full-disclosure - Re: Bug 718066 - [meta] Add feature to submit anonymous product metrics to Mozilla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 10 Feb 2012 09:48:23 -0500
From: Valdis.Kletnieks@...edu
To: Nick Boyce <nick.boyce@...il.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Bug 718066 - [meta] Add feature to submit
	anonymous product metrics to Mozilla

On Fri, 10 Feb 2012 03:51:53 GMT, Nick Boyce said:
> OT: They should just make FF quality high and the design impeccable -

"Quality high" is always a nice concept.  But there's always 5 quality issues and
resources to fix only 3.  Obviously, you want to fix the 3 that matter most to
your users - but which 3 are they?  You really can't rely on bug reports or
surveys, because those tend to have a major self-selection bias.  Think about
it - how many people do you know that use Firefox?  How many of them have
had it crash or misbehave?  How many of them *reported* it?  Surveys have
the same problem - you can't easily run a survey of users who just want
to hit their sites and *do* stuff and find out what they want - because they'll
just skip your survey, hit their site, and *do* stuff.  Unless of course you make
the survey mandatory - in which case you tick them off because you got in
the way of hitting their site and doing stuff.

Or "report the list of extensions and performance numbers" -  it's one thing to
know that users have a range of launch times.  It's something else to know that
20% of users have *consistently* longer launch times on comparabie hardware.
But if you have data that shows that NoScript users take a 15% launch time hit,
*that* is something you can then go do something about.

Similar problems for "impeccable design" - if you want a browser that Joe Sixpack
will actually *use*, then you need data on how Joe actually wants to use that
browser.  And *asking* Joe never works - anybody who's had to do project
requirements will tell you that what the user *says* they want, what they *think*
they want, and what they actually need, are almost always 3 different things.

No, I'm not saying it's OK for the Mozilla crew to collect PII like that - but I can
certainly understand why they feel the temptation to do so...

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/