything lost by _also_ including the technical information necessary to diagnose the problem?
    - 2T1Qka0rEiPr 7y ago
      You mean "stability and security will suffer"? Sorry I didn't exclude it to try to make my point more convincingly, I just missed it altogether. Assuming that's the part you meant, do you really think that is sufficient in explaining the situation to the user. I'm very unconvinced, my parents would have no idea what that means and just close the warning.
      - Epokhe 7y ago
        Well, your(and my) parents would download an .exe file to play Farmville and run it with admin privileges by clicking yes on the user account control popup. So, maybe a web browser is not the safest place for parents...
      - Ajedi32 7y ago
        Can the warning be closed? My assumption was that it's persistent. I agree the warning isn't as specific or actionable as perhaps it would be ideally, but seeing as the browser has no idea why the SSL keys are being logged (it could just be for debugging purposes) or how to fix it without breaking things further, I'm not sure what more it could say.
        2T1Qka0rEiPr 7y ago
        Yeh, I acknowledge it's a difficult problem to solve, but I think if you have messaging at all, it should probably be a lot clearer, and link to some kind of article explaining the situation (which could cover the legitimate use cases such as anti-virus usage etc.)

Ajedi32 7y ago

Why? What "disastrous" consequences are you envisioning from a message like that? Note that the rest of the message (the part you omitted) explains in plain English what the part you quoted means to the average user.

2T1Qka0rEiPr 7y ago
Someone gets nefariously MITM'd and instead of giving the user an informative message, they're presented with something which means nothing to the lay-person.
- Ajedi32 7y ago
  But as I said, the rest of the text on that bar clearly explains what the message means, in terms a layman can easily understand. Is there anything lost by _also_ including the technical information necessary to diagnose the problem?
  - 2T1Qka0rEiPr 7y ago
    You mean "stability and security will suffer"? Sorry I didn't exclude it to try to make my point more convincingly, I just missed it altogether. Assuming that's the part you meant, do you really think that is sufficient in explaining the situation to the user. I'm very unconvinced, my parents would have no idea what that means and just close the warning.
    - Epokhe 7y ago
      Well, your(and my) parents would download an .exe file to play Farmville and run it with admin privileges by clicking yes on the user account control popup. So, maybe a web browser is not the safest place for parents...
    - Ajedi32 7y ago
      Can the warning be closed? My assumption was that it's persistent. I agree the warning isn't as specific or actionable as perhaps it would be ideally, but seeing as the browser has no idea why the SSL keys are being logged (it could just be for debugging purposes) or how to fix it without breaking things further, I'm not sure what more it could say.
      - 2T1Qka0rEiPr 7y ago
        Yeh, I acknowledge it's a difficult problem to solve, but I think if you have messaging at all, it should probably be a lot clearer, and link to some kind of article explaining the situation (which could cover the legitimate use cases such as anti-virus usage etc.)