Re: Concrete ideas for the December-March OPW?

[Hans Petter Jansson <hpj copyleft no>]

On Wed, 2014-10-29 at 10:20 -0500, Michael Catanzaro wrote:
> On Wed, 2014-10-29 at 14:10 +0100, Tobias Mueller wrote:

> > I would advise against popups though. Especially
> > those which are security relevant.

> Normally I'd agree, but this would be a far cry from a "do you want to
> do something insecure? yes/no" dialog. I figure if we throw up a big
> symbolic keyboard (or a wireless network device icon or a USB hub icon
> or whatever else) next to a big symbolic flash drive and say "What did
> you plug in?", there's no way the user could get that question wrong.

What do we do about e.g. cameras that legitimately identify themselves
as mass storage devices?

Also, I wonder what our options are for dealing with the fact that users
have been trained to accept that for UI purposes, cameras and USB sticks
are the same thing.

How many kinds of device are there that identify themselves as something
counterintuitive?

> > Another approach could be a tool which you need to open in order to
> > activate
> > your plugged in device.
> > In that tool you see the device and its types. Then you press a toggle
> > button
> > in order to activate (or deactivate) the device.

> To be frank, that sounds terrible. When I plug in a keyboard or network
> adapter I want it to just work; I don't want to have to hunt for some
> app on my computer to let me activate it. How would users ever figure
> that out? Keyboards ought to remain plug-and-play.
>
> I think it's OK to use a popup in response to direct user input
> (plugging in a device); the problem is when they appear for no reason
> (like the popups from evolution-data-server).

I agree with this. Plus, we already have a popup UI in place for asking
what you'd like to do with plugged-in mass storage devices ("Open with
<application>", etc). This could be extended with a "deny" option and
applied to more devices.

The only potential issue I see is that currently, mass storage devices
are mounted and inspected in order to determine the options. We'd have
to show the popup prior to doing anything with the device, so we may
have to turn it into a two-step process, at least the first time a given
device is plugged in.

-- 
Hans Petter