Re: [Secdispatch] [saag] The Mathematical Mesh

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Apr 24, 2019 at 12:52 PM Ben Laurie <[e-mail]> wrote:

> On Wed, 24 Apr 2019 at 17:47, Phillip Hallam-Baker <[e-mail]>
> wrote:
>
>> But right now the situation is that it took me over 15 minutes to
>> configure Thunderbird to use S/MIME. And I know what I am doing. It is a 17
>> step process that requires use of a Web browser and email client and
>> multiple switches between the two. It took me another ten minutes to find
>> the instructions.
>>
>
>> When the current situation is that users are required to poke themselves
>> in the eye with a sharp stick to get end-to-end security, it doesn't take
>> very much to improve on that.
>>
>
> I don't disagree with this, either. I do object, however, to assertions
> that things are obviously usable.
>

My assertion was 'easier' not 'usable'. If a process has 17 steps and 16
are unnecessary, I don't need to do usability testing to know that it will
be easier to use if we eliminate them.


Well let me tell you what I am going to be doing on Sunday. I am going to
be taking the scafolding out of where it is stored in the garage and
building a tower in the master suite so that I can take down the #W$)(%$
Nest Protect device and update the WiFi settings to use a different WiFi
access point after the old one was stolen.

Someone obviously did a heck of a lot of user testing on the device but
they never thought about the management and maintenance features that would
be needed in the real world.

I have connected my device to my WiFi network three separate times. Why
does your product insist on tearing up my work and throwing it in my face?
You control both the device and the app used to establish the connection.
If you switched to using the Mesh approach, I would not need to repeat the
process yet again. (And incidentally, the connection process does use QR
codes and there is probably no need to change the user experience to enable
use of a standards based approach)

It is not just your company that has a problem with usability, Apple does
as well. I have to go and help people configure the television because the
Apple TV assumes that a person watching television can see well enough to
read. Which might sound like a really good assumption until a 90 year old
partially sighted deaf person wants to watch CNN. I would really like to be
able to set out a control that has a limited number of buttons that
directly provide the functions he needs but that would require a four or
five figure investment in coding on my part.

And the reason I brought up Apple and Nest is that they are produced by the
companies that are the leaders in the usability field.

But here is the thing, I don't think it was the usability testing that made
the difference so much as the knowledge that the polo shirted one would
have a screaming tantrum if someone had to climb a ladder to reconfigure a
device whose very function requires that it be installed in the ceiling.

The reason that the World Wide Web exists at all is that Tim Berners-Lee
ignored the sage advice of the hypertext community that referential
transparency was essential and pressed ahead with 'scruffy links'. Nobody
did usability testing to decide whether the gopher or Web UI was the
approach to follow until long after we knew the answer.


My criticism of usability testing is this: we do not find out if buildings
will stay up by building them and seeing if they fall down. That is exactly
how it was done in the past which is why the Bent Pyramid collapsed during
construction.

Usability testing is the scientific approach. We should have moved past
science and started practicing engineering. We should be able to predict
with some confidence how users will react by applying principles learned
from individual tests.


Some classes of usability failure are quite easy to analyze. If a user
faces two potential situations, case A and case B where one will lead to
disaster and the other will perform the intended task and has no means of
distinguishing these cases, the product is defective.

Right now, I have no means of knowing if an email from my bank is actually
an email from my bank or not. And that should be considered a problem. The
problem I have with discussions of usability is that the argument is made
that because we might not be able to serve every user we should just give
up and never try to change anything.

Like I said, if you want to propose changes to the protocol based on
testing or even just based on advice from usability specialists, I am more
than interested. But right now, the Mesh Reference Code is a command line
tool and I am pretty sure that is not going to be the means of delivery
that is most useful for end users.

It is however the most useful means of delivery for people who want to
build the Mesh into other applications and tools which is why we stopped
developing the GUI tool and wrote the command line tool instead.