In developing a Security Application what would be your preference?

I know what I would do :slight_smile:
I would first develop a security product to be secure (afterall thats why its called a security product… right) …then make it usable… but would love to hear everyone’s view on this.
thanks
Melih

Do the hard part first, eh? (:WIN).

I chose secure architecture first, and usability second.
For my aunt, the other option is better, because if the soft is tedious to use, her eyes will gloss over reading the prompts and she will eventually go into “click-thru” mode (“Click-thru” in that the user clicks through whatever dialog box just to get back to their previous activity as soon as possible).

Therefore, giving her an app with the balance tilted towards security may actually make her LESS secure. :slight_smile:

Especially if the alerts aren’t easy to understand. I don’t understand some of them, so my aunt wouldn’t have a chance (especially as she’s dead).

Some alerts that I get are quite alarming so I tend to say ‘No’ but not remember, then see what happens; however I don’t really know what the effect of ‘Yes’ would be.

Axl is correct - click-through is very tempting.

You can have the prettiest curtains in the world, but they won’t do you any good until the house is built. The architecture simply must come first.

If you design for usability, rather than functionality, you risk limiting the on-going enhancement of the product. The underlying architecture needs to be built to be expandable and extensible. If this occurs, you can more readily change whatever bells and whistles you want to hang on top of it.

Ewen :slight_smile:

Fair enough. HOwever the choice is between

1)False sense of security knowing that the security applicaitons is still vulnerable
2)usability, thinking that the user will misuse the product

now its a very difficult to prove which is going to cause more trouble to be honest.

but of course i understand your point.

Melih

Its a bit like the “three little piggies” ordeal with the “big bad wolf”

The first house was easy to assemble but one huff and puff from the big bad wolf(Malware) and it came crashing down.
Now the brick house(Comodo V3) is a lot harder to put up and means you have to put some graft in,but the big bad wolf can huff and puff as much as he likes,it`s staying put and keeping you safe.

I know which “house” i`d rather be in,plus you can also extend/change it easier if the foundations are in place.

Matty

LOL… amazing analogy! So very true!

Melih

Nice analogy, but unfortunately it can only go so far.

Now let’s say that instead of “the big bad wolf”, we use a “storm” analogy.
The first house, easy to assemble, is easily blown away by a hurricane.
The brick house, harder to put up, is able to withstand these forces, so you choose it.

Now here is the unasked question:
“Where is the house going to be built?”
If it is in the Caribbean, the brick house is obviously better, but what if the house is in the Sahara?

My aunt checks her email, shops with only the largest online retailers, and reads the news.
Since her browsing habits are low-risk, a brick-secure firewall is OVERKILL for her, and the time and effort required to setup Fort Knox security on her box is essentially a waste of time!
Therefore, from her perspective, even though CFP v3 is more secure, a product like OA may have the balance she needs, making OA her “firewall of the year”.

I think this is the point Melih is trying to make.Both Online Armour and Comodo with there top notch ratings are excellant products and IMO both companies deserve a lot of credit.
The fact that the basic foundation of the product is so good means that in the future it can be used in many differant variations without compromising much.Its like you say where is the house going to be built,what if its in the Sahara.If this is the case then you paint the house white to keep it cooler(an optional extra) you could put sloar panels on the roof etc I think that this is what the idea behind Threatcast is,to make it adaptable to a great many differant variations be that for a complete novice or a computer genius. Anyways well have to wait and see how that pans out.

Regards,

Matty

ps The people who should be getting most annoyed about this are the ones who pay $/£`s for a “well known” security solution but get a cardboard box instead ;D

maybe having CPF with Firewall with Leak testing mode is all that your aunt requires!? Afterall, any uknown apps must be checked by AV… so if she has AV and use cpf in the firewall mode with leaktest then this is all she needs!?

Melih

Point well taken, but in this case it seems like the straw house (OA free) is not only stronger than the wood house (CFP with Firewall Leak testing mode), it is stronger than the brick house (CFP with full HIPS), as per Matousec’s most recent findings.
Not only that, but from what I have read it is still easier to configure than CFP in Firewall leaktest mode.

IAC, I will be installing OA free on a box to verify these conclusions for myself. (:NRD)

I voted to build the architecture first but really I think there needs to be a balance of both. If I have the most secure and tight firewall but cannot install it or use it because it is too difficult to set up and will not install without a manual, then I think that I will not use it even though it may be the best there is. I have seen this with other programs that I have tested out for my use. If I cannot immediately make sense of what is going on when I start the program, i will uninstall it, although I see great reviews for it.

Yes, for a firewall you need first of all protection, but this must come with some usability or it it will not be used by the majority of people.

John

I agree with everything you have posted here.

The problem is that Comodo has garnered a reputation with v2.4 of not ironing out all the wrinkles in its softs before moving on to the “next big thing”, something which Scot Finney alluded to in his review.
So we are at the point where OA is at 100%, a PERFECT score, while Comodo can never seem to go that extra inch.

Great to have the perfect foundation for your house, but doesn’t it make you nervous that your contractor may leave your house at 98% complete by not going that extra 2% and installing a lock on your patio door?

Not sure if I would agree with this.
Usability in software is VERY HARD; if it wasn’t, I think all the Linux hackers would have made an OS easier to use than Windows a long time ago.

I would say that making an app secure is more of a science, while making an app usable is more of an art.

You are making this an other firwall vs our firewall issue AXL, this thread has nothing to do with that. The reason why I started this thread is to explain to users our development strategy and logic. So lets not make this this firewall vs other firewall issue pls. There are many other respectable firewalls out there who have followed on our footsteps… so whats your point? You should be grateful for Comodo initiating this to change the whole industry!

btw: there is no 100% security.

thanks

melih

Did I state which was my answer? No. It just a general post.

It is NOT a firewall vs firewall issue, it is a vendor\business model vs vendor\business model issue; it is the very MANNER in which one organization interacts with their users compared to another.

Your comment, “You should be grateful for Comodo initiating this to change the whole industry”, illustrates this point.

I do NOT want to be “grateful” to any vendor, as if they are doing me some favor; before I do that, I would rather PAY financially for my software.
Tall Emu has to answer to its users, because they are the ones that are PAYING for the product.
Comodo doesn’t have to answer to anyone but itself, because they are not only providing the software, but they are also providing the business model which makes the development sustainable.

Ultimately, for all Comodo Firewall Pro users, the question becomes:

How much are you willing to pay for something that is free?

Not up to getting tangled in semantics today…

Thats such a bull**** AXL…

If you think responsibility and accountability only happens if you pay (using Currency) for something, I hate to live in your world!

Melih