On Nov 12, 2012, at 9:46 AM, Zack Weinberg wrote:

> Obviously, refusing to upgrade Firefox opens up these users to serious 
> security risks.  I would like to suggest that we put that toggle back in, and 
> commit to preserving tabs-on-bottom mode for the foreseeable future, *just 
> because* it will encourage this upset minority of users to continue 
> upgrading.  Remember that the actual size of the upset minority here is 
> probably at least 100x larger than the number of people who have gone to the 
> trouble of complaining about it in the newsgroups and/or the bug report.


It's true that sometimes non-security changes have major security impacts (c.f. 
session restore making people more willing to apply updates). I also agree that 
each poster in our newsgroups represents a constituency (100x may or may not be 
right, let's say it is).

Nevertheless, I disagree. We've got a decade of experience with UI changes 
having vocal critics that turn out, in hindsight, to be minorities (e.g. tab 
close button position militancy around FF2). That doesn't mean we shouldn't 
listen to feedback about UI change (e.g. adding more uninstall UI for social 
API because users found it undiscoverable) but on balance I believe we bias far 
too much towards letting vocal, conservative complaint chill the evolution of 
our products.

Every community has conservative elements. They are helpful; they remind us who 
we are when we forget. But conservative forces prevent change (by definition!) 
and we have important aspects of our code that need changing. I don't believe 
that the discussion around tabs on bottom will result in any significant 
portion of our user base turning off updates. I do believe that our tab strip 
code is in desperate need of clean up, and full of edge cases that hurt 
performance, maintainability, and quality.

J

---
Johnathan Nightingale
VP Firefox Engineering
@johnath

_______________________________________________
dev-security mailing list
dev-security@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security

Reply via email to