21–30 of 101 posts
I think that the reverse problem is even worse. Many of the applications that I use (Posterous, Picplz, Instagram) only need write access, yet they always get read permission. I don't want these applications reading my direct messages. Unfortunately, Twitter does not provide a write only permission.
Earlier quoted context omitted.
Would be cool. But really, I don't think people will double-guess themselves when QuizMatic3000 doesn't give reasons for it. (An age-old UX myth: users never read dialog boxes, they just click OK.)
One fearless developer I worked with would switch the meaning of the boxes every now and then to 'train' the users not to ignore the texts based on negative feedback. +------------------------------------------------------+ | | | Are you really sure you don't want to format ? | | | | | | | +------------------------------------------------------+ He'd have made a pretty good BOFH I think.
Earlier quoted context omitted.
Q: Why would an application developer want to make limiting promises? A: Because more users will trust the application and be willing to authorize it. I think this is the only correct answer. Sadly, without mechanisms in place to limit the scope of the authorization, the market is aiming for a scenario where ordinary people simply don't trust web applications. Even visiting new sites on the web for them will carry a…
Most users will never analyze the "This application requests the following permissions..." screens; see: anyone that owns an Android phone.
Maybe 80% people will still press "Allow" instantly, but at least this makes the 20% other more comfortable.
Earlier quoted context omitted.
One fearless developer I worked with would switch the meaning of the boxes every now and then to 'train' the users not to ignore the texts based on negative feedback. +------------------------------------------------------+ | | | Are you really sure you don't want to format ? | | | | | | | +------------------------------------------------------+ He'd have made a pretty good BOFH I think.
That's like "training" a cyclist to use a helmet by smacking them in the head.
I also believe that the author has some fundamental misconceptions about OAuth. OAuth is merely a standardized way of gaining access to proprietary APIs. There is nothing in the specification about what sort of level of permission an access token will provide the consuming site. The statement: "And KanyeAnalysis™ uses OAuth, which lets you use your Twitter credentials to sign in!" is misleading and makes OAuth sound much more like OpenId than it really is.
Earlier quoted context omitted.
Q: Why would an application developer want to make limiting promises? A: Because more users will trust the application and be willing to authorize it. I think this is the only correct answer. Sadly, without mechanisms in place to limit the scope of the authorization, the market is aiming for a scenario where ordinary people simply don't trust web applications. Even visiting new sites on the web for them will carry a…
Most users will never analyze the "This application requests the following permissions..." screens; see: anyone that owns an Android phone.
Quit it with the "most users" reasoning, unless your goal in life is to part fools from their money.
Even better: Let the application also say why it needs the permission: * Read access We want to analyse your tweets * Read/write Because we want to spam your friends
Q: Why would an application developer want to make limiting promises? A: Because more users will trust the application and be willing to authorize it. I think this is the only correct answer. Sadly, without mechanisms in place to limit the scope of the authorization, the market is aiming for a scenario where ordinary people simply don't trust web applications. Even visiting new sites on the web for them will carry a…
As the worms spreading through e-mail show, social filtering may not be sufficient to identify rogue apps in time.
Twitter also in their TOS specify how not do do things. If you don't follow the TOS and expected behavior of the app, then you are going to get complaints, and twitter will shut down your app.
In general it's not good business to get shut down.
Even better: Let the application also say why it needs the permission: * Read access We want to analyse your tweets * Read/write Because we want to spam your friends
Both OS X and WinAPI do this now. Users (in general) hate it. You make a good point, but it's going to have little impact in the real world. People livin' in that 21st century do it better'n anybody you ever seen do it and they want their Kanye analysis now; they ain't got nothin' to lose! They rollin'! I am deadly serious.
Look at the mobile platforms for an example of implementing this idea correctly. Android users, the same who are likely to detest UAC, rave about the ability to see which parts of the system an application accesses before they install it. I'm an iPhone user, and I've always appreciated its piecemeal approach to authorizing location and notification services.
Zach's article is about making the message more meaningful, such that it's not just another automatic clickthrough. My guess is that users would much prefer this screen to what twitter is using now.