Slashdot Mirror
Why We Should Stop Hiding File-Name Extensions
An anonymous reader writes 14 years after the Anna Kournikova virus took advantage of users' ignorance about file-name extensions in order to wreak worldwide havoc, virus writers and hackers are still taking advantage of the tendency of popular consumer operating systems to hide file-name extensions: Windows users still need to activate extension visibility manually – even though email-transmitted viruses depend most on less savvy users who will never do this. Additionally applications on even the latest versions of Apple's OSX operating system still require the user to 'opt in' to including a file-name extension during an initial save. In looking at some of the eccentricities of the modern user experience, this article argues that it might be time to admit that users need to understand, embrace and responsibly use the only plain-text, obvious indicator of what a file actually is.
The crap ones like Windows and OSX, they hide it because they assume the user is a drooling moron.
And most of the time they are right.
The first thing I do on windows is change the settings to show tilename extensions. Much of the confusion I see in others can be directly traced to the fact that they don't know what their files are.
Stop being afraid to make someone learn something useful to use a computer.
That being said, don't make people learn useless things. Design a powerful set of useful things to learn each of which is valuable and worth learning and remembering and then reward people for learning them by maintaining their usefulness
Making things overly simple robs users of the power to make things simple for themselves, and ends upt complicating their interaction with the computer.
...
The malware writers will never agree to i!
Sent from my ASR33 using ASCII
There's a whole slew of weird extensions now, that when clicked, do things.
Instead of insisting that modern OS design carry forward an old and archaic standard set of digits describing the type of file, show users visual information about the file type/associations in way that is meaningful to them. If it is an executable file, don't make users parse that .exe is short for that, and in many cases .com and .bat can kinda work the same way. Give users a visual identifier that lets them know clicking this file will lead to this action. A web icon for anything that'll attempt to open itself from a browser, a document icon for something that will open in a document viewer, and so on.
Insisting on showing people a 3 character code that 99% of them are entirely ignorant of solves nothing.
You really think this will happen with the current level of OS dumbing down?
I am Bennett Haselton! I am Bennett Haselton!
This seems irrelevant. If you have a jpeg with a TXT extension, Windows at least will treat the file as a text file not an image.
That always baffles me.
I'm kind-of-sort-of willing to concede to the demands by that fuckstick hipster who works in marketing who thinks that aesthetically filename extensions make the product too technical for other fuckstick hipsters who are also wound up about appearances. I don't agree, but I'm tired of arguing about it, at least when it comes to the consumer desktop OS.
But WHY IN THE FUCKING FUCK does the server operating system have the same goddamn "hide everything that might be confusing to marketing types and the mentally retarded" settings out of the box? What shithead, or group of shitheads, made that decision and WHY? As far as I'm concerned this is a deeper, more profound and transcendental stupidity than making Win Server use the Win8 start menu.
I find it particularly ironic given the Microsoft push to capture mindshare from CLI propellerheads with PowerShell Everything.
The filetype is now contained in the icon
The icon of an executable is set by the executable. Enjoy your porn.jpg.exe with a thumbnail icon.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Modern operating systems flag downloads and show warnings before executing. This seems more useful than a file extension which will commonly be truncated from view, even if the OS is set to display them.
it might be time to admit that users need to understand, embrace and responsibly use the only plain-text, obvious indicator of what a file actually is.
Oh man, good one! You had me going until that line. Beautiful!
I just responded in another thread where actual programmers argued about whether or not it counts as "confusing" to split a delimited string without actually using the name "split" for the method that does the work.
And you want to try to get the average end user to understand the difference between ".XLS", ".XLSX", and ".XLSX.EXE"?
May as well swing for the fences, I suppose.
The tendency to treat the user like a moron is common on all the widely adopted consumer operating systems and it really does need to stop.
It just leaves otherwise intelligent people utterly baffled when simple things happen because they're kept in a fantasy land by their GUI.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
This seems irrelevant. If you have a jpeg with a TXT extension, Windows at least will treat the file as a text file not an image.
Exactly. That's idiotic. If I walked up to you and stuck a sticker with ".cat" onto your back, would you meow?
What a file is, and the portion of the filename after the final dot, if any, should not have anything to do with one another. The assumption that any random file is what it says on the tin may have worked fine when computers were slow and security consisted of a big lock on the door to your office, but it has no place in 2015.
My favorite is the config files for .Net programs.
When you create an "app.config" file, Visual Studio handily renames it to be [compiled output file name].config. So if you have program named "foo", and you compile it to make "foo.exe", your app.config file is going to be named "foo.exe.config". Now, hide the file extension and see the confusion erupt on all sides. "foo.exe" becomes "foo", and "foo.exe.config" becomes "foo.exe". So instructing someone to run that executable becomes an exercise in frustration as they repeatedly open the config file with Notepad.
Hiding file extensions needs to die, at the minimum. I'd like to see VS adopt a better naming convention for app.config files, too. Like just calling them "app.config" or at least [project name].config.
On Windows, extensions are meaningful to the operating system. It doesn't identify all files by magic numbers. Files are typed by their extensions. If the file is "fishhead.jpeg" then it is not a Win32 executable binary (barring flaws in the JPEG rendering system that lead to arbitrary execution).
You miss that it isn't like that in Windows either. A file named fishhead.jpeg can indeed be a a Win32 executable binary that gets executed by the OS as a binary if called without a named program to open it. That depends on what the end user and the programs he (spit) trusts have set the .jpeg extension to signify. It is only a recommendation. Windows provides defaults, but it is silly to presume that no program would ever be mean enough to change any of that on you.
You cannot trust the extensions any more than you can trust the "From:" address in an e-mail. Not in Windows either.
Looking at the name extension will tell you what the system will attempt to do with it by default. This can be very important to know.
OK, and how is opening the jpg in notepad going to harm your computer?
Troll is not a replacement for I disagree.
This is not about how your own application react to a file. this is how the operating system *does*. There is a convention in the operating system, particularly windows, that a .gif will be tried to be displayed as a picture and a .html as a web page. Your application may *chose* to interpret it as music for all we care, but the operating system will react by default as described.
This is why displaying and showing this is an executable is important. Although nowadays the windows operating system should warn you you are about to run an executable.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
No shortage of stupid user interface choices. Some of the ones I've hated the most.
* Hiding menu options, aka personalized menus
* Wholesale rearranging and renaming of user interfaces between versions, esp. for infrequently used options
* Super secret hidden files.
* Windows 8
I think the idea, at least for Windows, is that extensions are a legacy thing, and are still supported because they are the basis for determining file type. BUT, the reasoning is likely that they can be hidden from the user and only show the user the actual file type. Which is fine in theory, except that now you are training the user to recognize file type solely by icon, making it trivial to give a dynamic-icon type (like EXE, or the old SCR which users are unlikely to recognize) the same icon as a text file and subvert the user's expectations and make them think the file is safe. If you are not in Details mode or not grouping by File Type it is IMPOSSIBLE to reliably determine the type of a file without the extension!
Of course MS has added the whole Zone Identifier scheme and displays a nasty warning when trying to run dangerous files from the internet. I think this is a good measure to prevent this type of trickery, unfortunately people tend to click past such dialogs.
Actually, it doesn't tell you what the system will attempt to do with it by default. It tells you what would happen on a normal system, without anybody playing with the file extension meanings. There's a difference there, and when we're talking about malware it's a very important distinction.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
It's hard to make extensible for newly installed products, and nowadays lots of file formats are a renamed zip file that contains other files.
When I did Windows XP images for clients, I always set the Default User profile to display extensions.
I did this without asking, without any discussion beforehand, and only had to defend the decision once near the end of the design project... my defense was, "This is the right way to do it, so that's what we're doing." End of discussion.
...I'm kind-of-sort-of willing to concede to the demands by that fuckstick hipster who works in marketing who thinks that aesthetically filename extensions make the product too technical for other fuckstick hipsters who are also wound up about appearances....
Hiding filename extensions predates the hipsters by decades. Don't blame the hipsters for everything you don't like...
Whenever I see a Windows desktop with file extensions disabled, I always try to explain to the person that they should be switched back on, and most people are quite happy to do so (they only had them off because that was the default).
However I was quite dismayed when I looked at my mother's laptop (which I had installed Linux Mint on for her), and she had no file extensions either. It turned out that she thought they looked untidy, and had gone through and manually removed the extensions from every single file in her home directory!
Fortunately the file and mmv commands made short work of fixing this, but I was surprised to say the least.
What does this have to do with OS X? On Windows the extension determines how the file is treated/opened when double clicked. In OS X this is done differently.
Sig?
doing UUCP support with someone who has to have Unix characters (like bang and pipe)
Odd. I found most receptionists understood what I meant by bang and pipe perfectly well.
Have gnu, will travel.
There are two problems. The first is that the OS allows you to run porn.jpg.exe having downloaded it from some random place on the 'net. I don't think that either OS X or Windows do: they'll both pop up a thing saying 'You are trying to run a program downloaded from the Internet, do you really want to?', which isn't normally something that happens when people try to open a file so ought to trigger them to avoid it (if it doesn't, then seeing the .exe extension probably won't either).
The second is that the OS allows programs and other file types to set icons at all before their first run. This also leads to confused deputy-like attacks where you think you're opening a file with one program but are actually opening it with something that will interpret it as code. The solution to this is probably to have programs keep their generic program icon until after their first run. If you double click on something that has a generic program icon, then you probably intend to run it...
I am TheRaven on Soylent News
Not sure how Macs have training wheels, but my antediluvian MacBook running Yosemite shows all file extensions in the Finder, and when I'm using a shell window, ls -l and ls -la work just as well as in AIX, Linux, BSD, Solaris, or any other UNIX or UNIX variant.
I'm OS agnostic, and OS X has some annoying qualities [1], but being able to see file extensions isn't one.
[1]: My biggest complaint about not OS X specifically, but Mac hardware is that Apple killed off the XServe, You -can- rackmount a Mac Pro with a RackMac kit, but it would be nice if Apple still kept a toehold in the enterprise.
I don't mean to digress, but if Apple could make Macs that could connect to each other via Infiniband and read/write to each other's storage, it would be a platform that could run applications at SAN speed and reliability, but without the SAN, just local drive arrays. Doing this would ensure a niche in the enterprise. Apple even has a clustered filesystem, XSan, so in theory, if Apple did a bit of design, one could have a bunch of Macs with fault tolerance of failed drives and systems, similar to how the EMC Isilon arrays work.
What seems even more stupid is that some OS's seem to think the last 4 characters of a filename convey some magical meanings -- like if it should be executable; or what application is should magically launch when clicked.
I hear the faint and cryptic laughter of Steve Jobs echoing in the distance...
Hiding Things?
Well of course, because modern UI design is all about obfuscating control over your device and interface.
Microsoft and the rest(this includes Linux desktops) don't want a "cluttered" user experience. UI designers seem to forget that people to need to modify and control their device and interface.
UI designers are too quick to "googlify" interfaces to such a degree that vast uncounted eons of time are wasted simply trying to modify simple things because UI designers have mandated a "spartan" and oh so Sprockets-like look and feel.
Users are tricked into thinking they shouldn't see the nuts and bolts.
Users are treated like idiots, and then become idiots.
We play the game with the bravery of being out of range
Because something system-level with access to run the file (presumably) has to apply regexp's to almost it's entire contents to correctly determine the type of it (e.g. is it a ZIP or is it a JAR with the same compression?).
No, it would only have to examine the first few bytes.
Why trust users to know what file extensions are "safe" and which are not? Surely the same computer that shows "ImportantFile.doc" to the user when it's really "ImportantFile.doc.exe" can be smart enough to pop up a message when someone clicks on it: "Hey, this filename *looks* like a document, but it's really an executable so instead of opening a document, I'm going to run it. It's probably a terrible idea to run it, so I'm not going to do it, you'll have to rename it to something less ambiguous if you really want to run it. But you should't do that. Really. I'm not kidding."
Huh, they run just fine on mine. Must be all the Wine.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.