Category: KDE

I just read about Colibri and that motivated me to write a blog post I wanted to write for a long time. First of all I think it’s an improvement that the Ayatana notifications are now packaged and not patched into the system as in Karmic – one of the reasons why I am using Debian, now 😉 (I still think that notifications are a central part of the workspace and that a downstream should respect it’s upstream’s decision on that point.)

But that’s not the point of this post. I want to talk about click through. Aurélien advertises the Colibri notifications as click through, that you can interact with the window underneath. I think that is the failure by design of the Ayatana notifications. The fact that it’s missing actions in the notifications is just a consequence of it.

So what’s the problem with the click through? It requires compositing. A click through is only useful if the window you click through is translucent. But we do not always have compositing. There are systems where it still doesn’t work – even new ones. There are users who don’t want to use it and there are situations when kwin just turns it off due to bad performance.

Consider the situation that you are a user of a non composited environment and the notifications are shown on the upper right as in Aurélien’s screenshot. A notification appears and you click on it so that it goes away, because you do not know that they are queued. The window underneath the notification will be closed in the worst case if the click hit the close button. That’s probably not what Joe User expects. So when the environment is non-composited a click-through is a no go. The same is true if the notification is opaque or hardly translucent. But based on the description they fade away, so that is not a problem.

A solution to the non-composited environment is to make the notifications not click through when compositing is turned off. But that has drawbacks as well. Consider the situation that an experienced user knows about the click through and suspends compositing (something I do quite often). Now a notification appears and he wants to interact with the window underneath as he knows the geometry. The click is eaten by the notification although he expects that it goes through. So in that case we have a behavioral change which is in my opinion as bad as the not expected click through.

So we see as soon as compositing is turned off it breaks. So the fault in the Ayatana specification in my opinion is that functionality depends on visual representation. I’m pretty sure such a mistake would not have happened in Plasma as there are devs who can’t use compositing: "Erm you want to do that? I don’t have compositing that wouldn’t work for me." In kwin as well we ensure that compositing only adds additional features without breaking anything if compositing is turned off that is all compositing features are optional effects.

And just to make sure: this is of course no critic to Aurélien’s work. AFAIK he joined Canonical after the spec was designed and he just implemented the KDE part. I also appreciate that Ayatana is now using KDE’s status notifier spec instead of inventing yet another solution. So most of my critics on Ayatana’s approach which drove me away from Kubuntu are not valid any more (except the point mentioned in this post).

=-=-=-=-=
Powered by Blogilo

This is a follow-up post to my yesterdays post that obfuscating an email address does not work and is useless. Many comments on the blog post stated that they think that obfuscation helps because the bots are not interested in the obfuscated email addresses.

So let’s recap: we use obfuscation to prevent spam bots from harvesting email addresses. So we obfuscate in a way that

• Humans are able to read the email address

• Computers are not able to read the email address

That sounds like a CAPTCHA. If you don’t know the do’s and dont’s of CAPTCHAs I recommend to read the information on captcha.net. One of the most important facts is that you shouldn’t use a CAPTCHA which will break as soon as everybody uses it. That is in the moment the bots start to support it.

Now let’s get back to the obfuscated email addresses. I think we can agree that the obfuscation is conceptually broken. I think we can compare it with cryptography: even that there is no real usecase to attack MD5, nobody would use it to digitally sign important documents any more.

As soon as the harvesters start to search for obfuscated addresses they will find them. If you obfuscate an email address on the web today and in five years the harvesters start to unobfuscate addresses they will find your address. Bad luck.

So instead of using a broken CAPTCHA like obfuscation we should use a secure CAPTCHA like the Mailhide service provided by reCAPTCHA. There are plugins for many programming languages and it can be used to e.g. automatically replace all email addresses in a Mailman archive with a link to the CAPTCHA. It looks like that: jsm…@example.com

And solving reCAPTCHAs is mostly much easier than solving the normal CAPTCHAs as you have a complete word and it is probably much easier than solving some obscure obfuscation rule and it helps to digitize books and newspapers and in the end you get a link to click on.

So I know, that you will say “reCAPTCHA belongs to Google and Google is evil. I don’t want Google to give them my email address”. If you think that, rethink. You think that the world’s biggest web harvester is unable to break your used obfuscation? You have never ever sent an email to a gmail/googlemail account? You don’t use Jabber with Google Talk users? You do not have a Google account? Do you really think that Google doesn’t already know your email address? And if you really don’t trust reCAPTCHA, you could still use scr.im to get a tiny, CAPTCHA protected URL. But I recommend to use a well tested CAPTCHA system.

To summary: I agree that you should secure your email addresses on websites. But please do yourself the favor and do it properly. Obfuscation is broken and it is only a matter of time till harvesters start to harvest the email addresses. There are services which provide a secure CAPTCHA to protect email addresses. Please use those. And no this is not an advertisement campaign for reCAPTCHA – it is just the best CAPTCHA service I know. If you know a better and more secure which doesn’t belong to Google, please leave a note 🙂