Vista doesn't seem to add much value for a couple of reasons (off the top of my head)
* The current builds of windows are not easy to deploy on a larger scale, however, there do exist imaging CDs and unattended install scripts that make this quite easy.
* The primary activities on the desktop PC are surfing the internet, office suite (email, word processing, spreadsheets), IM, graphics and games. Vista doesn't bring much value to any of these as XP did when it replaced 98 (it was a major face lift, lots of PnP and driver issues were addressed, networking was significantly improved, office XP did not run on 98, major memory leaks, BSOD etc).
* It's biggest competitor is XP/2003. I don't think anyone's mom will want to upgrade considering XP is already doing well for them. Further, there is a slow paradigm shift toward web services and thin browser-based clients (it will still be a couple of years before you can expect to use a web-based word processor but we're getting pretty close).
* IE won't be as big a selling point since it doesn't share the same prestige as it did during the XP release with which it was bundled (primarily because moz is better and IE7 will have to be backward compatible with IE6 and MS has a greater obligation to comply with standards now more than ever).
* The support cycle for 2003 and XP have been extended to 2008 (not certain -- correct me if I'm wrong)
* Parental controls and user authentication could be improved further still and if done right they would add some value.
That said, the OS will probably still come into wide use due to the piracy (~90%+ copies of existing windows copies in China are pirated). DRM and other similar features may become a selling point toward corporate adoption (although they will diminish user control which might discourage migration to Vista).
If you take away from the bias and do an objective comparison, VE is quite remarkable, even though their coverage is not as expansive as GM's (for the time being).
Sure, there are discrepencies between the satellite shots (both have missing frames and other bloopers). These are bound to happen when you have a satellite photographing the entire globe frame by frame.
Where I do see more value in VE over GM, however, is in the overall picture quality. Compare these two images and notice the dithering/resolution in GM vs VE:
> I'd have thought the motivation was to limit the number of separate accounts you need.
Yes, log in once to the network and browse on all partner sites without having to log in again.
> Having a billion accounts running around is a massive security nightmare.
Quite the contrary. Having a single point of failure (master account) is much worse.
> Either you're using the same password everywhere
The only way is to educate users about pass phrases and password schemes. Most people who are reading this probably have 3-4 passwords which they use for different sites depending on the security threat. My bank account sites for example all have exclusive passwords. My social software (msn, orkut friendster) have the same password. If you really must, devise a password scheme based on domain name. If your regular pass for example, is mhallwfwwas! (mary had a little lamb whose fleece was white as snow!), then for orkut.com you can use mhallwfwwasou (append all vowels (O and U) in the domain name OrkUt to your password. You can get more creative by appending vowels in reverse order or by interspersing: mOhUallwfwwas, using alternate casing etc).
> (and telling every web site owner your password)
This is a real threat. You have no guarantee that the site owner isn't privvy to your password. This is more an issue of trust than security and in that the proposed system does add some value provided their central servers can be trusted. If you used a password scheme as outlined above, the website owner would not be able to extract mhallwfwwas from mohuallwfwwas (assuming the passphrase does not make sense to him) rendering that password useless to him/her.
Like I said, it's about educating users. I am other geeks have their own set of password'ing rules.
> or you're wandering around with a notebook of thousands of passwords.
Get Password Safe. You may argue that this results in a master password but the software is localized so the threat is smaller (one person gets hacked at a given time; the hack must be local through a key logger or something which is more or less preventable).
I noticed the maps API does not allow you to switch to a satellite view like their web counter-part. If they added that, the cool factor on this thing would double.
Overlaying polygons and lines is a neat feature though. No need for using flickr to mark out areas on static maps when you can do so on dynamic maps right through the google API.
That's what google does so well; build the foundation, open up the API and let the developers build on top of that foundation. Some really cool things will come out in the upcoming weeks.
Actually, Pakistan's best political ties are probably with China and I would assume China has good bandwidth capacity which is why that option doesn't sound so bad.
If the cables can be strategically routed through the unstable regions in the north (Gilgit?) with a hub in the capital city of Islamabad it would work out very nicely.
1) The cities in the north are currently linked through Karachi so routing through China would balance the northern and southern parts of Pakistan in terms of capacity and infrastructure.
2) The silicon valley equivalent in Pakistan is in Islamabad so this makes total sense. They could use a direct connection through China and branch out to other regions.
3) At the same time the infrastructure would be very solid in terms of backup and capacity planning: existing cable running through the Arabian Sea, Karachi; One from Lahore to Amritsar, India which is under development; And one through Islamabad into China. It would cover all the three major metropolitan cities.
4) It also makes sense from a defense standpoint since China poses no threat (economic or otherwise) to Pakistan as does India.
Agreed, it is quite stupid and this should be an eye-opener. Pakistan's infrastructure is lagging behind and in desperate need of an upgrade, however, there aren't many options. There is Iran and Afghanistan to the West which are unstable regions and don't seem like viable options. China in the north but would mean running a cable through the northern regions which are highly unstable (although it seems like the next best option) and then there's India to the right which already has a solid IT infrastructure in place and that's who we are currently routed through.
It is caused by a break in the SME-3 cable, in the Arabian sea, some 35 km south of Karachi. The problem started out on Monday morning [ reported on a local slashdot-style forum http://tech.one.com.pk/?q=node/87 ]
The repair operation is complex and might take up to two weeks possibly causing disruption in India and UAE as well, who are also connected by the same cable.
SME-3 is Pakistan's primary pipe to the internet and the only backup is through satellite uplink which is providing service to some high ISPs at 10% of regular bandwidth. Call centres are surely going through a real tough time and their business will probably be impacted adversly by this.
> Why would the (lack of) avilability of a media player influence my OS decision?
It would influence your decision on the OS versions: N vs XP. I don't think anyone would want a degraded eXPerience when they can get the OS bundled with Media Player.
Unions in Europe have evolved in their ranks over the past decades and arguably, rightly so. The workers want to rise with the company. The problem though is not the headaches arising from the unions, although that makes a good alibi.
Even if the European unions and workers settled for something lesser, they would not be able to go head to head with the standards of Indian workers simply because of the economical and social divide.
The fundamental problem is that when countries like India enter the picture, they redefine the landscape. Simply put, they work harder and cheaper. Many are contracted so they are dispensable. They aren't unionized (yet) in many cases. The have lesser health costs due to the lower standards of living (they don't go running to a chiropractor if they have a slight ache in their back). They don't file whimsical lawsuits. They are the ideal workforce from a corporate standpoint. The only investment is training them.
As the development and business processes evolve, this trend will only escalate. You will see an assembly line of developers relying increasingly on processes. Add to that the growth (in breadth and depth) of online self-help communities, easier development tools (writing a calculator app in VS.NET takes 15 minutes and is a beginner level undertaking compared to 8 years ago), and easier software collaboration due to the evolution of versioning systems and communications networks.
If you haven't made the connection yet, think about it again: it's a $12bn industry and even if a small percentage start moving at $60 a hit, that's a lot of money for the registrars. It's simply a move to catalyze domain registration.
It's naive to think that all porn sites will move to xxx and we will be able to partition them off. Porn is the most spammy content on the web and the registrars are cashing in on it--it's simple as that.
Some retailers (Gas station employees mostly) will double swipe your card to charge you twice or swipe it through a personal magnetic reader which grabs and stores all info on your card which they use later to repro your magnetic strip. With RFID, an fradulent retalier would simply need you to walk through the door and have a concealed reader sitting within close proximity. You won't even know you've been charged until you get your bill at the end of the month. And to add to this, if they charged you 10 cents, would you go through the hassle of calling waiting on customer support for 10 minutes just to report a 10 cent charge you don't have?
There'll be a whole new array of attack vectors and frauds built around this. The insurance companies will up the premium, the credit card companies will be able to differentiate and compete, retailers will install new readers and a it'll give shape to a new industry.
1) If 1/3 of the users click on spam, that means that even if the spam filters on all the major servers/clients let 66% of the spam through, the user would have to click on ~50% of those spam mails.
2) If 1 in 10 users made the purchases? Have they have outdone google's ad model?
I suspect these numbers are reported by folks in the spam industry to project better success metrics and lure in more clients.
Injecting ads through POP3 is an interesting revenue model but it also enhances the SPAM problem.
They will certainly not send individual email ads (those will simply be filtered out and are no better than SPAM). The only other option is ads at the bottom of emails. This has a couple of problems.
Having ads in the signature of the email does make sense and is very easy to tweak. I'm guessing that if they took this route, you'll get clickthrough ad links. Impressions wouldn't work since those ads are not _useful_. Only a few select emails would contain ads (emails with large bodies so the text ad words don't have much weight which would be a concern for spam filters), and sent once for say, every 5 mails you recieve.
The problem though is that text-ads in emails are sticky. The become a permanent part of your mail and even more so, since Gmail promotes archiving/storing all your mail.
I'm sure people will have mixed feelings about this if they ever did take this route. Ads are just not cool when they become a permanent part of your conversations.
There are quite a few concerns about free storage and a warez API on top of gmail, but personally, I don't think it is a big concern and doesn't pose any significant risk to the gmail service.
Using a visual challenge to ensure that the user on the other end is human, will prevent automated scripts. You better have a lot of time downloading a file spread across a lot of emails (and a lot of accounts). While uploading is not a problem, downloading them will require you to invest quite a bit of time.
Some file storage for backup purposes is inevitable but warez exchange can be stumped (unless you want to trust leechers with your gmailwarez@gmail.com password).
Well, actually I just had another thought to counter my own argument. You could just forward the files to the leecher's account. Maybe they could setup limits on how many megs you can forward in x amount of time. But even then, you could forward it to 2 other accounts, and those 2 other accounts could then forward to 4 other accounts and so on...
Usability seeks to minimize the learning curve and optimize the speed of user-driven tasks. It relies quite heavily on abstraction. Security, in this context should aim to ensure that the level of abstraction does not create loss of information that can lead to an ill-informed decision.
It is a design issue. The problem is that people who work on usability are not proficient in security and vice versa and for the two things to co-exists in harmony, requires extensive planning and effort on part of both security and usability teams.
For example, consider file extensions not being displayed by default in windows and being replaced by familiar icons. Not displaying file extensions by default allows for easier renaming. If the "stupid" user renames the file and forgets to add a.doc extension it will render his file useless since he can't double click and open it anymore. MS Word won't show up the file by default in the "open file" dialog box either, since it only shows known document files by default. All this adds to the confusion and increases the level of knowledge required about the system, to work around the problem. We take it for granted but a beginner has to know about file extensions, file/program associations and file types, then use these "elementary" concepts to open the file in the file dialog by choosing "display all files" from the "file type" list (even then the file will be missing his familiar word document icon) OR by renaming the file by adding a . (using the knowledge of file extensions), adding a "doc" extension (using knowledge of extensions and file associations). All this is over-whelming for the new user. Security folks don't think this way!
Going back to my orignal argument. It is a design issue. We are accustomed to and inclined to think in terms of windows GUI and moulding existing systems for security. If these systems were designed from the ground up with security in mind a solution to the problem is certainly achievable.
In the case of my example, the.doc extension can still be displayed (only greyed out). Hitting F2 highlights only the filename (the extension is still greyed out and unselected) so the user can type in a file name and the.doc extension remains intact (beyond the scope of the cursor). The user would have to hit the right arrow key to skip past the dot or hit delete button a few times to assign a new extension. In either case, when the scope of the cursor extends beyond the dot or touches upon the file extension, a warning could be displayed as a dialog box. The dialog box could have the option of "do not display warning in future". Additionally the warning dialog box could have the requirement that at least 3 instances of it must be displayed before the "do not display in warning in future" option is enabled (this is to handle accidental dismissals or users acting in a hurry (and for that it could require the user hit TAB -> ENTER or explictly click OK to dismiss rather than just enter)). Furthermore, the status bar could still always display the warning so it's less intrusive, but instructive none-the-less.
Does enabling file extensions improve security? Not immediately, but if the users were always accustomed to file extensions the concept of file extensions/program-association would be implicitly relayed to them (by cognitive association -- every time the user clicked a.doc file and it opened up in MS word). A file called report.doc.exe will arouse some suspiscion since it is not the norm they will get accustomed to. Further more, once they are bitten by that file, they will be more careful and their knowledge will have gone up. (using only icons cannot overcome the problem since exe files can have the same icon as a.doc document).
I do agree, however, that security requires the user to be more knowledgeable and usability assumes "stupid" users, but like in the example above. The two conce
Slashdot Mirror
Is this fixed? Am I the only one who finds it extremely annoying to restart after each plugin install or update?
90% of 2MM is 1.8MM. You are getting 1.88MM off google and you claim less than 1% conversion? Could you elaborate on the numbers?
If you're going to comment out an entire block of code, do it as: /* //*/
//* //*/
foo
bar
now if you want to uncomment the whole block, you simply add another whack to the top comment
foo
bar
foo bar is no longer commented out. this comes in very handy when commenting/uncommenting entire blocks of code.
Vista doesn't seem to add much value for a couple of reasons (off the top of my head)
* The current builds of windows are not easy to deploy on a larger scale, however, there do exist imaging CDs and unattended install scripts that make this quite easy.
* The primary activities on the desktop PC are surfing the internet, office suite (email, word processing, spreadsheets), IM, graphics and games. Vista doesn't bring much value to any of these as XP did when it replaced 98 (it was a major face lift, lots of PnP and driver issues were addressed, networking was significantly improved, office XP did not run on 98, major memory leaks, BSOD etc).
* It's biggest competitor is XP/2003. I don't think anyone's mom will want to upgrade considering XP is already doing well for them. Further, there is a slow paradigm shift toward web services and thin browser-based clients (it will still be a couple of years before you can expect to use a web-based word processor but we're getting pretty close).
* IE won't be as big a selling point since it doesn't share the same prestige as it did during the XP release with which it was bundled (primarily because moz is better and IE7 will have to be backward compatible with IE6 and MS has a greater obligation to comply with standards now more than ever).
* The support cycle for 2003 and XP have been extended to 2008 (not certain -- correct me if I'm wrong)
* Parental controls and user authentication could be improved further still and if done right they would add some value.
That said, the OS will probably still come into wide use due to the piracy (~90%+ copies of existing windows copies in China are pirated). DRM and other similar features may become a selling point toward corporate adoption (although they will diminish user control which might discourage migration to Vista).
I am surprised no one has pointed this out yet, but it's a copy of start.com:
http://www.start.com/myw3b/
the space needle link should be:
0 382%7C-122.349149&style=h&lvl=19&v=1
http://virtualearth.msn.com/default.aspx?cp=47.62
If you take away from the bias and do an objective comparison, VE is quite remarkable, even though their coverage is not as expansive as GM's (for the time being).
e ,+WA+98109&ll=47.620296,-122.349029&spn=0.005187,0 .009917&t=k&hl=en
6 413%7C-72.764616&style=h&lvl=11&v=1
Sure, there are discrepencies between the satellite shots (both have missing frames and other bloopers). These are bound to happen when you have a satellite photographing the entire globe frame by frame.
Where I do see more value in VE over GM, however, is in the overall picture quality. Compare these two images and notice the dithering/resolution in GM vs VE:
http://maps.google.com/maps?q=203+6th+Ave,+Seattl
http://virtualearth.msn.com/default.aspx?cp=41.15
Clearly, VE has much higher resolution. Unless Google bumps up their resolution, I don't see why I would go to them for satellite images.
VE also shows some nice landmarks around Space Needle which quite frankly, are very handy.
Yeah Google is cool company, but is there any reason to use GM when VE offers more?
> I'd have thought the motivation was to limit the number of separate accounts you need.
Yes, log in once to the network and browse on all partner sites without having to log in again.
> Having a billion accounts running around is a massive security nightmare.
Quite the contrary. Having a single point of failure (master account) is much worse.
> Either you're using the same password everywhere
The only way is to educate users about pass phrases and password schemes. Most people who are reading this probably have 3-4 passwords which they use for different sites depending on the security threat. My bank account sites for example all have exclusive passwords. My social software (msn, orkut friendster) have the same password. If you really must, devise a password scheme based on domain name. If your regular pass for example, is mhallwfwwas! (mary had a little lamb whose fleece was white as snow!), then for orkut.com you can use mhallwfwwasou (append all vowels (O and U) in the domain name OrkUt to your password. You can get more creative by appending vowels in reverse order or by interspersing: mOhUallwfwwas, using alternate casing etc).
> (and telling every web site owner your password)
This is a real threat. You have no guarantee that the site owner isn't privvy to your password. This is more an issue of trust than security and in that the proposed system does add some value provided their central servers can be trusted. If you used a password scheme as outlined above, the website owner would not be able to extract mhallwfwwas from mohuallwfwwas (assuming the passphrase does not make sense to him) rendering that password useless to him/her.
Like I said, it's about educating users. I am other geeks have their own set of password'ing rules.
> or you're wandering around with a notebook of thousands of passwords.
Get Password Safe. You may argue that this results in a master password but the software is localized so the threat is smaller (one person gets hacked at a given time; the hack must be local through a key logger or something which is more or less preventable).
I noticed the maps API does not allow you to switch to a satellite view like their web counter-part. If they added that, the cool factor on this thing would double.
Overlaying polygons and lines is a neat feature though. No need for using flickr to mark out areas on static maps when you can do so on dynamic maps right through the google API.
That's what google does so well; build the foundation, open up the API and let the developers build on top of that foundation. Some really cool things will come out in the upcoming weeks.
Risky yes, but in terms of uptime, two connections through India are more reliable than one (which is down at the moment).
Lahore and Amritrar are quite close to each other, so for short-term expansion this solution seems most feasible.
Actually, Pakistan's best political ties are probably with China and I would assume China has good bandwidth capacity which is why that option doesn't sound so bad.
If the cables can be strategically routed through the unstable regions in the north (Gilgit?) with a hub in the capital city of Islamabad it would work out very nicely.
1) The cities in the north are currently linked through Karachi so routing through China would balance the northern and southern parts of Pakistan in terms of capacity and infrastructure.
2) The silicon valley equivalent in Pakistan is in Islamabad so this makes total sense. They could use a direct connection through China and branch out to other regions.
3) At the same time the infrastructure would be very solid in terms of backup and capacity planning: existing cable running through the Arabian Sea, Karachi; One from Lahore to Amritsar, India which is under development; And one through Islamabad into China. It would cover all the three major metropolitan cities.
4) It also makes sense from a defense standpoint since China poses no threat (economic or otherwise) to Pakistan as does India.
Agreed, it is quite stupid and this should be an eye-opener. Pakistan's infrastructure is lagging behind and in desperate need of an upgrade, however, there aren't many options. There is Iran and Afghanistan to the West which are unstable regions and don't seem like viable options. China in the north but would mean running a cable through the northern regions which are highly unstable (although it seems like the next best option) and then there's India to the right which already has a solid IT infrastructure in place and that's who we are currently routed through.
A secondary fibre-optic connection is being planned, also through India.
Some indigenous efforts are also underway but the costs are too high.
It is caused by a break in the SME-3 cable, in the Arabian sea, some 35 km south of Karachi. The problem started out on Monday morning [ reported on a local slashdot-style forum http://tech.one.com.pk/?q=node/87 ]
The repair operation is complex and might take up to two weeks possibly causing disruption in India and UAE as well, who are also connected by the same cable.
SME-3 is Pakistan's primary pipe to the internet and the only backup is through satellite uplink which is providing service to some high ISPs at 10% of regular bandwidth. Call centres are surely going through a real tough time and their business will probably be impacted adversly by this.
Seriously, why put down $300 when the windows firewall will do?
Or get a $50 router and block all uncessary ports to give yourself and additional layer of security.
> Why would the (lack of) avilability of a media player influence my OS decision?
It would influence your decision on the OS versions: N vs XP. I don't think anyone would want a degraded eXPerience when they can get the OS bundled with Media Player.
Unions in Europe have evolved in their ranks over the past decades and arguably, rightly so. The workers want to rise with the company. The problem though is not the headaches arising from the unions, although that makes a good alibi.
Even if the European unions and workers settled for something lesser, they would not be able to go head to head with the standards of Indian workers simply because of the economical and social divide.
The fundamental problem is that when countries like India enter the picture, they redefine the landscape. Simply put, they work harder and cheaper. Many are contracted so they are dispensable. They aren't unionized (yet) in many cases. The have lesser health costs due to the lower standards of living (they don't go running to a chiropractor if they have a slight ache in their back). They don't file whimsical lawsuits. They are the ideal workforce from a corporate standpoint. The only investment is training them.
As the development and business processes evolve, this trend will only escalate. You will see an assembly line of developers relying increasingly on processes. Add to that the growth (in breadth and depth) of online self-help communities, easier development tools (writing a calculator app in VS.NET takes 15 minutes and is a beginner level undertaking compared to 8 years ago), and easier software collaboration due to the evolution of versioning systems and communications networks.
If you haven't made the connection yet, think about it again: it's a $12bn industry and even if a small percentage start moving at $60 a hit, that's a lot of money for the registrars. It's simply a move to catalyze domain registration.
It's naive to think that all porn sites will move to xxx and we will be able to partition them off. Porn is the most spammy content on the web and the registrars are cashing in on it--it's simple as that.
Some retailers (Gas station employees mostly) will double swipe your card to charge you twice or swipe it through a personal magnetic reader which grabs and stores all info on your card which they use later to repro your magnetic strip. With RFID, an fradulent retalier would simply need you to walk through the door and have a concealed reader sitting within close proximity. You won't even know you've been charged until you get your bill at the end of the month. And to add to this, if they charged you 10 cents, would you go through the hassle of calling waiting on customer support for 10 minutes just to report a 10 cent charge you don't have?
There'll be a whole new array of attack vectors and frauds built around this. The insurance companies will up the premium, the credit card companies will be able to differentiate and compete, retailers will install new readers and a it'll give shape to a new industry.
1) If 1/3 of the users click on spam, that means that even if the spam filters on all the major servers/clients let 66% of the spam through, the user would have to click on ~50% of those spam mails.
2) If 1 in 10 users made the purchases? Have they have outdone google's ad model?
I suspect these numbers are reported by folks in the spam industry to project better success metrics and lure in more clients.
Injecting ads through POP3 is an interesting revenue model but it also enhances the SPAM problem. They will certainly not send individual email ads (those will simply be filtered out and are no better than SPAM). The only other option is ads at the bottom of emails. This has a couple of problems. Having ads in the signature of the email does make sense and is very easy to tweak. I'm guessing that if they took this route, you'll get clickthrough ad links. Impressions wouldn't work since those ads are not _useful_. Only a few select emails would contain ads (emails with large bodies so the text ad words don't have much weight which would be a concern for spam filters), and sent once for say, every 5 mails you recieve. The problem though is that text-ads in emails are sticky. The become a permanent part of your mail and even more so, since Gmail promotes archiving/storing all your mail. I'm sure people will have mixed feelings about this if they ever did take this route. Ads are just not cool when they become a permanent part of your conversations.
There are quite a few concerns about free storage and a warez API on top of gmail, but personally, I don't think it is a big concern and doesn't pose any significant risk to the gmail service.
Using a visual challenge to ensure that the user on the other end is human, will prevent automated scripts. You better have a lot of time downloading a file spread across a lot of emails (and a lot of accounts). While uploading is not a problem, downloading them will require you to invest quite a bit of time.
Some file storage for backup purposes is inevitable but warez exchange can be stumped (unless you want to trust leechers with your gmailwarez@gmail.com password).
Well, actually I just had another thought to counter my own argument. You could just forward the files to the leecher's account. Maybe they could setup limits on how many megs you can forward in x amount of time. But even then, you could forward it to 2 other accounts, and those 2 other accounts could then forward to 4 other accounts and so on...
It should be an interesting face-off.
Usability seeks to minimize the learning curve and optimize the speed of user-driven tasks. It relies quite heavily on abstraction. Security, in this context should aim to ensure that the level of abstraction does not create loss of information that can lead to an ill-informed decision.
.doc extension it will render his file useless since he can't double click and open it anymore. MS Word won't show up the file by default in the "open file" dialog box either, since it only shows known document files by default. All this adds to the confusion and increases the level of knowledge required about the system, to work around the problem. We take it for granted but a beginner has to know about file extensions, file/program associations and file types, then use these "elementary" concepts to open the file in the file dialog by choosing "display all files" from the "file type" list (even then the file will be missing his familiar word document icon) OR by renaming the file by adding a . (using the knowledge of file extensions), adding a "doc" extension (using knowledge of extensions and file associations). All this is over-whelming for the new user. Security folks don't think this way!
.doc extension can still be displayed (only greyed out). Hitting F2 highlights only the filename (the extension is still greyed out and unselected) so the user can type in a file name and the .doc extension remains intact (beyond the scope of the cursor). The user would have to hit the right arrow key to skip past the dot or hit delete button a few times to assign a new extension. In either case, when the scope of the cursor extends beyond the dot or touches upon the file extension, a warning could be displayed as a dialog box. The dialog box could have the option of "do not display warning in future". Additionally the warning dialog box could have the requirement that at least 3 instances of it must be displayed before the "do not display in warning in future" option is enabled (this is to handle accidental dismissals or users acting in a hurry (and for that it could require the user hit TAB -> ENTER or explictly click OK to dismiss rather than just enter)). Furthermore, the status bar could still always display the warning so it's less intrusive, but instructive none-the-less.
.doc file and it opened up in MS word). A file called report.doc.exe will arouse some suspiscion since it is not the norm they will get accustomed to. Further more, once they are bitten by that file, they will be more careful and their knowledge will have gone up. (using only icons cannot overcome the problem since exe files can have the same icon as a .doc document).
It is a design issue. The problem is that people who work on usability are not proficient in security and vice versa and for the two things to co-exists in harmony, requires extensive planning and effort on part of both security and usability teams.
For example, consider file extensions not being displayed by default in windows and being replaced by familiar icons. Not displaying file extensions by default allows for easier renaming. If the "stupid" user renames the file and forgets to add a
Going back to my orignal argument. It is a design issue. We are accustomed to and inclined to think in terms of windows GUI and moulding existing systems for security. If these systems were designed from the ground up with security in mind a solution to the problem is certainly achievable.
In the case of my example, the
Does enabling file extensions improve security? Not immediately, but if the users were always accustomed to file extensions the concept of file extensions/program-association would be implicitly relayed to them (by cognitive association -- every time the user clicked a
I do agree, however, that security requires the user to be more knowledgeable and usability assumes "stupid" users, but like in the example above. The two conce