OSNews

The user chooses to install an application and is given a list of what the app has access to. The user has the choice, if they choose to continue then that is their decision.

Written like a designer complaining that an end user should have the experience, knowledge and foresight to be cautious like a security expert.

Kroc is correct when this falls on the architect, not the end user.

But how much is too much when it comes to an application giving off warnings before an end user does something? or how restrictive should it be where there is a weighing up between keeping the individual safe and giving maximum flexibility? at some point one has to take off the training wheels and allow the user to stay upright on the bike - and yes that might mean going into the gutter or straying into the road and getting hit by a car.

There is a thing called personal responsibility that is sorely lacking these days - time that end users exercised that instead of being mindless click and drool mouth breathers.

But how much is too much when it comes to an application giving off warnings before an end user does something? or how restrictive should it be where there is a weighing up between keeping the individual safe and giving maximum flexibility? at some point one has to take off the training wheels and allow the user to stay upright on the bike - and yes that might mean going into the gutter or straying into the road and getting hit by a car. There is a thing called personal responsibility that is sorely lacking these days - time that end users exercised that instead of being mindless click and drool mouth breathers. "

The problem with the "PEWTD - Problem Exists With The Designer" thinking is that some designers deliberately design malicious code. When they do so, they will also do their utmost to obscure the fact that the code is malicious from the end user.

According to this article:
http://www.pcmag.com/article2/0,2817,2365651,00.asp

Where the Google spokesperson (Cannings) says this:


Google themselves are apparently going to take responsibility for "malicious applications". If Google are alerted by one end user to the existence of a malicious application, or if Google identify such an application themselves, they apparently can and will take action and delete it from everybody's android phone.

Edited 2010-06-25 05:57 UTC

What if the user doesn't want to learn how to ride a bike? To break from your analogy, a user doesn't want to "use a phone". He wants to share his photos, send an email or whatever.

This situation is primarily our fault ("our" in a very broad way; as in our industry). Some point in the past, we decided that computers aren't going to stay on the server rooms, but there is going to be one in every home. Since this is the direction we've taken, we have to actively support it by providing "training wheels" to everyone who needs them. Since you could say that generally a mobile app's audience needs these training wheels, you can't just shout RTFM to anyone who is confused and expect to be successful.

I'd just stick with the normal aproach:

"
This program accesses your; address book, phone calling
[ ] do not show this warning in future.
[allow] [deny]
"

Each program can then warn the user that it will be touching stuff or, ideally, the OS provides the monitoring, warning and permissions on a per application basis.

I don't think a minimum of one warning per application is too much and people can always opt to leave the box unchecked and see the warning each time if desired.