Hacker News Reader

Comment by cwyers | Hacker News Reader

I don't get it. It's a site designed for public sharing -- the word "showcase" is right on the front page, as username223 points out. I just loaded it up and walked through uploading a file to it. It's incredibly explicit about what it's doing. Under "Visibility," it says:

"Public on the web Anyone can find it on the web. Search engines will find the doc, giving it a larger audience."

It's not unambiguous. It's very clear. The only way you can't tell what it's doing is if you just pay no attention whatsoever to what you're doing. It's not the default sharing method from either Office 365 (web, traditional or Android/iOS) or OneDrive. You have to opt into using it at all at an IT department level if you have a corporate Office 365 department. You really just can't stop users from footgunning themselves when they're on the open Internet.

View on HN

> The only way you can't tell what it's doing is if you just pay no attention whatsoever to what you're doing.

You've just described a very common type of non-technical user.

In my experience, the least technical users are the ones who read more than the rest of us. While I just want to click the "Next" button or whatever is in its place until something like "Cancel" takes its place, my grandpa wants to read every word to make sure everything is happening correctly, and even asks me questions about what the words mean. He doesn't like to proceed until he's sure that everything will work just the way he wants it.

As GP said, users got a very obvious warning. It's not like there was a 1000-word long essay greyed out which contained the words "oh and this is all public" in a random location. This isn't about how technical users are, it's just a user error that anyone could make. I would be extremely surprised if you told me that, for example, there are less than a hundred Google Docs with sensitive information that are publicly viewable. In fact, I would probably call anyone above the age of 20 a liar if they said that during their entire life they had never, ever shared something they didn't mean to share. Even when it comes to things we're very familiar with, like our own mouths, we sometimes share more than we intend to.

Sure, but for every user like you, there are 5 users that think they are like you, only less pattern recognizing and keep pressing "Next" even when it installs trojans/searchbars/uploads stuff publicly/etc.

It seems like it should be this way, but I've often found another level of cautious user. My mother has stopped using her computer for a week while waiting for me to come visit so I could tell her how to proceed past a popup she hasn't read. Typically, I'll come home, she'll ask me to help her with a problem, show me the popup and ask me what she should do next. I'll instruct her to read it, which she hasn't yet, and then once she does, she'll make a decision and ask me if it's the correct course of action before proceeding.

I think generally non-technical users are just pretty diverse, and I'd wager there's more non-readers than readers...

That said, in this case, I'm not sure what more MS can do beyond simply not offering this service.

> I'd wager there's more non-readers than readers...

Work in tech support, can confirm

Yes. And no.

It is very clear, to you. To me. To other people? The evidence doesn't support that claim.

So again: was it clear enough? Apparently not.

You can argue about this as long as you want, but interpretation of an interface is not complete until you get the context. Ours is that of someone who's either looking for it, or aware of the possibility of its existence.

If you're neither, perhaps you'd need to be able to see other people's documents as well. Perhaps you need a big ol' warning sign with tick-boxes before you dismiss it.

Maybe the default should be hidden, and sharing made optional. I realise this doesn't make much sense for a "sharing" feature, but maybe it's been labelled wrong. "Sharing" doesn't necessarily (read: "by definition") mean "everyone in the whole world can browse your stuff".

So imo, two parties to blame.

Yes. It's the user's own fault.

No. It's not clear enough.

> It is very clear, to you. To me. To most other people? The evidence doesn't support that claim.

I'm not sure that's clear? The headline says "hundreds" of sensitive documents are on there. How many documents are on there total?

I'll remove the word "most". Point holds.

Okay, but what's the acceptable defect rate for users not being able to understand the UI? Because I don't think it's possible to design a UI so unambiguous that a user, no matter how determined, cannot manage to misunderstand it.

Surely the acceptable rate depends on the system? A UI defect in something that could launch missiles, for instance, would be a disaster.

As for the design here - how about a big red banner with "by ticking here this document will be available to the public and can be found through search engines" or similar?

Anyone given access to a missile system will also be trained in it's usage, so the bar for usability of a missile system is much lower (e.g., it can assume knowledge of military terminology)

Doesn't mean less care should be given to the interface. Doesn't mean they aren't subject to the monotony of repeating actions each and every day.

While they should be able to react quickly, I'm also sure that they have to switch to "able to react quickly mode", and won't always be ready to launch missiles at the push of a single button!

>but what's the acceptable defect rate for users not being able to understand the UI?

Acceptable defect rate is the defect rate that does not result in an Ars article pointing out the defect rate of your product.

One big misunderstanding could cause an article like that. I don't think that's a workable standard.

Which is zero, because a large part of Ars business model is making a big stir about defects.

Acceptable rate of UI failure depends on the consequences of misinterpretation of the interface.

Apparently, for a document uploading service, this case shows an example that's below the acceptable rate.

See it this way; you don't want someone to accidentally trigger a nuclear bomb even once. However you probably don't care that a knife sometimes cuts a finger.

It all depends on the context. Microsoft's audience is for everyone from kids playing Minecraft to corporate O365 users. So it's not surprising that it's a mess.

People often assume a level of security at work that doesn't match reality.

There are trigger words that should be used, in large type, before posting.

Please upload a document to host publicly for anyone on the internet.

When we deployed O365 to 100k+ people, we ran into a few things like this.

A big one was the meaning of "everyone" in OneDrive. Many people thought that it meant "everyone on my team", and posted all sorts of wacky stuff.

My work switched pretty recently (December last year) that is one thing I've noticed that has really annoyed me is that all the Office apps have One Drive set as the default location to save anything. I've never used One Drive, I don't want to use One Drive but every time I hit save in word or excel it defaults to "One Drive" I have to physically click "This PC" button and browse to my local disk to save a copy locally every single time.

No one in my building uses one drive, no one asked for one drive but Microsoft keeps trying to shove it down our throats. It feels like an anti-pattern like the forced windows 10 "upgrade" for home users.

According to word I have Office 365 ProPlus version - I note there is no option to save to docs.com.

I am curious what your resistance is to OneDrive. Personally, I try to put as much in there as I can as I frequently switch machines that I am working on. I keep my work code in there as well (Git repo and all) and it's convenient when switching between VMs or when needing to wipe my workstation and start fresh.

I encounter many co-workers though who like to do things "the old way" and just email copies of documents around and then spend time merging them back together instead of sending a link to their OneDrive. Just more files for me to juggle on my computer. No thanks.

There are a few reasons, partly because of corporate policy which says no sensitive documents on cloud.

Partly because I need to access stuff offline so prefer to have a local copy. For example if I have to take my laptop travelling with between sites I may not have access to a internet connection.

Your right that a large part is familiarity - we use Sharepoint (which I also hate) to share documents between teams rather than email.

It sucks worse if you have compliance requirements because the controls really suck in the product. It exists because Google Drive exists.

You missed the serious suckabe. 3 years ago you could put the sync client on a fresh install of Windows 8 and do nothing with it and it would break itself.

There comes a point when you start wondering if some people are just willfully stupid.

Exactly what I was thinking. Maybe even after sharing with "everyone" it takes the approval of N people on your team to fully share it out. With a safeguard like that I bet a lot less docs would be accidentally shared to the public.

I have unfortunate news for you: If you read http://reddit.com/r/talesfromtechsupport , you will very quickly learn how much attention the ordinary corporate PC user pays for warnings and error messages. I don't ordinarily link to reddit, but the stories on that page are the perfect illustration of just how blissfully ignorant and clueless many people are.

There are Public, Limited, and Organizational visibility options, the Public option should have a clear enough warning and not be the default.

That would sort of defeat the point of having a site designed around public sharing, wouldn't it? It doesn't seem like good UI to have the default be something other than what the typical usecase for the UI is supposed to be.

I'm not sure how requiring an explicit change from private to public would create an undue burden, also it would most likely reduce the potential harm that certainly comes from unintentionally publicly sharing something.

Assuming a particular number of users are going to be too stupid, careless or rushed to set the privacy option, I think I'd err on the side of caution. What's worse: Not having the document available to all, but accessible by the link? or having the document available to all and the link unwittingly?

It is of course the users fault, but that doesn't mean the devs can't take extra steps when a flaw is pointed out.

The worst for the owners of the sharing site would be for the site to fail in the marketplace because grandma couldn't figure out how to share her photos with her grandkids and gave up on it.

Some people would benefit from more safety features but nobody wants to ride in a car with a full roll cage and a helmet.

Well it's not a photo sharing site, it's a document sharing site under the MS Office branding.

Funny you should bring up auto safety when we've now got at least 4-6, and sometimes as many as 13 airbags in the average new car despite the fact they'll often never be used, and all because of the drivers. Certainly lane departure and collision avoidance systems aren't there for the people using vehicles properly.

Reply on news.ycombinator.com