OpenSSL security fix for human beings

[Dylan McCall]

First off, kudos to those involed with the openssl fix. It was swiftly
produced and in the repos within record time. I had learned about the
problem earlier today and welcomed the updates quite happily. (As well
as their instructions. Those info popups are cool). However, one
question very quickly sprang to mind: Did usability people look at this?
I assume that almost every user of Ubuntu with ubuntu-standard
installed encountered at least some of these ssl related updates, which
should make usability an issue worth considering.


Various problems:

-I experienced not one, but three popups telling me about the update.
The first one was a big one, clearly instructing me to run "ssh-keygen
-l -f HOST_KEY_FILE" when I log back in. It also told me that something
would be done for me on log in. (Which has me wondering: Do I actually
need to run that command? I jumped through the message rather quickly).
The message was very long and deeply technical. It was informative, but
even the command it gave me (and I instinctively copied) is useless:
What is HOST_KEY_FILE? I smell confused and angry phone calls / support
requests already.

-Another popup message shortly after, with very similar contents.
Slightly shorter. The gist of it was that a security flaw had been
detected on my system (eeek!) and it was now being fixed after a
restart. Note: Telling me about the restart is a tad redundant in the
first place, thanks to that icon and notification bubble.

-A third popup message came along, again the same thing. This one was a
bit more concise, with instructions for what to do. It also, nicely
enough, told me to ignore the message if I did not know what it was
about. That is definitely the most user friendly of the three, although
even it bothered me. I think, on the usability front, a nice thing with
GNOME (and Ubuntu by extension) is not belittling the user. That is,
never presenting information the user does not know about and then
telling him to just ignore it because "it means nothing to him". If
information means nothing to the user, it should not be waved under his
nose. If it does mean something to the user, it should be presented
clearly. The result: Users get used to reading what is on screen instead
of frantically avoiding scary technical information.

Sorry, I should have copied the messages and what package they were
coming from. I know the three there don't say much, since I have many
packages which are not default. For that matter, the first two with
which I am concerned may have been my own doing and of a technical
nature themselves... Will run the update later on another box to see.
Still, it seems odd to me that openssh-client, openssh-server and
openssl would all be saying essentially the same thing with varying
levels of complexity.


What I am really concerned about here is how capable our existing
infrastructure for major security updates is of being user friendly. I
suppose the update script wanted me to run that command myself since it
is running as root (so it would be bad for it to do that), which does
expose some problems: Here an updater that needs to change something for
a user is giving the user instructions that it should seemingly be able
to follow itself.

Perhaps the issue here is really nonexistent. After all, Ubuntu has had
truckloads of security updates by now and this is the first one I have
seen to have presented a usability issue... and looking at Ubuntu
Forums, it appears to have gone relatively unnoticed. Most updates
handle themselves quite tidily.
Furthermore, good Vulcan logic dictates that critical security updates
should not be slowed down for the sake of usability review.

Still, I think it could be worthwhile to give a little heads-up about
this event before a rambo releases an update telling people to run rm
-rf ~/something as their own users (sure to get CLI paranoiacs up in
arms! :P). Is there a system in place for a rapid usability review
"queue" of some type? Could be interesting to ponder. There was a post
(I believe to the ubuntu-art list) about a magical way of sorting
discussions in a hierarchy by
topic-problem-solution-problem-solution-etc..., which could work wonders
for such a thing. What we need is a way to very, very quickly get
software (packages in general? automagically?) reviewed for usability
and have it confirmed that there are no outstanding issues within a very
short time.

I think Ubuntu's speedy updates on any day of the week are a great
strength, but so is usability. To be truly user-friendly, though, that
philosophy of usability must be present everywhere from the web site to
the security patches. It seems to me, though, that this security update
had very little time in which to get a proper look at how it could be
applied without disturbing users. Indeed, I fear that it, with all the
crazy popup messages and (repeated!) instructions, may be unnecessarily
disruptive.

Alternatively, maybe I just messed up my system :P

Bye,
-Dylan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : https://lists.ubuntu.com/archives/ubuntu-desktop/attachments/20080514/39fe421c/attachment.pgp