[packagekit] This dialog sucks

[Duncan Mac-Vicar Prett]

James Antill wrote:
> On Wed, 2009-04-22 at 18:16 +0200, Duncan Mac-Vicar Prett wrote:
>> However, we could not find much on this graphical hash generation more
>> than the ascii stuff gnupg uses. But I think it is an interesting
>> direction.
> 
>  The place I've seen this used well is for anonymous blog posters, where
> a unique pictures is generated from an ip address:
> 
> http://en.wikipedia.org/wiki/Identicon
> 
> ...converting this to work for GPG keys shouldn't be too hard. But given
> most users only see it once, I'm less inclined to believe it'll help.
> 

As I mention, the real solution is to not show the dialog by making the
verification engine smarter.

Nobody cares about security, so we have to make it very implicit. You
can't just get rid of the security problem.

IMO you can move the buttons as much as you like, add longs texts of
explanations what is happening, and the result of Grandma will be the
same. Don't read the text and click "continue", because she will not
care what a signature is and she just can't compare fingerprints.

However, if you tell her to compare a picture with the one in the
company website, or show the two pictures when they changed, you may
have a chance that some users go to the website and compare the
pictures, or that click no when it changes. Even if still most people
will just click "continue".

While there are may be more possible options to make the dialog friedly,
I am convinced that:

* moving/adding text/buttons around adds zero value
* the real solution is to avoid asking the user
* minimal improvements can be achieved by some radical ideas, in case
one HAS to show the dialog.

-- 
Duncan Mac-Vicar P. - Engineering Manager, YaST
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)