Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The screen that set off the ballistic missile alert on Saturday

twitter.com

Post reply on HN
Print view View original

351–360 of 375 posts

Re: The screen that set off the ballistic missile alert on Saturday

#351

Post by swombat »

swombat wrote: post #302
crispyambulance wrote: post #61

Earlier quoted context omitted.

It looks like quite a normal UI from an "internal" government or enterprise application point of view. In this case, the citizens of Hawaii paid for the bad system design with 48 minutes of existential horror. But these kinds of mistakes happens ALL THE TIME with "enterprise applications." Oracle has similar horrendous UX for their EBS (Enterprise Business Suite), so does SAP, Siemens, etc. People regularly make cost…

Somewhat controversially, I wonder if that existential horror was really so bad. I can think of worse ways to spend 48 minutes that contemplating the reality of your mortality, the fact that you could very well be dead at any moment with no warning whatsoever. It makes you re-evaluate your priorities, maybe makes you stop putting off the life changes you were thinking about that seemed like they could wait until next…

Perhaps a bit of context might make it seem less like I’m being unempathetic. TL;DR: I was caught in the London tube bombings in 2005 and I believe it changed my life for the better.

http://swombat.com/2011/12/19/bomb-changed-my-life

Re: The screen that set off the ballistic missile alert on Saturday

#353

Post by catmanjan »

Karunamon wrote: post #326
astura wrote: post #20

Earlier quoted context omitted.

XSRF has nothing to do with JavaScript. A site is vulnerable to XSRF if it doesn't use tokens when performing critical operations, critical operations are (usually) performed using HTTP POST, which can be done via form submission... token generation and validation is done server side... You can perform a successful XSRF attack in a browser with javascript completely disabled.

Wait, so what am I thinking of? The phenomena where if you can get a website to display output of your choosing in a non sanitized way, you can abuse that to cause code to be executed by the user.

XSS (cross site scripting)

Re: The screen that set off the ballistic missile alert on Saturday

#354

Post by WalterBright »

kelnos wrote: post #347
WalterBright wrote: post #318

Earlier quoted context omitted.

> But these kinds of mistakes happens ALL THE TIME with "enterprise applications." Such misteackes in the cockpit of an airliner are deadly, which is why a great deal of effort is expended to prevent such mistakes. Unfortunately, 1. bad UI design is usually only obvious in hindsight 2. doing good UI design is expensive, and not always worth the effort Of course, I face the same sorts of issues in designing a programm…

> bad UI design is usually only obvious in hindsight That's only true if you have little or no experience designing or even using interfaces. As someone who has been bitten by bad UI design in the past, I've noticed and called out a decent amount of bad design well before it actually has caused a problem.

> That's only true if you have little or no experience designing or even using interfaces.

I'm afraid the history of cockpit design in airplanes decisively shows otherwise.

Re: The screen that set off the ballistic missile alert on Saturday

#355

Post by wlib »

jim_dow_jones wrote: post #106
giarc wrote: post #96

Earlier quoted context omitted.

>intentionally No one intentionally set off these alarms.

You are correct. There is no current reporting that claims these were set off intentionally. However, I'm curious if there could be a valid motive for both states to purposely set off these false alarms. It does seem like a pretty big coincidence that both states happen to get these false alarms in relatively short time frame. I have already seen conspiracy posts making claims about these alarms being purposely set o…

When a nuke comes to destroy a big developed part of Hawai'i, there's a lot of stuff on the island you might want to get out of there. Maybe, systems are designed to rapidly move that stuff to safety, as soon as an alert triggers it. A Bulk Data Transfer of all sensitive, unique data would probably be hardcoded to start on this emergency alarm. How long would such a BDT take? Maybe somewhere around 38 minutes? Forget data transfers, what else might need to be moved out, that would take more than 30 minutes? This whole situation sounds silly, but what explanation sounds more probable?

Re: The screen that set off the ballistic missile alert on Saturday

#356

Post by ashleyn »

escapecharacter wrote: post #31
andrepd wrote: post #9

Yikes. Now consider this: this is the design for the missile warning system. It is possible, even likely, that some missile launch system has similar catastrophic UI. How we've not wiped ourselves off by accident so far is a miracle.

Relevant Far Side comic: https://i.imgur.com/AosYvGn.jpg

This is seriously what came to mind first when I saw the EAS screenshot

Re: The screen that set off the ballistic missile alert on Saturday

#357

Post by fencepost »

user5994461 wrote: post #278
fencepost wrote: post #252

Earlier quoted context omitted.

If that confirmation window is on every message drill or not, then it would be completely useless. Users have been trained to click past/ignore pop-ups. I say this as someone who watches people log in on PCs and click past a useless (for them) Citrix dialog that includes a "stop asking" checkbox. Citrix added that checkbox some time ago, so these folks have been vacuously ignoring the entire thing at least once per b…

People are taking popups more seriously when it comes to payment... or sending a nuke.

Hmm, "Enter your credit card payment information to send this alert."

Nah, real world experience shows that people who supposedly have common sense will happily put their payment info just about anywhere.

Re: The screen that set off the ballistic missile alert on Saturday

#359

Post by CamperBob2 »

merb wrote: post #299
unit91 wrote: post #292

Earlier quoted context omitted.

> How many times do you see a dialog box and click "yes" without even reading it? A simple fix would be to use a tried and true method that's been effective for decades. Have different popups that read Type "REAL WORLD" to send this alert. and Type "DRILL" to send this alert.

this would probably be a bad design aswell. because if a real missle treat happens I would need to get out the warning as fast as possible. the best way would've been a second page with a big button and huge warnings.

You were modded down, but I agree. Contrary to popular opinion, "duck and cover" is not just psychological pacification. It will save lives if worst comes to worst. Literally every millisecond counts when issuing a warning of this nature.

So, yes, bring up a huge flashing red warning dialog with a single confirmation step. And make it easy to issue a retraction.

Re: The screen that set off the ballistic missile alert on Saturday

#360

Post by mikeash »

jdmichal wrote: post #251
usrusr wrote: post #242

Earlier quoted context omitted.

Well, in addition to the color coding I suppose the text would still be different? To me, the screenshot looks more like a list of user-defined presets than something that went through the original software development process. Maybe something along the lines of only superuser can define new presets, but lower users can activate them. That way, at least random "I love you honeybunny" pranks would be avoided, but the…

I did think of the covered switches that are common in movies. I think the equivalent in software are confirmation dialogs, but those are not as effective as the physical counterparts due to click-through-itis disease. [0] This could actually be one of those types of things that might benefit from a different presentation, such as a silly skeumorphic design involving a graphical cover. [0] Which, to be fair to users,…

They could use an actual covered switch. Maybe something this important should have a bit of physical infrastructure associated with it. Doing everything in software can be great, but it's not always the best solution.
Post reply on HN