Slashdot Log In
When Does Usability Become a Liability?
Posted by
Cliff
on Mon Apr 12, 2004 03:12 PM
from the stuff-to-discuss dept.
from the stuff-to-discuss dept.
nasteric asks: "I caught myself in the middle of a very interesting discussion last Friday over Krispy Kreme donuts and coffee. The discussion had to do with usability and security. Many of the Microsoft Administrators I work with argued the more user friendly Linux becomes, the more vulnerable it becomes. They claimed making Linux a friend of Joe User will require it to 'open itself up' and become more susceptible to attack. Needless to say, this became an endless debate between our Microsoft Administrators and our Linux/Unix Administrators that will undoubtedly continue into the morning. Therefore I pose this question to the Slashdot community. Will making Linux more user friendly result in it becoming less secure? Hopefully your expertise will help shed some light on (and bring to and end) our discussion." Does decent usability necessarily imply the presence of vulnerabilities? Macs seem to have this area down pretty well, with little in the way of vulnerabilities. Can Linux software follow the same route?
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Simple (Score:5, Funny)
Write better SQL! (Score:5, Funny)
Parent
Yes (Score:5, Insightful)
Re:Yes (Score:5, Insightful)
Hmm, I was under the impression that most viruses these days just need a stupid email client (read: Outlook), with no intervention by the user required one way or the other.
Yes, I suppose there may be a way to disable the braindeadedness of Outlook, and that some may regard users as "stupid" if they do not lock down their system in this way. But, given that MS pitches Windows as the everyman's OS, does it not make much more sense to place the burden on *them* to provide a reasonably secure default setup, such that it is reasonably resistant to simple script-kiddie attacks "out of the box"?
There's a difference between stupidity and ignorance. In this case, it seems to me that the OS design is stupid, and if the user is ignorant of this fact, then they are in trouble.
Parent
Re:Yes (Score:5, Informative)
Parent
Usability is always a liability. (Score:5, Funny)
Re:Usability is always a liability. (Score:5, Funny)
Parent
Re:Usability is always a liability. (Score:5, Funny)
Parent
It's all in the install program... (Score:5, Insightful)
One of the biggest design flaws in Linux from a usablity perspective is that nearly every service that comes with the system is turned on by default.
Re:It's all in the install program... (Score:5, Insightful)
Linux's usablility problem does not derive from this very prudent choice, but from the difficulty of discovering how to turn any particular service on or off.
-jcr
Parent
It's all about the end user (Score:5, Interesting)
Making Linux more user friendly, in my mind, means improving upon the features that revolve around the GUI. The great thing about Linux is how much you can customize it; you can strip away the GUI and have a powerful production-level server environment. This is different from Microsoft products, as the ease of usability encompases the operating system.
Linux is much more "modular", in that you can build exactly what you want; an installation could take up anywhere from a few megs to a few gigs. The security and vulnerability lies in the end user.
Mac OS X "trojan"? (Score:5, Insightful)
It doesn't "expose" some fatal flaw in the OS, nor is it some newly discovered exploit. All it is was an application that displayed a dialog box. Mac OS applications (with the exception of Cocoa applications) have always been able to have:
a.) any icon, and
b.) any name
The only remotely slightly interesting feature of this proof-of-concept was that it stored the executable code within an MP3 ID3 tag, and even contained valid MP3 data. But that's mostly irrelevant, since the executable code could be anywhere, and the code can't even be moved in raw binary form without destroying the resource fork. Though the major media outlets haven't picked up on the subtleties of this thanks to Intego's FUD-mongering and self-serving press release, this "trojan" is nothing more than a Carbon application. (Though, the discussion that comes of this will be fruitful: maybe Apple will revisit yet again the filesystem metadata vs. file extension dichotomy, and discuss novel ways of visually identifying executables, perhaps in the same fashion as aliases.)
So, to get on-topic, no, an OS doesn't necessarily have to become less secure to become user-friendly. Some (most?) of the security of an operating system, both from a user perspective and network perspective, comes from underlying philosophical design principles and fundamentals - not to mention the intensive peer examination that open source software encourages. Sure, some user-friendly "features", such as auto-opening attachments in the preview pane of Outlook, exist to make things "easier" for the user. But this is a wrongheaded approach: a sensible focus on security can solve the majority of problems without necessarily making it harder on the user. Ease of use and security aren't entirely, or even mostly, mutually exclusive.
The key is making security easy to use.
But the age-old technique of "tricking the user" will ALWAYS be possible via various means, on any OS on any platform.
Re:Mac OS X "trojan"? (Score:5, Informative)
I assume that most Mac mailers observe the MacMIME [cmu.edu] spec. This makes sending forked files through email a transparent process.
(Not arguing with the rest of your post -- I think it would be a lot easier to trojan Mac users with a "Install this Cool Screensaver" thing instead of jumping through hoops with a fake MP3.)
Parent
If Usability implies vunerability... (Score:5, Insightful)
Absolutely Inevitable. (Score:5, Insightful)
Once Linux gets to the point that it can be administered by people who aren't dedicated specialists, it's inevitable they will try it out and that most of these people will be less careful administrators. After all they aren't dedicated *nix admins and will often wear many hats in their organization. This doesn't mean that Linux is insecure, it's just a growing pain that it has to go through.
Don't forget how many people fall into the "it's working, it's now forgotten" category. These are the people that only perform oil changes on their cars and wonder why it eventually breaks down on them - and there are a lot of them. They won't patch it, back it up or anything else until the day it inevitably comes crashing down around them.
Ok, we're on to you. (Score:5, Funny)
Cheese it, it's the cops!
Yes (Score:5, Interesting)
A "user friendly Linux" (Lindows, anyone?) will have to be very, very careful not to end up down this same path.
Re:Yes (Score:5, Informative)
There is no need to log into an admin account to do any of this kind of stuff under OS X.
I've also never seen an OS X app that says you have to give all users all perms to the root folder, or have everyone running as admin, or open up the program folder for everyone to write to because settings are being stored in the wrong dang place.
Windows could be a lot more secure, but Microsoft doesn't go far enough to shame software vendors into sticking to the logo requirements. How many times have you Windows admins had to support a desktop app or driver for a peripheral that REQUIRES admin or power user rights? It's insane that there are Windows programmers that are still writing crap like this today.
Parent
It's all in the account setup... (Score:5, Insightful)
It's really more of a user eductation issue than a technical one. The best security practices are usually in counter to an element of ease of use.
Re:It's all in the account setup... (Score:5, Informative)
Except it's not quite the same. On Linux, graphical apps, at least the ones that are part of the distro's admin tools, prompt for the root password if they are started by a regular user. Windows XP, as far as I've been able to tell, doesn't do this. Ordinary *nix apps are designed to run with user-level privileges, and this has been so from the beginning. Many Windows apps, however, are written with a permissive environment like Windows 95/98 in mind, so apps do things that only work if the "Program Files" directory is writable. Most Linux distros have a regular user account created as part of the installation. Any additional users created as part of a Windows XP installation have Administrator privileges by default.
On a typical Linux box, running as a regular user is usually the path of least resistance. The opposite is true for Windows XP.
Parent
"Microsoft Administrators" have no perspective (Score:5, Interesting)
- user-friendly
- vulnerable
and so they think anything that's user friendly must be vulnerable. A classic logic error, whose name I forget right now.User friendly does NOT imply vulnerable, nor vice versa. I've posted before about building secure systems and securing existing ones. The techniques are, for the most part, well known albeit tedious, though I do anyway. (I even posted a security advisory to BUGTRAQ today...)
As long as the people making Linux user friendly keep security in mind when designing and implementing the new features, there will be no problem.
The anti-usability bullshit must stop. (Score:5, Insightful)
Of course if you have elitist programmer types who use their case-modded Amiga's to talk to talk to each in Klingon don't expect your user experience to be one 'Joe User' can use or enjoy. If you are one of those people who are disdainful of people not as smart as you and want to keep Linux/OSS in the hands of your CRT tanned brethren then by all means continue to disparage and FUD usability all day long - just don't complain about Linux's adoption - EVER.
A few things for folks to remember:
Using Security (Score:5, Interesting)
SELinux (or, hopefully, a similar system with a sane configuration/management interface) can also assist with this by limiting what vulnerabilities can do.
And the interface design itself helps. Microsoft's attempts at usability equate to "do everything automatically." Compare this to GNOME where the design is based not on automation, but on streamlining. I fully believe GNOME is *more* usable than Windows in almost every way, yet it hasn't the security problems as apps don't try to auto-run executables from untrusted sources, embed scripting languages with system-modification abilities, etc.
In truth, the interface can be designed such that it makes using security easier, vs hiding security away.
MS Admins are experts on Linux security? (Score:5, Funny)
Apple doesn't think so (Score:5, Interesting)
One nice trick Apple discovered is to have the users be non-root, yet still administrative. (Did you hear that, Lindows?) They did this by creating tools that run as root, but which require authentication to run. For example, a mortal user who is an administator can't trash the whole filesystem by dragging and dropping important items, because they are not root. But they can run Software Update, an application for downloading patches, by supplying a username and password.
On Linux you can add users to the group "wheel" and make them sudoers with much the same effect.
Apple also made many important directories like /etc invisible from within the GUI, which I think is a great idea as long as power users can turn it off.
Seems easy and secure to me...
Guess what (Score:5, Insightful)
As secure as you think OSX is, anyone who wanted to write an application to fuck stuff up, call it "Super Happy Funtime Sexy Game", and email it to morons, could do so just as easily as they could with a VBScript file.
I could write:
#!\bin\sh
rm -rf
cat
echo Linux is teh gay!
Email it to some stupid people, tell them they have to run it as root or else they wont see the video of Condoleeza Rice's tits.
Stupid people will run what came with the box they bought at Best Buy. When those boxes start shipping with linux, they'll be on linux. The REALLY stupid people shop at K-Mart, who I understand are in the business of ubercheap linux boxes these days.
Be afraid, be very afraid, of the rootkits that get put on this new army of lindows boxes.
Re:Guess what (Score:5, Interesting)
Why is this modded as insightful? Anybody who knows how to run something as root (and how to do it) would know how to look at the script and decide what it's doing. It's not like OS X has a "Run as Root" button on the toolbar or anything.
Yes, people can do stupid things. But if you sent that to your average OS X non-power-user, they would do absolutely no damage whatsoever, no matter how much they tried.
Parent
Maybe... Need more sandboxes/restricted userids... (Score:5, Insightful)
I think that maybe all vulnerable processes, like web browsers, irc clients etc should run under a separate uid from the user (maybe each user should have 2 uid's - one normal, and one restricted so that it can only access a subdirectory of the users home). So rather than Mozilla launching as user fredbloggs:fredbloggs, it launches as "fredbloggs_restricted:fredbloggs_restricted" by default. The user could then chown some directory to be writable to fredbloggs_restricted" for downloads, cache etc.
Maybe this is already implemented? The real problem though is that a user could still build and run something they downloaded, potentially wiping all their files, unless a mechanism automatically made anything they installed themselves, run as the restricted user and not their own uid:gid.
Does any of that make sense?
Re:Maybe... Need more sandboxes/restricted userids (Score:5, Interesting)
Nope. Any system that doesn't allow the user to do whatever they want to do is going to is not user friendly. We've got two somewhat paradoxical concepts here.
Users will always want to be runing at root at all times. Some won't grasp the security implications until it's too late.
Parent
user friendly means stable code (Score:5, Insightful)
My point is, moving towards usability shouldn't mean that we should loosen our belts, allowing the user to run amock in the system, we should tighten them.
Memory Permissions (Score:5, Insightful)
Usability, however, does have to do with coherent UI design: picking icons that communicate what the button does on a toolbar, grouping menus is a logical way, making sure that there are keystrokes available for commonly used features, etc.
It sounds like the Microsofties have confused usability with Feature Creep.
Now.. the more people running Linux may in fact lead to more vulnerabilities being found, since testing only proves the existence of bugs, not the absence. However, history shows that bugs are fixed much quicker in open source then in closed source, so that's a race Linux wins easily. But as far as usability, comparing the latest KDE and GNOME desktop to Windows XP just shows that as far as usability, Linux may have already surpassed Windows.
The List (Score:5, Funny)
Re:Here we go again... (Score:5, Insightful)
Parent
Re:Here we go again... (Score:5, Insightful)
When a hole is discovered, the number of people who get hacked is equal to the number of people who are running the affected software who don't patch in time.
If a luser wants to run telnet to get to their Linux server as root... they're just asking for trouble. Good thing most people who understand what to do at a bash prompt already know that. The problem comes when people who don't understand that SSH is better for a huge reason want to see a Linux command prompt on a remote server...
Parent
Re:Here we go again... (Score:5, Insightful)
This theory needs only a slight modification to become valid...
It's popularity among stupid people that breeds vulnerabilities.
Apache may not have very many holes, but it's far too easy to write a PHP script that gives away the keys to the kingdom if you're not careful. A password of "password" is insecure on any system.
Parent
Re:Wha? (Score:5, Insightful)
Extremely poor analogy.
We spend literally decades learning to read and write and even then very few people are actually any good at writing books. Natural language is also, compared to computer languages, extremely stable. Natural language are also exactly that - natural. Our brains evolved to support them and our languages evolved over millenia to suit our brains.
Understanding images is considerably more important than language and certainly long pre-dates any human language- written or spoken.
And I'm sure you've heard the expression "A picture is worth a thousand words".
So, your point would be?
Parent
Re:Wha? (Score:5, Funny)
A picture is not ~1000 words.
Parent
Re:Wha? (Score:5, Funny)
Parent
This depends on what you define as ease of use... (Score:5, Insightful)
There's a lot of things that are purely cumbersome because of the GUI under XP or MacOS.
Parent
Re:Wha? (Score:5, Insightful)
What is easier - a multiple choice test, or a fill in the blank test?
Parent
Re:Wha? (Score:5, Informative)
Sorry, I do not have the source available. The study was discussed in the NYT within the last year or so.
Parent
Re:Wha? (Score:5, Insightful)
Seriously though, I'm an author and do a lot of writing. We are a visual species - look at the popularity of TV, movies, and video games. Why are GUIs popular? It gives you a lot of information in a small amount of space. Think small applets, like CPU usage or disk usage. More information can be sent quicker using a pie graph and setting colors than just giving raw capacity and percentage used.
But writing is much more precise. When you write something down, you need to know *exactly* what you're saying and who you're saying it to. Otherwise the meaning could be lost.
Parent
Re:Wha? (Score:5, Insightful)
Parent
Re:Wha? (Score:5, Interesting)
It depends. The command line can be quite user friendly.
copy a b
That's a fairly easy way to understand how to copy a file in dos. But in the gui world, a person has to remember to right click and say copy (or ctrl+c) and then right click on the destination and say paste (or ctrl+v). Or remember that if dragging files between folders not on the same drive, the file is copied by default but if dragging between folders on the same drive move is the default in windows. KDE does this better, always asking the user what to do with files drug from one location to another.
As far as your example goes, it really depends on the os. In my copy example above, linux would have the user us cp. Well, how does the user know that? If the os let a person say:
burn song.wav to cd1 as audio-cd
burn all songs in c:\mp3 to cd1 as data-cd
that would be pretty easy and friendly. But no os does that AFAIK. No reason you couldn't make a bash alias to do that and then it would be easy for people.
On the other hand, I just found a really handy little program called sequoiaview that gives you a visual representation of how much space your files and folders occupy on a drive or network share. There's no way a command line utility could convey the amount of information in the sequoiaview window in as easy a fashion.
The thing to remember is that usability is Hard. Very Hard. But it isn't the medium that's restrictive, it's the capabilities of the person creating the interface.
Parent
Command lines aren't *learner* friendly (Score:5, Insightful)
Once you have that training, the command line is a very useful tool. But if you can't get the training, and aren't self-sufficient or technically apt enough to go to the bookstore and buy a book on how to use the command line, you're screwed.
That's why people like having icons for things. The message icon is your mail program. Don't have to remember what it's name is, or where it's at. Just click.
Parent
Command Lines Different kind of Learning (Score:5, Insightful)
Parent
Re:Command lines aren't *learner* friendly (Score:5, Funny)
Parent
Re:Wha? (Score:5, Interesting)
Tracy Hickman (of Dragonlance fame.) has professed to using a "help you write" tool. Despite using what ammounts to a novel-wizard, his last four or five books were all NYT best-sellers. And he probably wrote the manuscripts in a GUI environment.
As for the CLI itself--it's not that CLIs can't be user-friendly, it's that they simply aren't. A user-friendly, intuitive command line would:
* Have plain-language redirects to all commands (swipe some code from a twenty-year old Command-line game if you must!)
* Have a help-file that's intuitively found and starts with the basics--file maniuplation, directory navigation, et al.
* Give immediate and clear feedback that something is working.
Parent
Re:Wha? (Score:5, Interesting)
Talk about an asinine knee-jerk reaction!
The whole point of bringing up OS X was as a proof-of-concept that the sort of user-friendliness which Linux is moving towards does not automatically mean weak security. It has nothing to do with flame-wars, and everything to do to paying attention to what others in the industry are doing. (Something everybody should do, unless they want to lose in the long run.)
let me add to the discussion... Windows and Linux admins in the same organization? What organization is this?!
Damn near every Linux-centric organization I've ever been a part of, for a start. If you are a software company, you are going to have customers on Windows. If you are going to support those customers at all, you need to make your shit work in a Windows environment, which means maintaining a Windows environment.
Mixed environments are the norm, not the rule. A lot of companies even have a few Novell systems lying around doing stuff. Show me a "pure" Linux shop, or a "pure" Windows shop, and I'll show you an IS department run by a raging platform bigot.
Why do people think that the command line is *not* "user friendly"?
The command line is extremely user friendly. Having to remember the names and locations of dozens of config files in order to perform basic upkeep and maintenance of your server is not. I don't know about you, but I need to crack a book open to remind myself how to add a virtual host to my Apache web server each time I do it. If I was constantly editing the httpd.cnfg file (or whatever the hell it is), I wouldn't need to look it up every few months just to remember all the lines that need to be changed, but since it's only an occational change, a GUI front-end that held my hand through the process would not be entirely unwelcome. Granted, a badly designed GUI tool which lacked the flexibility I expect from raw config file edits would be ignored, but do it right and I would never need to open that file in vi again. That's what people mean when they say "user friendly."
Parent
Re:Mac Security (Score:5, Interesting)
This means that yes, a trojan horse could run, and yes, it could keep running until the user logs out, and maybe even add a login item on a per-user basis, but it can't install anything into the system that runs at startup unless the user explicitly enters a password to say that "yes, I really expected this to be installing something". This simple authentication requirement would have prevented 99% of what has made Windows viruses so virulent.
In fact, the best form of user-friendly security basically amounts to having a bunch of policies for things that shouldn't generally happen, then shouting at the user and asking if you really want to do that. This concept has been popping up repeatedly on the Mac platform ever since the classic "GateKeeper" virus checker extension. I remember saying that I wanted to see an OS do exactly this sort of sanity checking (don't let an application modify the OS without user permission) back when I was still in elementary school (mid-eighties).
So here's what I don't get.... If this was obvious to me at about age 10, what does that say about companies that still haven't figured out how to implement such a basic security measure? And why would anyone in his/her right mind use an OS like Windows whose security policies haven't caught up to what seemed obvious to a 10-year-old kid almost 20 years ago?
For shame.
Parent