- From: Adrien de Croy <adrien@qbik.com>
- Date: Mon, 20 Sep 2010 20:46:54 +1200
- To: Anne van Kesteren <annevk@opera.com>
- CC: Willy Tarreau <w@1wt.eu>, Mark Nottingham <mnot@mnot.net>, HTTP Working Group <ietf-http-wg@w3.org>, Roy Fielding <fielding@gbiv.com>
I think we need to balance the reluctance to assault users with error messages with the potential for mischief such responses could contain. In the past there may not have been many real smuggling exploits that had any real damaging effect. It would only take one vulnerability to be exploited on a wide scale to change user attitudes towards such things, and have users baying for blood - "you knew about this before, why didn't you do something about it!!!??!!!!" I'm no PR person, but how you present it makes an enormous difference. One could adopt the approach google takes with suspicious sites - post a big red page stating the site appears to be doing something potentially dangerous (the truth). If the user really wishes, give them a button where they can proceed ignoring the warning. Doing it this way provides a point of difference ("see we protect you from this as well") as opposed to yet another pointless nag dialog. Plus it provides an enormous incentive for site operators to fix the problem. On 20/09/2010 8:06 p.m., Anne van Kesteren wrote: > On Mon, 20 Sep 2010 07:57:56 +0200, Mark Nottingham <mnot@mnot.net> > wrote: >> Two replied that they have concerns about displaying errors to end >> users. If they come on-list and discuss their concerns, we can >> discuss this more. > > I was one of those if I remember correctly. End users just do not > understand such error messages. And since they cannot do anything with > them either showing error messages to end users will just make them > confused, which gives them a bad product experience. It is exactly the > same problem with asking users if they are okay with doing the request > using the method CHICKEN to this other location. They'll just go "WTF" > hit "OK" and hope it works, which is not that great really. Or worse, > terminate the browser and start over. > > -- Adrien de Croy - WinGate Proxy Server - http://www.wingate.com
Received on Monday, 20 September 2010 08:47:34 UTC