Slashdot Mirror


Why We Should Stop Hiding File-Name Extensions

An anonymous reader writes 14 years after the Anna Kournikova virus took advantage of users' ignorance about file-name extensions in order to wreak worldwide havoc, virus writers and hackers are still taking advantage of the tendency of popular consumer operating systems to hide file-name extensions: Windows users still need to activate extension visibility manually – even though email-transmitted viruses depend most on less savvy users who will never do this. Additionally applications on even the latest versions of Apple's OSX operating system still require the user to 'opt in' to including a file-name extension during an initial save. In looking at some of the eccentricities of the modern user experience, this article argues that it might be time to admit that users need to understand, embrace and responsibly use the only plain-text, obvious indicator of what a file actually is.

22 of 564 comments (clear)

  1. Good operating systems Dont. by Anonymous Coward · · Score: 5, Insightful

    The crap ones like Windows and OSX, they hide it because they assume the user is a drooling moron.

    And most of the time they are right.

    1. Re:Good operating systems Dont. by Gerald · · Score: 5, Funny

      I can't get OS X to hide extensions on my machine. Is there a special flag you have to pass to ls?

    2. Re:Good operating systems Dont. by swimboy · · Score: 5, Informative

      Yes, it's | sed s/\.[^\.]*$//

      --
      Ask me how the Heisenberg Principle may or may not have saved my life.
    3. Re:Good operating systems Dont. by ShanghaiBill · · Score: 5, Insightful

      The crap ones like Windows and OSX, they hide it

      I am using OSX right now. File extensions are not hidden. There are some dialogs that optionally hide them, usually when only one extension is possible, such as .pdf in Adobe Reader, but in general, they are not hidden. But even where extensions are hidden, it is not at the same level of stupidity as hiding them on Windows. On Windows, the extension actually changes how the operating system interacts with the file, such as whether it is executable. So Microsoft uses the extension to convey very important information, and then hides that information from users.

    4. Re:Good operating systems Dont. by gnasher719 · · Score: 5, Informative

      Except that MacOS X doesn't hide extensions when an attacker uses the double extension trick. So if you downloaded a file prettyimage.png.exe, even with "hide extensions turned on", MacOS X will display both extensions, while Windows (as far as I know) displays "prettyimage.png".

    5. Re:Good operating systems Dont. by ShanghaiBill · · Score: 4, Informative

      Just asking, never having used OSX, which I understand to be a Unix system, aren't filename extensions non-functional?

      In Mac OS X you can associate an extension with an app. For instance, I have .pdf associate with Adobe Reader, so I can click on a PDF file, and it will pop open in Adobe Reader. These associations are under user control, so you can add, change or delete. But extensions don't change whether a file is executable like .exe, .com, or .bat do on Windows. You use chmod to do that, just like on any other Unix.

    6. Re:Good operating systems Dont. by schnell · · Score: 4, Informative

      Honestly, I think the original Mac OS did it better with four character file type and creators; meta-properties that the file can have.

      This was a much superior solution in many ways. (If you're interested in a detailed exploration of why, read any of John Siracusa's in-depth OS X reviews on Ars Technica for his fierce and well developed defenses of the old method.)

      Unfortunately, the downfall of this method came in sharing files across platforms. For much of the 1990s, Mac users would send files via FTP or e-mail which - lacking file extensions - were difficult for PC users to deal with when they received them. For example, my Word doc titled "Briefing" worked fine on my Mac but when I e-mailed it to a colleague using Windows, he would get a file that his PC didn't know what to do with. He would have to ask me what type of file it was (.doc? .pdf? .ppt?), and manually append the correct extension, yadda yadda.

      Macs, as the minority in a nearly all-PC world (especially the business world) needed to create as few waves as possible and "get along" with the Windows standard. So, when designing OS X, Apple decided to deprecate file/creator types and go along with the inferior system that the rest of the desktop computing world was using.

      --
      "95% of all Slashdot .sig quotes are incorrect or completely fabricated." -Benjamin Franklin
  2. Yes, I agree by GargamelSpaceman · · Score: 5, Insightful

    The first thing I do on windows is change the settings to show tilename extensions. Much of the confusion I see in others can be directly traced to the fact that they don't know what their files are.

    Stop being afraid to make someone learn something useful to use a computer.

    That being said, don't make people learn useless things. Design a powerful set of useful things to learn each of which is valuable and worth learning and remembering and then reward people for learning them by maintaining their usefulness

    Making things overly simple robs users of the power to make things simple for themselves, and ends upt complicating their interaction with the computer.

    --
    ...
    1. Re:Yes, I agree by Anonymous Coward · · Score: 5, Insightful

      "The first thing I do on windows is change the settings to show filename extension"

      Hear hear! Hide the extensions is one of the stupidest things Microsoft has ever done and it is a huge disservice to the end user.

      The condescending My Docs, My Music, et al should also go.

    2. Re:Yes, I agree by gstoddart · · Score: 5, Insightful

      I just went through setting up a new Windows 8.1 machine.

      And the sheer quantity of places where Microsoft has more or less gone out of their way to hide basic stuff about your computer, and make it as difficult to find as possible -- well, that is kind of mind boggling (and very frustrating).

      And when they do make it available to you, they couch it in a "well, everything hereafter is your fault".

      Essentially, in my opinion, Microsoft has tried to dumb down the system so far that when you try to do anything it is almost useless, and if you need to see more information it just throws up its hands and says "fuck it, not my problem".

      So, maybe instead of trying to write a crappy, useless system for the users who will be scared to know they're looking at a text file or an exe ... Microsoft should try to write something which isn't crap, isn't still predicated on using that crap autorun to ensure every possible source of malware is ran without being prompted, and from the get go tells users "this is a computer, we're not hiding this from you".

      It boggles my mind even at work on a Windows server, when my account is an admin and I'm doing admin tasks how Microsoft goes out of their way to hide the actual functionality. And when they don't their "helpful" error messages are garbage ... like "something bad happened, contact your administrator". Tell you what, I'm the fucking administrator, why don't you tell me an actual error message instead of assuming I'm a child?

      It seems like the more Microsoft tries to dumb things down for their users, the worse they actually make their software. Because it actively tries to be sure you can't see what you know, and simply can't (or won't) tell you what happened when it should.

      Microsoft is way too focused on pointless eye candy (like the Metro interface on my desktop I had to remove), and dumbing down the user experience ... and seems to utterly fail to make it possible for someone who actually has some idea of what they're doing to find what they need.

      The more "helpful" they try to be, the less helpful and usable they actually are.

      --
      Lost at C:>. Found at C.
    3. Re: Yes, I agree by gstoddart · · Score: 4, Insightful

      Hell hath no fury like a nerd set in his ways.

      There's set in my ways, and then there's confronted with a modern piece of shit that some marketing wanker thinks is helpful.

      And, I'm sorry to say it, but almost all of the crap I had to figure out how to remove was garbage, intended to give a tablet like interface, using a UI which is mostly about eye candy.

      It serves no purpose, and provides no value to me.

      It's crap. But it's pretty.

      My problem with Microsoft is they seem to have forgotten that many of us still actually use computers to do our fucking work.

      Metro was a steaming pile of crap which wasn't useful for that.

      The OS itself seems good. The user interface has been designed by morons.

      --
      Lost at C:>. Found at C.
  3. Are you nuts? by Anne+Thwacks · · Score: 4, Funny

    The malware writers will never agree to i!

    --
    Sent from my ASR33 using ASCII
  4. Re:File extensions? by Qzukk · · Score: 5, Insightful

    The filetype is now contained in the icon

    The icon of an executable is set by the executable. Enjoy your porn.jpg.exe with a thumbnail icon.

    --
    If I have been able to see further than others, it is because I bought a pair of binoculars.
  5. Re:Missing the problem by a mile by arth1 · · Score: 4, Informative

    On Windows, extensions are meaningful to the operating system. It doesn't identify all files by magic numbers. Files are typed by their extensions. If the file is "fishhead.jpeg" then it is not a Win32 executable binary (barring flaws in the JPEG rendering system that lead to arbitrary execution).

    You miss that it isn't like that in Windows either. A file named fishhead.jpeg can indeed be a a Win32 executable binary that gets executed by the OS as a binary if called without a named program to open it. That depends on what the end user and the programs he (spit) trusts have set the .jpeg extension to signify. It is only a recommendation. Windows provides defaults, but it is silly to presume that no program would ever be mean enough to change any of that on you.
    You cannot trust the extensions any more than you can trust the "From:" address in an e-mail. Not in Windows either.

  6. Re:Missing the problem by a mile by Chris+Mattern · · Score: 5, Informative

    Looking at the name extension will tell you absolutely nothing.

    Looking at the name extension will tell you what the system will attempt to do with it by default. This can be very important to know.

  7. Re:Yes, I agree, but no shortage of stupid GUI by gewalker · · Score: 4, Insightful

    No shortage of stupid user interface choices. Some of the ones I've hated the most.

    * Hiding menu options, aka personalized menus
    * Wholesale rearranging and renaming of user interfaces between versions, esp. for infrequently used options
    * Super secret hidden files.
    * Windows 8

  8. When people aren't used to seeing extensions by Spacelem · · Score: 4, Interesting

    Whenever I see a Windows desktop with file extensions disabled, I always try to explain to the person that they should be switched back on, and most people are quite happy to do so (they only had them off because that was the default).

    However I was quite dismayed when I looked at my mother's laptop (which I had installed Linux Mint on for her), and she had no file extensions either. It turned out that she thought they looked untidy, and had gone through and manually removed the extensions from every single file in her home directory!

    Fortunately the file and mmv commands made short work of fixing this, but I was surprised to say the least.

  9. Re:And why is hiding shit the default in Win serve by PPH · · Score: 4, Funny

    doing UUCP support with someone who has to have Unix characters (like bang and pipe)

    Odd. I found most receptionists understood what I meant by bang and pipe perfectly well.

    --
    Have gnu, will travel.
  10. "Hiding Things" by Sir_Eptishous · · Score: 4, Insightful

    I hear the faint and cryptic laughter of Steve Jobs echoing in the distance...

    Hiding Things?
    Well of course, because modern UI design is all about obfuscating control over your device and interface.
    Microsoft and the rest(this includes Linux desktops) don't want a "cluttered" user experience. UI designers seem to forget that people to need to modify and control their device and interface.

    UI designers are too quick to "googlify" interfaces to such a degree that vast uncounted eons of time are wasted simply trying to modify simple things because UI designers have mandated a "spartan" and oh so Sprockets-like look and feel.
    Users are tricked into thinking they shouldn't see the nuts and bolts.
    Users are treated like idiots, and then become idiots.

    --
    We play the game with the bravery of being out of range
  11. Re:Even worse - extensions == "chmod +x" ?!? by jellomizer · · Score: 4, Insightful

    The extension vs file system property is a trade off case. If I see a .EXE file I expect it to be a binary file. if I see a file which a 755 mod to it. How would I know if it is a binary file vs. a script without looking into it. Renaming a .bat file to a .exe will prevent it from running. A file that is chmod 755 will try to run. So the file extension is actually a good way to know what type of file it is.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  12. Re:Even worse - extensions == "chmod +x" ?!? by AntiSol · · Score: 4, Informative

    How would I know if it is a binary file vs. a script without looking into it.

    type 'file /path/to/file'.

    e.g:

    user@host:~ $ file /bin/bash
    /bin/bash: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=bla, stripped

    or:

    user@host:~ $ file a_script.rb
    a_script.rb: a ruby1.9.1 script, ASCII text executable

  13. Re:Even worse - extensions == "chmod +x" ?!? by BasilBrush · · Score: 4, Insightful

    So the file extension is actually a good way to know what type of file it is.

    No, it's brain dead. The filename is a name. The filetype should be another piece of metadata. (and not just an executable flag either - a complete file type.)

    If the file type needs to be seen by the user, then that's a UI design issue, not a reason to have brain dead mixed purpose metadata fields.