Whatever happened to simple?

Have you noticed a trend in the world of Programming, Computer Software, etc., towards making things more complicated than they really are?

I can understand this trend in terms of my experience as a programmer. When I was young, I thought I could pretty much make anything work, and that the time it would take to make it was always fairly short. "I can make that!" Accompanied with "That's not too hard, maybe a few hours of programming!" And time and again, my estimates were way off, and things took much longer than I had anticipated, and often bloomed in ways I had not foreseen, into complexities and code-necessities that required time and thought to handle.

Add to that the typical response of non-programmers to every feature: "Build that! And have it done yesterday!", and one quickly comes to the conclusion that things are harder than they seem, more complex than they ever appear at first blush, and a self-preservation mechanism of "default to more complex / difficult assumptions" so that you have the space and set expectations that might actually match the end-result, keeping yourself out of the cross-hairs of "you're late with X feature" criticism from management.

But on the other hand, I am more and more seeing examples of folks who are either over-compensating for these factors, or who are simply coming at everything from a hyper-conservative position, making it very hard to see the simple in things.

When I began my career, Text-based GUIs were just becoming available. Programs such as Borland's fantastic Turbo series, and PC Tools suite, and Copy II PC. Much of the standard fair of GUIs of today found their genesis (at least from my experience) in these software suites. The edit box, the drop-down menu, the combo-box, the radio button, check box, push button, list box, etc., all began their life to my eyes here. And they were generally very well done. They were consistent, and relatively intuitive. These software suites were by and large simple to use. And it was fairly common to see some new innovation, some slight twist on a theme, that made using them even easier and more powerful, such as begin-typing-jump-to-first-match in a list.

But it seems to me that much of this "try it and find out" mentality has been replaced with a "form a committee to study this issue and do focus groups to determine an interface's value" type approach. And this sort of hype-conservative approach stifles innovation, and to my eyes at least, leads to a sort of dumbed down, least common denominator approach to user interfaces.

I don't know about you, but my experience of "design by committee" is that of a sub-par experience, a sort of group-stupid applied to what should be fairly trivial and obvious decisions. It seems to me that it often invokes the "what color should we paint the shed" sort of arguments, where there shouldn't be this level of discussion and focus on something so trivial.

Essentially, the preconceived notion that every decision is not a trivial one, that there's no such a thing as a simple feature is a dangerous slippery-slope in and of itself. And here's sort of the seminal argument for why a simple feature isn't: How many Microsoft employees does it take to change a lightbulb?

And although I respect that, in fact, most things are more complex than they appear at first blush... I hurts my brain to see such overwhelming odds set up against any sort of trivial and useful innovation as a type-ahead search, or perhaps more compellingly, creating a security model at Microsoft that isn't ... well ... retarded.

Some things are simple. And they need to be left to a single developer's common sense to implement them. Its great to at least review such things on a local level - maybe the group to which that programmer is assigned. But having to have every single minute bit of trivia examined as though type-ahead and security UI are of the same depth of focus and importance is.. crazy. And that way lies stagnation and poor designs.

Two examples come to my mind when I read such blogs. First: Microsoft Vista's "shut down" button, and second: Vista & W7's "Security UI". Someplace I read a Microsoft blogger's scathing post on the process behind the Start-menu's shut-down button. How that it went to multiple committees, was changed over and over during the various stages of Vista's design, and ultimately was left with an unfocused, incoherent design. Clearly a victim of Parkinson's Law of Triviality.

But it pains me to think that the many intelligent and sometimes brilliant people at Microsoft have such a poor grasp of what is meant by "Ordinary Users". Ordinary users do not feel threatened by whether something is grouped or ungrouped on the task bar! Lol - they don't even, for the most part, have any idea how to use the task bar. Raymond's example is laughable. It sounds absolutely nothing like any ordinary user I've ever heard. And yet these are the self-same folks who believe that they understand what ordinary people perceive and how they think about computers.

But when you actually sit down and use a computer, be it a Vista machine or a Windows 7 machine, and are constantly bombarded with "This action requires Administrator permissions" dialog, where you have to type the password for the admin account over and over to accomplish even day to day tasks, with no option to perma-authorize anything, you come to the inescapable conclusion that the folks at Microsoft behind this UX as they like to call it (User Experience), must all be on some serious drugs, or more likely, utterly self-delusional. Its so far from a functional, usable interface as to make me want to shame them in front of the entire class. I'd give them an "F". Hell, I'd post it in the school cafeteria's wall for all to see. I'd hold a mandatory "school-rally" to highlight the vast failure that is their security, and I'd want to interview the many folks involved in the course of creating this albatross to try to come to grips with how such an Elephant comes to reside in plain view without anyone commenting on how incredibly retarded it is, so that we can learn from their mistakes and never, ever, ever make this colossal of a stupidity again.

Or do you find that you side with the "there is no such thing as a simple feature" folks? Do you find Microsoft's UI changes in Vista and Windows 7 to be genuinely better and more usable than their overall UI in XP? Would you prefer to see every decision go through committee? Or do you see a better way?

Windows UAC: Why it is wrong-headed

The problem with the entire UAC approach to security as implemented on Vista and Windows 7 is that it is little more than way for Microsoft to punt on its responsibilities and claim with a straight face that Windows is not at fault.

As seen in the Windows 7 blog:

There has been no report of a way for malware to make it onto a PC without consent.

Sigh. Great, so your approach is working perfectly. You've gone from a system where malware installs itself while the user is doing things, to one where you bombard the user with generic, indistinguishable, relentless queries as to whether its okay to do the thing they just clicked on, and hidden in that avalanche of requests is one that is actually from a piece of malicious software, which gets approved as a matter of course, but its not Microsoft's fault anymore. Brilliant. But completely shallow, self-serving, missing the point, blame-the-victim mentality at its best (worst?)!

Many, many pundits critizied MS for its onerous UAC when it first came out. As they reasonably should have. And many of them made this exact point: if you bombard the end-user with questions that they don't understand and give equal weight to things that are ordinary with things that might actually be of concern, then they're not going to take you seriously and they're not going to spend time evaluating every single query before answering.

I mean, gosh, how many of you are familiar with "The boy who cried wolf" at Microsoft? Anyone? Anyone?

So here we are, looking towards the next version of UAC, and someone is actually foolish enough to make the exact claim that everyone denounced as stupid and self-serving for Microsoft to do: "Not our fault, you pressed okay."

Any security design that requires constant authorizations for even mundane tasks is going to create the boy-who-cried-wolf problem. Its going to cause users eyes to glass over. Its going to cause knee-jerk acceptance of the "ok" button everytime that interface is presented. IT IS NOT, at its most basic level, A SOLUTION. Its merely a way to push the blame onto the end-user. Its ... a ... marketing ... tool.

And most end-users aren't even stupid enough to confuse the two. Microsoft is only fooling themselves. When Vista's UAC first came out, everyone immediately glomed to the fact that this is not a secure system, or a useful answer or approach or remdy to the underlying first-principles cause of the problem: malicious software getting installed or otherwise allowed access to our computers.

In their defense, I certainly grant that this is a difficult and complex issue. However, I don't actually think its beyond the resources at Microsoft to solve it in a way that is genuinely useful and usable by its customers and business users.

I don't think most of this is that difficult for most users to understand: run programs at only the level of access that they actually need, and no more.

If there were a SIMPLE way to grant some programs more access than the default (which would be set to a low, harmless level), then users could grok this. They could easily distinguish that their anti-virus software needs full access to their machines, but the latest toolbar from Yahoo does not!

But since Microsoft's UAC is too fucking stupid to distinguish between the user clicking on an applet in the control panel, and a bit of software trying to install itself from a web site or removable media, then there is no way that end-users are going to be able to distinguish between when a security authorization is actually meaningful or routine.

Microsoft utterly dropped the ball here. They did nothing to improve the actual situation. All they did was blame the end-user and create a stupid self-justifying system to prove themselves un-culpable.

Its a shitty way to handle this situation, and I for one am neither amused nor tricked into believing their bullshit.

Microsoft's UAC is the biggest "fuck you" to its customers that they've probably ever done. And until they take a deep breath, and admit the truth, there is little chance of actual forward progress or rational conversation on the issue to be had.