Re: Gtk Certificate Dialogs

Hi,

> - Isn't the "corner arrow" icon reserved for the 'OK' button? Otherwise it
> could be used for just about any affirmative button.

I did wonder about that, but I couldn't see anything saying either way,
maybe I missed something in the HIG.

> - According to the HIG, a 'Cancel' button should only be available in
> response to a user action. It is debatable whether loading a secure page
> prompting a SSL dialog can be defined as a user action, since the user
> obviously couldn't know in advance that the certificate may be incorrect.
> I'd suggest [Decline] and [Accept] instead.

At one point I had "Reject" (as it is the opposite of "Accept"), but I
had a complaint about that. Looking at it, I think putting the Reject
back is the thing to do.

> - 'Ask your system administrator for assistance' can be pretty much a
> dead-end message when the user is using his home PC and hence *is* the
> sysadmin.

That is an interesting message, as I have found no way of getting
mozilla to display it. Also a normal user won't have any CRL's enabled,
so they wont ever see it.

> - Please use the same date format everywhere (preferably from the system
> settings.) Right now you have 'Aug 2 2003' and 'Thu 28 Aug 2003'.

The one with the actual time of the system is generated using the %c
time format, so I don't have any control over that, I'll change the
format of the other one though.

> - Tough question: should the default button be 'Accept' when the user is
> about to load a page where his data might be intercepted? Also if that is
> a extremely remote possibility?

I had 'View Certificate' as the default at one point and had complaints
that people would like to just hit Enter and ignore the dialog. I would
much prefer to make the "View Certificate" the default, as people would
then have to think about accepting the certificate.

I have had some comments about the text, some saying that it is too
long, others saying that you need the text to get the point across. If
someone can come up with shorter text, that (importantly) still makes it
clear that there is a security risk if you click on "Accept" I would be
very grateful :).


Crispin