Warning: Cannot modify header information - headers already sent by (output started at /home/cssquirrel/www.cssquirrel.com/blog/index.php:4) in /home/cssquirrel/www.cssquirrel.com/blog/wp-includes/feed-rss2.php on line 8
CSSquirrel » Drama http://cssquirrel.com/blog opinions and news on web design Mon, 06 Feb 2012 17:41:49 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Snow, Blood and Cookies http://cssquirrel.com/blog/2011/12/09/snow-blood-and-cookies/ http://cssquirrel.com/blog/2011/12/09/snow-blood-and-cookies/#comments Fri, 09 Dec 2011 21:29:19 +0000 Kyle Weems http://cssquirrel.com/blog/?p=991 CSSquirrel #90: Snow, Blood and Cookies

Today’s comic features Opera’s viking doing some nasty, brutal stuff. Because if a public community representative of Opera acts out of line, and the company doesn’t call them on it, they might as well be endorsing it. Luke Wroblewski also stars as the stand-in for well-meaning folk who are trying make peace at the expense of correcting bad behavior.

Buckle up.

I’m going to throw myself on the grenade and be the curmudgeon.

You don’t have to like what I’m about to say, but I think you need to read it.

We are, as a community, allowing ourselves to be abused. We’re Kevin Bacon in Animal House, bent over in our underwear and thanking someone for beating us. And, like any sadist with a free pass, they’re continuing to hit us again, and again, and again.

I get it. It’s the holidays. We’re stressed out by end-of-year deadlines, driving on icy roads and getting our Christmas shopping completed and hoping that at the end of the day we can kick back an egg-nog and just be merry. We don’t want the stress of confronting and condemning bad behavior, so we’re trying our damnedest to shrug it off.

Additionally, most of us want to be liked. And we want our friends to like each other. Whether it’s in our neighborhoods, in our Facebook profiles, or in our professional circles we just want people to be friendly and think highly of one another, but especially us. So when a flare-up starts between two peers we’d rather put our fingers in our ears and hum the Benny Hill theme song than owe up to the fact that there’s a problem.

But I’m here to be the bearer of bad news: there is a problem. Not only that, we’re responsible for it.

When I was growing up, my mother made it clear that certain behavior was not acceptable. Among other rules of childhood, I couldn’t go about tossing insults at people. Not my parents. Not my siblings and not friends. Heck, I was expected to maintain at least some decorum around the kids I disliked.

Going outside the bounds of socially acceptable behavior carried with it a penalty. Maybe soap in the mouth, or a spanking, or being grounded in my room, or at the bare minimum no desert after dinner. It was unpleasant. I was a pretty big crybaby, so any sort of punishment or chastising resulted in a waterfall of tears and a sniffling cry that would last for hours. I guarantee my mother hated having to deal with it. She probably would have enjoyed her evenings much more pretending I didn’t doing anything wrong, instead of listening to me cry and sniffle in my room as she desperately tried to read a book in peace.

But she did it anyway. As a result, I learned the difference between right and wrong and stopped doing the bad behavior. It didn’t mean that I stopped thinking ill of kids I disliked, or devising a choice insult for my brother when he provoked my ire. But it did mean I knew it was unacceptable to act on those thoughts, and it made me consider my words before I said them. If, after a good hard think I decided it was worth provoking my mother’s wrath, I’d still take the risk of insulting someone.

I did, however, think first.

In a pattern that goes back probably for quite some time but for certain seems to have flared up this week we’ve been permitting ourselves to be subject to bad behavior. We’d rather read our books in peace, so we are ignoring the misdeeds of an entitled few in the hopes that it will all go away.

And it’s not going away.

There’s literally thousands of amazing, talented developers and designers currently involved in making the Web a better place. A whole lot of them are like me, working hard for a very modest living in a small design firm that doesn’t get awards or fancy big-name clients. A great many also work as embedded Web people in a large corporation or other entity, thanklessly fighting the ignorance or misinformation of their bosses and co-workers while trying to apply their awesome skills to making their corporate site a better, slicker place to visit.

Then there’s the superstars, Web folk that work as community representatives and star developers for the big Web companies that take leadership roles (by fiat or by standards) in developing and proselytizing the advancement of the very technologies we use to make awesome Web stuff.

These people don’t just speak at conferences, they speak at dozens of conferences. They don’t just make cool web projects. They make amazing, cutting-edge projects that push forward the meaning of “good Web design”. They talk a lot about community participation and self-learning and being involved.

They’re intelligent, creative and successful people.

Sometimes, they can be utter dicks.

Anyone can be a jerk. From the drug-addled homeless man currently shooting up in the alley down the street from my office to the richest men in the world. Every person is capable of forgetting those lessons in basic decency that their parents (hopefully) taught them as children and slip up from time to time.

When it happens, it’s usually considered acceptable to say “Dude. No.”

The worse the bad behavior, usually the more stringent the chastisement should be. Action. Consequence. It’s a no-brainer, right?

But what happens when thought leaders, community representatives of important companies in the industry, and superstar talents start to repeatedly engage in or endorse bad behavior? It usually goes something like this.

  1. The superstar does something socially unacceptable. Like refer to a recent article by the owner of a small design firm as drug-enduced bullshit. (original was deleted, here’s a retweet).
  2. Individuals call the superstar on the behavior, noting how unacceptable an action it is. Especially for a community representative of a major player in our industry (although, really, it’s just unacceptable period).
  3. The superstar sort of apologizes. Usually in the vein of “I’m sorry for using strong language” or “I’m sorry you got upset”.
  4. The individuals (rightfully) insist that’s not an acceptable response, and demand a genuine, public apology.
  5. The superstar does so.
  6. Supporters of the superstar retaliate by calling the original individuals the curmudgeons in this situation. They in essence defend the bad behavior by shaming them for “bullying” the superstar, say the “crap” they’re saying is undeserved.
  7. The rest of the community, straining to retain a smile, do everything in their power to bury the “firestorm” under a (likely well meant) pile of hugs and cookies universally handed out to everyone involved, including those that defended the bad action and the superstar that did it in the first place. All are pardoned, nobody is wrong.
  8. The superstar states how tired they are of the drama… seemingly ignoring the fact that it was their own behavior that caused it.

This is all sorts of messed up. Nobody’s learned a lesson, because as a community we’re too concerned about “drama” that we’ll do anything to quash it instead of uniting as a community to call down the person who started the drama with their attack in the first place. We’re sending such a mixed message of supporting the peace or the person without collectively condemning the behavior.

Anyone who ever raised a kid or was a kid knows exactly where that will lead. To more bad behavior.

I’m not calling for punishment. But the launch of a pro-community “make the web better” website (which I will not be linking or mentioning by name for reasons I’ll make clear below) should have been a source of joy in the holiday season. Instead, two individuals tied to that effort have engaged in either passive/aggressive sniping or outright insulting of individuals and their efforts in this week alone. And according to people in the know, this isn’t the first time for some of those involved. And what kills me, what hurts me is how highly I thought of these people prior to now. But how can I promote the work of people who engage in socially abusive bad behavior?

I can’t. No matter how much I agree with the message of their product, I cannot in good conscience promote their goods and services when they’re behaving in a fashion that I know to be wrong. And as near as I can tell, they’re not sorry for how they’ve behaved. They’re simply sorry they were called on it.

The only way we’re going to improve as a community is to grow up and realize we can’t hide everything under soothing hugs and cookies. People messed up. Worse yet, people who are well known and respected representing companies with power or social clout messed up. If they are protected for their behavior, they will continue to abuse us, the community. And many of us will, over time, mimic that behavior in a misguided attempt to become as successful as they are.

Shame on you, Divya. Shame on you, Paul. You’re grown adults. You know better.

Next time you want to blame the drama, stop for a moment and think about who actually started it.

And to the rest of you, I’m sorry. I don’t want a cookie. I want it made clear that this behavior should never have happened, and can’t be allowed to keep occurring.

Happy holidays.

]]>
http://cssquirrel.com/blog/2011/12/09/snow-blood-and-cookies/feed/ 18
Surrender Monkey http://cssquirrel.com/blog/2010/08/11/surrender-monkey/ http://cssquirrel.com/blog/2010/08/11/surrender-monkey/#comments Wed, 11 Aug 2010 20:50:47 +0000 Kyle Weems http://www.cssquirrel.com/?p=737 Gruber says: “It’s not that Google is worse on net neutrality than other companies with a stake in the mobile phone game. It’s that they made such a show of being better, of being on the side of the public interest — before they had a big stake in the game.”

Word.

This is in reference to this piece by Ryan Singel on Wired, entitled Why Google Became A Carrier-Humping, Net Neutrality Surrender Monkey.

Gruber’s response is short, sweet and quotable. Ryan’s piece is worth the read. Both manage to say, eloquently, reasons that Google’s behavior is poor behavior.

Cat’s out of the bag, Google. No more free passes for being the “people’s champion”.

]]>
http://cssquirrel.com/blog/2010/08/11/surrender-monkey/feed/ 0
Average Users Aren’t Idiots (We Don’t Live In Narnia and Your Friends Aren’t Talking Otters) http://cssquirrel.com/blog/2010/01/28/average-users-arent-idiots/ http://cssquirrel.com/blog/2010/01/28/average-users-arent-idiots/#comments Thu, 28 Jan 2010 17:27:33 +0000 Kyle Weems http://www.cssquirrel.com/?p=590 Ok, the iPad.

Whoop-dee-freaking-doo.

I’m annoyed by all the defense of the device’s failures by my peers who are justifying the shortcomings as features that only mega-geeks want; they say that the mythical ‘average user’, like some strange breed of lobotomized unicorn, is not interested in these issues. (*cough* Jeff Croft’s iPad Thoughts and Jason Beaird’s iPad: It’s not for us are two stellar examples of this ‘average user’ argument *cough*)

Really? Are you patting yourself on the back that much about how awesome you are that you think it’s still 1999 and we’re logging onto the Internet via a series of loud angry screeches? (Oh dialup modems, how I don’t miss you.) Virtually everyone (in America, at least) uses browsers on a very regular basis. Over 350 million people use Facebook. There’s been these little instant messaging programs with names like MSN or gTalk  for a long, long time now. My friend’s grandparents use Skype to talk to their friends in other countries.

What these people lack isn’t a taste for the features we geeks have been talking about. What they lack is the terminology for it. My mom isn’t going to say she wants “multitasking.” She is, however, going to want to have her browser open to look at websites while having access to her IM program to chat with family and friends.

That basic pair of tasks: browsing + chat, does not exist on the iPad. That is a single example that fits the everyday life of millions of people. To tell me that some sort of mythical upper class are the only ones who want to do that is to live a magical life in Narnia, where your friends are mostly talking animals; the majority of which lack opposable thumbs.

One last thing: the App Store. You want to run a program on the iPad? Better hope that Apple wants you to have it. Have fun surfing the Internet without Flash. For better or worse, a good part of the web still runs on it. Apple seems to be pushing farther towards a closed ecosystem, which is the complete opposite of what most of us standardistas believe in. You can’t pretend the device is the replacement to a netbook when it doesn’t have the same breadth and variety of software. Some people celebrate it, claiming the closed ecosystem of the App Store makes it somehow better, filled only with quality software.

Like iFart, which for a time was the #1 app in the store.

The iPad does have a lot going for it (however, the name is killing me.) But let’s not pretend that we’re some rare breed of horse, and that these shortcomings only impact 1% of users. Because that’s clearly a fantasy, and the average person lives in the real world, just like us.

]]>
http://cssquirrel.com/blog/2010/01/28/average-users-arent-idiots/feed/ 20
The Squirrel in Crisp Audio! SitePoint podcast “HTML5 is a beautiful mess” http://cssquirrel.com/blog/2010/01/15/the-squirrel-in-crisp-audio-sitepoint-podcast-html5-is-a-beautiful-mess/ http://cssquirrel.com/blog/2010/01/15/the-squirrel-in-crisp-audio-sitepoint-podcast-html5-is-a-beautiful-mess/#comments Fri, 15 Jan 2010 17:30:32 +0000 Kyle Weems http://www.cssquirrel.com/?p=564 On Wednesday I had the honor and pleasure of participating in a podcast recording session with HTML5 Doctor Bruce Lawson, Beginning Web Design author Ian Lloyd, and SitePoint’s Kevin Yank in a discussion about HTML5, and whether it’s just exploded over all our face.

The end product, “HTML5 is a beautiful mess” is now up at SitePoint. I’d be tickled pink if you took the time to listen.

As you may recall, I discussed ranted about this subject on Monday with the strip The HTML5 Show (AKA a Mess) and the related post.

Mostly, HTML5′s a mess in the political sense. The organizations behind it (W3C and WHATWG) are increasingly in conflict with one another. Additionally, in my opinion, Ian Hickson is increasingly disregarding any attempt at a legitimate process and simply putting what he pleases in the spec, as he pleases.

The podcast touches on that matter, and spins out to the state of the actual implementation of HTML5 itself, whether there’s a challenge in getting designers and developers to start using it, the issues of accessibility in <canvas>, and how delightful it’d be to move past plugins.

If I have one beef with the whole podcast, it’s the fact that I’m talking with a pair of Brits. Which, as every movie-going American knows, instantly sound more clever due to their crisp accents. Also, if the transcript is any guide, my sentences tend to roll off the rail quite a bit, inflicting casualties to adherents to the English language.

So, if you have the time, please go have a listen, and then please come on back here and post any thoughts you had at my butchery of verbs, the points that the participants brought up (or even better, the points we didn’t) and how lovely Bruce Lawson’s voice is.

]]>
http://cssquirrel.com/blog/2010/01/15/the-squirrel-in-crisp-audio-sitepoint-podcast-html5-is-a-beautiful-mess/feed/ 2
Designers and Code http://cssquirrel.com/blog/2009/10/14/designers-and-code/ http://cssquirrel.com/blog/2009/10/14/designers-and-code/#comments Wed, 14 Oct 2009 16:13:11 +0000 Kyle Weems http://www.cssquirrel.com/?p=477 I wasn’t at An Event Apart: Chicago 2009. But along with other desk jockeys, I followed along via A Feed Apart. One comment that got re-tweeted about seventy million times during the conference was the following quote by one Jeffrey Zeldman:

Real web designers write code. Always have, always will.

When I made a comment about the amount of retweets occurring on this post, I got a reply from Molly Holzschlag (who I respect, but am incapable of pronouncing the last name of):

Bless my pals at AEA but the entire comment is bait or a very misguided statement to make on the brink of 2010.

When two people who helped define the industry as it is today have a difference of opinion, I’m left on the sidelines wondering which to agree with. One the one hand, I agree with the concept that design needs to occur more in the browser and less in Photoshop, but on the flip side I suspect Molly has some insights that I’m simply not taking into account.

So I’ll throw it to the web at large. What’s your opinion on this topic? Do designers need to start doing more design in (X)HTML and CSS, or are we coders going too far in expecting the to put Photoshop aside in the early design phase?

]]>
http://cssquirrel.com/blog/2009/10/14/designers-and-code/feed/ 42
Comic Update: Redefining Resolved http://cssquirrel.com/blog/2009/10/06/comic-update-redefining-resolved/ http://cssquirrel.com/blog/2009/10/06/comic-update-redefining-resolved/#comments Tue, 06 Oct 2009 16:13:18 +0000 Kyle Weems http://www.cssquirrel.com/?p=461 Today’s comic imagines a scenario where Ian “The Leviathan” Hickson, HTML5 editor, “resolves” an issue as a plumber.

I’ve used quotation marks on “resolves” because the English language lacks punctuation to indicate sarcasm. I can only imagine what such a strange mark would look like, the black sheep that was expelled from the childhood home of Exclamation Point and Question Mark after a dispute with his stern father, Period. What would life on the streets do to such a symbol?

I considered using italics, but I didn’t want to look too sassy.

The @summary attribute has been the source of no little discomfort during the gestation process of HTML5, a token of sorts that is lauded, derided, despised and fought over in what seems like an endless battle. I discuss, in my own rambling fashion, my view of the civility of the issue here, which in turn references Bruce Lawson’s post on the topic, Alternate text in HTML5. It’s been the source of no small amount of contention, which I think John Foliot describes nicely over here.

Despite this, for some reason I’d (perhaps foolishly) thought that some sort of accord had occurred with @summary, allowing it to exist in HTML5 as a non-obsolete, conforming part of the spec (albeit with a great deal of snark involved).

I’d recently learned that not only was peace not occurring, but that @summary had found itself into the middle of another fracas. It seems that in an attempt to get HTML5 to reach Last Call status on schedule, Ian is marking unresolved issues in the bug tracker as “WONTFIX”, insisting that people with problems talk to the chairs, and moving on.

One such example of this in action is available for your reading pleasure in this W3C bug report. For those of you in a hurry, I’ll sum it up: People (such as the PFWG) have issue with @summary being marked in the HTML5 validator as “obsolete but conforming” along with a warning message.  Ian Hickson, man of action, disagrees with the PFWG’s opinion, won’t change the (inaccurate) flag, and has decided that the issue (among others) is resolved and simply marking it “WONTFIX.” Apparently it will keep this status, despite the large amount of opposition to this stance.

This is, as John Foliot puts it (in the same report)  “An affront to the web accessibility community that existing accessibility solutions that the current editor disagrees with have the status of WONTFIX simply because the editor disagrees.

I’m not sure, in the end, if @summary does or does not deserves the bad rap Ian’s trying to attach to it. But I do know, though, that I’m tired of seeing one “benevolent dictator” being capable of deciding the future of the open web single-handedly by sidestepping all the prior discussions and opposing views regarding HTML5 with a simple “WONTFIX” status.

]]>
http://cssquirrel.com/blog/2009/10/06/comic-update-redefining-resolved/feed/ 9
Comic Update: The W3C/WHATWG Community Theater Group http://cssquirrel.com/blog/2009/07/27/comic-update-the-w3cwhatwg-community-theater-group/ http://cssquirrel.com/blog/2009/07/27/comic-update-the-w3cwhatwg-community-theater-group/#comments Mon, 27 Jul 2009 16:18:36 +0000 Kyle Weems http://www.cssquirrel.com/?p=392 I can’t help but be shocked at times at the drama and ugliness that builds up around the HTML5 effort. Good men and women, thinking that they can make a difference, time and again enter the dangerous mailing lists of the W3C and WHAT WG only to be ignored at best or belittled and chewed to pieces. These are zones (allegedly) of collaboration, but instead seem more at times like zones of war.

Go ahead and take a look for yourselves.

I’d think that this was just me overreacting, but when I tweeted on Sunday about my thoughts on the drama in the lists, I got a number of responses that illustrate that I’m not alone in my perception.

Jin Yang indicated that popcorn was a good snack while watching the drama unfold. After I made a bar brawl analogy, David Peterson suggested that whiskey might help them calm down, and that his two year old has progressed farther in the manners department. John Foliot provided some perspective sharing that this “us & them” mentality is a relatively new thing. And Manu Sporny joked that the W3C and WHAT WG originated as community theater groups.

Naturally, his joke was comedy, not fact. But I couldn’t help but think, what if…? So today’s comic portrays Manu Sporny and the Squirrel attending a fateful showing of Our American Cousin.

I want to say that I do see a lot of polite dialogue in the lists. I’m just amazed at how much bad behavior (sometimes well dressed, mind you) makes it into the discussions. Here’s hoping the good outweighs the bad by the time Last Call rolls around.

(As a closing note, I like the term Dundrearyisms.)

]]>
http://cssquirrel.com/blog/2009/07/27/comic-update-the-w3cwhatwg-community-theater-group/feed/ 4
Comic Update: The HTML5 Suggestion Box http://cssquirrel.com/blog/2009/07/20/comic-update-the-html5-suggestion-box/ http://cssquirrel.com/blog/2009/07/20/comic-update-the-html5-suggestion-box/#comments Mon, 20 Jul 2009 15:46:45 +0000 Kyle Weems http://www.cssquirrel.com/?p=385 In one of his recent lengthy, marathonesque comments in other people’s blog posts, John Allsopp said the following quote in response to Bruce Lawson’s post HTML is a mess: “I guess one of the reasons folks are resorting to raising their legitimate concerns in public fora, rather than directly with the HTML WG (or should that be the WhatWG, or maybe both?) is possible they don’t have a tonne of faith in the process.”

This comment by John sent me down several interesting paths of consideration. Firstly, it made me think that Mr. Allsopp might spend more time writing in other people’s blogs than his own, much like Jeff Croft (who I had the fortune to see at Refresh Bellingham last week) appears to spend more time in every other city in America than the one in which he lives.

Secondly, I briefly thought that I’d start spelling “ton” (American spelling) like “tonne” (which appears to be the Australian, and I’ll bet also the UK spelling). I quickly discarded that plan, since it’d just limit my word count in Twitter. Which made me wonder, do Japanese users of Twitter get to use kanji in their tweets? If so, that seems highly unfair. They could fit a War & Peace sized comment in a single tweet that way. (Note to self: learn Japanese.)

Finally I really got to the meat of what he said in that sentence (one of many that expressed his thoughts on the mess topic Bruce had posted about). Why should you or I bother with figuring out how the hell to send an email to the proper mailing lists for the HTML5 WG? Or the WHAT WG? Heck, I’m not even sure which group is more relevant. The former has more technical authority, but the latter is actually making all the calls. RDFa, ARIA, and other fruits of the loins of other W3C chartered working groups are being disregarded by the HTML5 people consistently, or being carefully argued away with a pleading for use cases, a suggestion that their expertise is flawed, or that alternate solutions (read that: the WHAT WG’s solutions) are the better option.

People who’ve spent decades in service to their fields are being shot down by non-experts. Consider the issues with accessibility. Laura Carlson recently sent a proposal (signed by a lot of notables including accessibility guru John Foliot and HTML5 doctor in residence Bruce Lawson) that suggested the audacious idea that there be a formal procedure that describes how HTML5 will seek accessibility guidance from the W3C WAI groups.

HTML5 editor-for-life Ian Hickson evaded the issue by listing all the unanswered questions he has waiting on such topics instead of addressing the proposal. Sam Ruby one-upped Ian by expressing his disappointment that the proposal even existed.

In a situation like this, where motivated, caring experts in their fields are being ignored or deflected when using the official channels, why should your average John Everyweb even consider unraveling the process involved enough to attempt to address concerns, knowing the almost certain result of such efforts?

I can’t think of any motivating reasons.

Today’s comic features John Foliot (representing accessibility efforts) submitting such a suggestion to the HTML5 group(s), with my squirrel alter ego looking on in horror at the results. Consider it a softened metaphor that reflects my own growing dismay at the direction HTML5 seems to be heading when working with others.

]]>
http://cssquirrel.com/blog/2009/07/20/comic-update-the-html5-suggestion-box/feed/ 11
Comic Update: Manners After the XHTMLacolypse http://cssquirrel.com/blog/2009/07/09/comic-update-manners-after-the-xhtmlacolypse/ http://cssquirrel.com/blog/2009/07/09/comic-update-manners-after-the-xhtmlacolypse/#comments Thu, 09 Jul 2009 20:40:50 +0000 Kyle Weems http://www.cssquirrel.com/?p=355 Last week, it was declared that the XHTML2 WG was being discontinued, so the resources could be focused on HTML5. I briefly mentioned it here, and Jeffrey Zeldman spoke about it here. It’s a simple enough matter, and drew a lot of mixed responses. That in itself isn’t surprising.

What was surprising was how all of a sudden it seemed that it became open hunting season on insulting developers that used XHTML 1 (which is not XHTML2) and gloating over the corpse of the standard before it had even cooled. As two examples, Henri Sivonen produced an unofficial “Q&A” complete with snark, and Mark Pilgrim invented a taunting childish rhyme that reveled in the folly of those he disagreed with. Pilgrim in his case even named Jeffrey Zeldman directly in his taunts (and got even worse in behavior in his comments on that post.)

This sort of behavior annoys me on two levels. One, it’s not a great way to treat your professional peers, as it crosses the line from attacking a technology to attacking people. Two, it confuses (in some cases intentionally) XHTML and XHTML2, making it seem as if the death of the latter somehow invalidated the former, which isn’t the case at all.

Fortunately, good men didn’t let that sort of behavior slide. John Allsopp rightfully called some of the taunters out for their snark (as recorded in this tweet here), and that became the basis for today’s comic, which imagines a post-apocalyptic world where this sort of poor manners must be corrected by brave warriors in the wasteland.

Also helping correct misconceptions and bad behavior were good posts by Jeremy Keith and Jeffrey Zeldman. If you’re confused about the whole XHTML issue this week, take a look at what they’ve written. It’s instructive.

Was XHTML2′s death a good thing? I don’t know. I do know that we can discuss the technology in a fashion that doesn’t involve insulting the people involved, though. Keep it clean, folks.

Note: I wrote this in about eight minutes at the end of my lunch. As such, it might expand later when I have the chance to be more verbose and thoughtful.

]]>
http://cssquirrel.com/blog/2009/07/09/comic-update-manners-after-the-xhtmlacolypse/feed/ 11
Comic Update: The Dangers of Intentional Vulnerability (AKA Password Unmasking) http://cssquirrel.com/blog/2009/06/29/comic-update-the-dangers-of-intentional-vunlerability-aka-password-unmasking/ http://cssquirrel.com/blog/2009/06/29/comic-update-the-dangers-of-intentional-vunlerability-aka-password-unmasking/#comments Mon, 29 Jun 2009 15:52:18 +0000 Kyle Weems http://www.cssquirrel.com/?p=330 Sometimes I find myself participating in a discussion or a debate that sounds like a theoretical exercise involving recreational intoxicants. The unfortunate part of such topics is that not only are the participants sober, they’re also well-informed.

As we’re about to learn, being wise and making wise choices do not always go hand in hand.

Today’s comic imagines Jakob Nielsen and Bruce Schneier intentionally exposing themselves to danger in a gladiatorial arena (overlooked by a Caesar-esque Dave Shea) with the predictable results. Sadly, this scenario reflects reality (with a little editorial excess) in a way that shocks me.

Let’s lay out the recent events.

Jakob’s Suggestion: Let’s Unmask Passwords

On June 23rd Jakob Nielsen proved he’s not done making poor recommendations in the name of usability. This time the victim is not design, however. Instead, he firmly takes a swing at security by recommending that passwords become unmasked, leaving naked all the strange alphanumeric combinations that we strive mightily to remember every time we want to visit naughty sites, check our email or bid on a rare 1920′s lampshade online.

He makes some assertions while recommending this course of action. First, that people rarely look over shoulders. Second, that you’re alone in your office. Lastly, he names two “costs” that these cause, one being that users don’t trust sites that mask password fields and the second that masked fields result in weaker passwords. He ends this list of errors by suggesting we do away with the masking altogether, and dance widdershins under the stars in a deep forest clothed in naught but our own sweat.

For the sake of avoiding a stoning at the hands of security experts, he does make an offhand suggestion of offering a check box to allow masking for public situations, but this is said in an afterthought that shows how little he worries about such a trivial thing as someone with both curiosity and eyeballs noticing you typing things on your monitors.

Dave Shea’s Suggestion: Let’s Have A Smackdown

I might have spent my remaining years ignorant of his “suggestion” (might I take some liberties and call it a mad raving?) of tossing away one of the final barriers of security in exchange for a marginal increase in usability. However, Dave Shea took the impetus to make a comment about Jakob’s strange post on Twitter, for which I thank him.

He then followed with a comment replete with inspiring concepts: “A Bruce Schneier / Jakob Nielsen smackdown would be, frankly, awesome.”

It’s moments like this that I wait for, mouth watering with anticipation as I crawl through the many tweets and blog comments of the web design sphere of opinion. Immediately I imagined a savage competition between these two notables where Jakob’s naivety costs him in a contest against the security expert Schneier. These sort of daydreams translate easily into a comic, and furthermore align with something about which I found myself holding a strong opinion. This sort of conjunction almost always sends me scrabbling to my mad laboratory, where I harness arcane shapes into vector imagery and stamp it with the mad wisdom of the stars.

The Twist: Bruce Agrees With Jakob

However, it was only on July 26th that Bruce did something I don’t think Dave expected when he made his tweet, and certainly wasn’t in my realm of anticipation. He agreed with Jakob.

Thankfully, I was able to adapt this change of circumstance to my comic’s needs.

However, I’m not about to alter my opinion on the topic. Namely, that I think this suggestion is madness.

In short, it appears to me that Jakob and Bruce assume that exposed passwords are a non-issue because firstly criminals don’t hover over shoulders and secondly that privacy when surfing a website is a guarantee.

Problem #1: Enabling Criminals Of Convenience

Let’s cross out the consideration of serious hacker types for a moment. These aren’t the sort of individuals that need to see you typing your password to steal your stuff. They’ve got mad skills, and are probably busy right now taking your credit card information off a hard drive the U.S. Government accidentally sold to a spare parts reseller. But amateur no-gooders and opportunists need all the help they can get. They may not plan on stealing wi-fi access, but if they see you typing a password in the cafe they just might take advantage of it.

Unmasking the passwords by default creates a situation where Average Joes are given a lot more temptation to misuse the information they’re casually overseeing. We’re a curious, slightly selfish race. Give us the chance and we’ll be exploring things we shouldn’t. This is probably why emergency room doctors drink heavily after workdays involving gentlemen walking funny who whisper about the need for extreme secrecy when dealing with their medical “emergency”.

Problem #2: Privacy In The Home Is An Illusion

We’ll jump past the criminal concern, however, to look at the privacy issue. For the average American (and even more so for the average human) privacy isn’t a guarantee, and rarely exists when accessing a computer terminal. On the home front you often have spouses, siblings, parents and children all about as you log onto email accounts, purchase music via iTunes, check your bank account, or make a purchase for a pizza or a movie. Although I’ll pretend that maintaining privacy between spouses isn’t a concern (although I suspect it is) we all know that kids will be kids, and that some siblings are less than circumspect in respecting your stuff.

How would you like to come home only to discover you’ve spent $40 on purchasing a couple of Brittany Spears albums? How about learning someone (probably a young someone) bought access to an adult movie on the cable box with your account? I’m not saying that kids can’t get access to something with enough effort, but I think that it’s a big step in the wrong direction when you remove such a simple barrier to that access, and by doing so it requires no effort on their part to act on a poor decision.

Problem #3: Private Office? What Private Office?

So privacy in the home is an issue. What about the workplace? I have a great job. I don’t work in a cubicle farm. But many office workers do, and have hundreds of co-workers with easily five or six sitting in cubes across the aisle who can see their screens.

School teachers often have their computers in the classroom next to students. Should they trust all their pupils to respect their privacy and not try to access staff-only functions or answers to an upcoming test?

Furthermore, more and more people are accessing websites in non-traditional spaces. When you’re packed on a subway car with dozens of commuters and you need to access a site on your smart phone, do you want to have to decide if you can trust the people squeezed up next to you?

I could come up with dozens of other scenarios. Jakob is trying to cast his recommendation in the light of saving us from “legacy” design by implying that we live in an era where security won’t be risked by removing masking. Bruce seems to agree, stating that shoulder-surfing is an uncommon activity and that the risk is outweighed by the annoyance of typing blind.

The Root Of The Problem: Outdated Assumptions On Where Websites Are Accessed

I say that instead these two are making assumptions about website usage that are outdated. Computers are being used by younger children with more sophisticated skills. Websites are increasingly accessed more by other devices like smart phones, in non-private spaces with dozens of potential observers. Privacy is a vanishing commodity, so to presume that an average scenario doesn’t involve potential prying eyes is foolhardy and risky.

Jakob said the following: “Users make more errors when they can’t see what they’re typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)”

I’m going to call you out on this one, sir. That’s outright backwards. I feel less confident when I am entering a naked password in any environment, and strongly doubt the security of the site in question if required to do so. In fact, I’m likely to not use it at all. Why should I trust their other measures if they can’t even protect the password from passing eyes?

Perhaps username/password security truly need to be replaced by something both more secure and simpler to use. I’m not sure what that replacement technology should be. But I do know that we shouldn’t decide that usability trumps security and retrograde to exposing our passwords to John Q. Public.

No offense, John.

[Edit: Fixed the jump from #2 to #4 in the problem subtitles. Thanks, Elaine!]

]]>
http://cssquirrel.com/blog/2009/06/29/comic-update-the-dangers-of-intentional-vunlerability-aka-password-unmasking/feed/ 14