Re: Car seatbelts (Was: Re: HTTP is just fine -- v. HTTP is insecure --> need a better metaphor)

On Wed, Nov 25, 2015 at 1:20 PM, Boris Zbarsky <[email protected]> wrote:

> On 11/25/15 2:51 PM, Chris Hofmann wrote:
>
>> Exactly.  Just as it would be inappropriate for an alarm in my car to go
>> off if I pull out of the driveway without my seatbelt attaached
>>
>
> I should note that most modern cars have exactly such an alarm: they start
> beeping at you if the car goes over some (fairly low) speed and the
> driver's seat belt is not buckled.
>
> It's a fairly effective UI affordance to get people who simply forgot to
> buckle to do so, though of course it won't deter an obstinate non-buckler
> (who will just buckle the belt behind his or her back).
>
> and an
>> alarm tried to communcate "you don't have your seatbelt attached, your're
>> going crash and kill yourself"
>>
>
> It doesn't do that, though.  It just beeps annoyingly.  ;)
>
> All of this is clearly veering slightly off topic, of course.
>
> -Boris
>

The point was to try and make the warnings and operation of the
vehicle/software match the risks.

That's how the seat belt example got to something productive and higher
rates of compliance.

minor beeping annoying signal, backed up with lots of side channel
explanation of why seat belts were important, plus case study and example
of how they saved lives had impact on people.  thats the combination is
what worked.  if the seatbelt was tied to the ignition system they may have
been great backlash and people were forced to engage the seatbelt before
starting the car it's likely to have created backlash.  the same kind of
backlash seen in this thread by people who would normally be supportive of
the larger goal.

this is how the "http is unsafe" warning and possible later prohibition in
the browser down the line might be getting off track, and away from the
main goal of stopping surveillance.   If the "unsafe" risks are overstated
in situations where its not exactly true then its going to be counter
productive.  If the warning are gentle and communicating the goal of
stopping surveillance we might get more traction on reaching that goal.

Its just a small twist in the way we approach and talk about the problem.
Thinking about this as project to stop surveillance, rather than a project
to shutdown http.   starting to reduce, or nearly eliminating all, use of
http can help, but certainly will not be the only thing needed to stop
surveillance.   Let's all work together and keep people focused on the
larger problem.  That's what I think we should be asking for.

-chofmann