Self-signed certificates

Johnathan Nightingale explains why Firefox makes you jump through a series of annoying hoops before it will show you a self-signed web page. As he points out, the jump-through-hoops design is actually old. It is only the number of hoops that has changed in Firefox 3.

The main problem with this design is well known: People are trained to just do whatever it takes to get the web page to display. When they finally do get a malicious page, they do what they always do, which then results in a completely normal-looking bank page where they type in their password as usual.

Here is a better idea:

Show the page without asking questions, but draw it with a weird red glow and a yellow warning. If the user actually enters any kind of information, then show a speech bubble saying that the information could be intercepted. Like this:

If the user then goes ahead and submits the information, show a final warning, then send it.

The big benefits:

Users get to see the page without being grilled

This means they are not trained to override the certificate because that won't usually be necessary to do what they want.

The page looks wrong

If a familiar bank page is suddenly annotated with yellow warning bars and red speech bubbles, that will get people's attention. Much more so than having to first click OK to a gobbledigook question. Imagine that: Web security that actually has a chance of working ...

Technical users are not frustrated

Because the details window would have an override button for people who have to use a self-signed web page on a regular basis.

The weird thing about the decadence discussion is all the talk about how we made this "awesome desktop" which is like totally awesome and the only reason nobody uses it that they are just happy enough with Windows or OS X.

The problem with that is that GNOME is not awesome; it is in fact a pile of junk where basic stuff DOES NOT WORK. It is not not even competitive with Windows 95, let alone Windows XP or OS X.

Maybe that has something to do with why nobody cares.

Power Information

The AC Power has been unplugged. The system is now using battery power. To celebrate, let's frantically seek the harddisk for several seconds.

"o hai i made u a notafication bubble"

An extremely interesting blog about algorithms, data structures, parallel programming etc.

Sysprof 1.0.8 is out with a fix for an embarrassing bug that caused panics and lockups on preemptive kernels.