Checkboxes that kill your product

Re:Checkboxes that kill your product by tptacek on Monday March 18, 2013 @01:29PM (#5395692)

I think you're dragging the article to a conclusion it didn't try to make. For the love of god, he didn't say that software can't have "Advanced" options panels. He pointed out a series of specific options that were either ill-advised, overly accessible, or so unusable as to be hardly better than a properties file.

Firefox really does have an easily-reached config panel with "Use SSL 3.0" and "Use TLS 1.0" on it. What is the situation in which any user at your lab would know which of those options is sensible? Neither of them are the current version of TLS. Both of them have cryptographic flaws. And both are extremely widespread.

Firefox really does have a top-level config panel with a checkbox that disables automatic image loading. It's not even an "advanced" option.

I don't think your comment really engages with the article. What should the top-level options for a browser be?

[ Parent | on HN ]

Re:Checkboxes that kill your product by agwa on Monday March 18, 2013 @01:57PM (#5395919)

Several of the options (cache, TLS, certificate manager) he cited are already in the advanced panel and he wants to kill them.

And in several places he explicitly says that these killed options (whether they're currently in the advanced panel or not) should be replaced by add-ons, not by an advanced option or even by about:config.

So I don't think I dragged the article to a conclusion it didn't try to make. The article is clearly about killing options which I contend people need, and I think should be placed in an advanced section rather than killed.

[ Parent | on HN ]

Re:Checkboxes that kill your product by tptacek on Monday March 18, 2013 @02:00PM (#5395936)

He wants to kill those options. Not all the options. I don't think that was a good-faith response.

Can you defend the SSL 3.0 and TLS 1.0 checkboxes?

[ Parent | on HN ]

Re:Checkboxes that kill your product by revelation on Monday March 18, 2013 @07:10PM (#5397782)

But he does want to kill plenty of these options. Thats why he constantly remarks about Addons, as if a Firefox addon should be able to globally disable JavaScript. It's the fault of this article: he constantly implicates that because something is an overly niche option, it should be done away with completely, instead of just removing it from the UI.

Certificate manager in an addon? What?!

[ Parent | on HN ]

Re:Checkboxes that kill your product by tptacek on Monday March 18, 2013 @07:16PM (#5397808)

The certificate management interfaces of every mainstream browser are so bad that they actually harm Internet security. They all need to be replaced. Add-on cert management interfaces sound peachy to me.

[ Parent | on HN ]

Re:Checkboxes that kill your product by revelation on Monday March 18, 2013 @08:45PM (#5398177)

The point here being that you should not delegate cert management to an addon. Addons have no business being exposed to any of that, they need to be sandboxed in and restricted.

And yes, they are so bad to the point they are harmful, but the only reason they are in there is because Firefox has it's own certificate store, more of a portability quirk than anything.

[ Parent | on HN ]

Re:Checkboxes that kill your product by tptacek on Monday March 18, 2013 @08:49PM (#5398198)

The certificate UX for other browsers is no better.

[ Parent | on HN ]

Re:Checkboxes that kill your product by dasil003 on Tuesday March 19, 2013 @06:36AM (#5400000)

Okay, but he didn't comment on the possibility of putting it in a hidden preference screen available by URL only. He hasn't explicitly commented on the middle ground between preference screens available from the menu and add-ons, so it's not fair to say that he's claiming it should be done away with completely.

His point was, and I agree with it, that a mass browser does not need to expose cert management in a way that the 99.9% can access it because it's likely to cause more harm than good for anyone who is not capable of jumping through a few extra hoops to get to it.

[ Parent | on HN ]

Re:Checkboxes that kill your product by chris_wot on Tuesday March 19, 2013 @06:52AM (#5400059)

I'm sorry, but the answer isn't to remove options that often make sense. You don't want to be like the Gnome guys, who in the guise of making things "user friendly" removed often extremely useful functionality.

Like removing the certificates manager. Or cache control. Or the ability to restrict cookies. Or JavaScript. Or the ability to turn off menubars, should you so desire to do so (kiosk mode). All of these things are used by people. Just because he doesn't like it, doesn't mean others don't want it.

[ Parent | on HN ]

Re:Checkboxes that kill your product by arjie on Monday March 18, 2013 @02:23PM (#5396131)

For what it's worth, some versions of the web interface for VMWare Server 2.0 will not work without disabling SSL 3.0.

[ Parent | on HN ]

Re:Checkboxes that kill your product by JoshTriplett on Monday March 18, 2013 @03:04PM (#5396402)

File a bug in Bugzilla in the Evangelism component asking Mozilla to chat with the VMWare folks, and file another bug against the browser requesting a fix for whatever autodetection prevents it from falling back to some other protocol.

[ Parent | on HN ]

Re:Checkboxes that kill your product by sandyarmstrong on Monday March 18, 2013 @06:23PM (#5397560)

Nope:

"The people that need to do these things should use add-ons, or at the very least an about:config tweak."

[ Parent | on HN ]

Re:Checkboxes that kill your product by Spooky23 on Tuesday March 19, 2013 @12:33AM (#5398967)

I think people get nervous about talk like this because the "make everything muppet-proof" movement has gotten so much traction in the wake of Android and iOS.

UI designers are empowered, and "power" technical and business users suffer for it. My iPad is easy for my two-year old to use... But it is horrific for more many types of tasks that computer users do every day.

Firefox definitely carries a lot of config legacy... But going too far the other way is dangerous too.

[ Parent | on HN ]

Re:Checkboxes that kill your product by Hello71 on Monday March 18, 2013 @01:44PM (#5395813)

Remove TLS version UI (Options > Advanced > Encryption > Protocols) https://bugzilla.mozilla.org/show_bug.cgi?id=733632

[ Parent | on HN ]