3 ms·

Just about everything you said there is wrong. Hey, don’t get me wrong: if you enjoy 10.15’s tedious security-theatre crap then knock yourself out. But you are

by hhas01 7y ago

Just about everything you said there is wrong. Hey, don’t get me wrong: if you enjoy 10.15’s tedious security-theatre crap then knock yourself out. But you are not qualified to dictate what other users need or want to do; only they are. Like Apple, you are thinking App-centrically. Stop. Apps are not the center of the users’ universe. The users’ own tasks are. Therefore you need to think task-centrically—i.e. What does the user need/want to do?—and structure your security model to enable and support that.

artimaeis 7y ago
You're right that tasks are the center of the user's universe. But it's generally not tasks that infect a device with malware. It's malicious applications that do that. This is the case on _every_ OS that lets users install applications. So, how can we make sure users doing tasks aren't afflicted by applications that want to sneak in? You're saying to "structure a security model differently" leads me to think maybe users shouldn't have admin access on the machine? But then you get all the critiques people have of iOS. I'm honestly asking, what's the alternative here?
- hhas01 7y ago
  See my other post here. There will always be desktop malware; what really matters is that it is contained and has no access to sensitive information. Locking down the entire UX doesn’t work because day-to-day operations become onerous while the constant spew of “Are you sure?” dialogs teaches users to click OK without thinking. Instead, put the sensitive stuff into its own “secure desktop”, and police all movements between that and the “standard desktop”. Even stick in an “unsafe desktop” for doing risky stuff, and encourage users to install new/untrusted software there; e.g. let them install and run anything without nagging, but keep apps completely sandboxed. Boundaries should be clearly delimited, e.g. give the high-security desktop its own window chrome and fixed background image that can’t be mimicked on the others. It’s deliberately coarse-grained, unlike the current mess, and that’s the point. That makes it easy for users to mentally model and match scopes to tasks, and limits nagging to where it really matters: when crossing scope boundaries with data in tow. Simply switching scopes and working within a scope should not nag, however. Look, I’m not saying it’s guaranteed to work. But at least I’m thinking about it from the point of view of end-users, not vendor developers and lawyers. It’d need prototyped and tested in both lab and real world, and sure as guns users will discover exciting new ways to screw things up; which means learning and adapting to account for that. But that’s UX. Either do it right, or go get a job flipping burgers where the worst you’ll do is hospitalize a few dozen locals with E. Coli. TWO BILLION now trust large chunks of their lives to their “personal” machines. That is a lot of people to screw up.

by hhas01 7y ago

artimaeis 7y ago

You're right that tasks are the center of the user's universe. But it's generally not tasks that infect a device with malware. It's malicious applications that do that. This is the case on _every_ OS that lets users install applications. So, how can we make sure users doing tasks aren't afflicted by applications that want to sneak in? You're saying to "structure a security model differently" leads me to think maybe users shouldn't have admin access on the machine? But then you get all the critiques people have of iOS. I'm honestly asking, what's the alternative here?

hhas01 7y ago
See my other post here. There will always be desktop malware; what really matters is that it is contained and has no access to sensitive information. Locking down the entire UX doesn’t work because day-to-day operations become onerous while the constant spew of “Are you sure?” dialogs teaches users to click OK without thinking. Instead, put the sensitive stuff into its own “secure desktop”, and police all movements between that and the “standard desktop”. Even stick in an “unsafe desktop” for doing risky stuff, and encourage users to install new/untrusted software there; e.g. let them install and run anything without nagging, but keep apps completely sandboxed. Boundaries should be clearly delimited, e.g. give the high-security desktop its own window chrome and fixed background image that can’t be mimicked on the others. It’s deliberately coarse-grained, unlike the current mess, and that’s the point. That makes it easy for users to mentally model and match scopes to tasks, and limits nagging to where it really matters: when crossing scope boundaries with data in tow. Simply switching scopes and working within a scope should not nag, however. Look, I’m not saying it’s guaranteed to work. But at least I’m thinking about it from the point of view of end-users, not vendor developers and lawyers. It’d need prototyped and tested in both lab and real world, and sure as guns users will discover exciting new ways to screw things up; which means learning and adapting to account for that. But that’s UX. Either do it right, or go get a job flipping burgers where the worst you’ll do is hospitalize a few dozen locals with E. Coli. TWO BILLION now trust large chunks of their lives to their “personal” machines. That is a lot of people to screw up.