Hawiian missle warning

[barbos]

"You are about to send an alert that says ICBMs are incoming. Do you really want to do that?"
"Yes. No."
"Really?"
"Yes. No."

You missed the point. Adding multiple prompts isn't the answer, we tend to reflexively confirm them.

"You are about to send an alert that says ICBMs are incoming. Type 'not a drill' to confirm."

You don't know it does just that after one clicks on the link.

 

[Loren Pechtel]

"You are about to send an alert that says ICBMs are incoming. Do you really want to do that?"
"Yes. No."
"Really?"
"Yes. No."

You missed the point. Adding multiple prompts isn't the answer, we tend to reflexively confirm them.

"You are about to send an alert that says ICBMs are incoming. Type 'not a drill' to confirm."

You don't know it does just that after one clicks on the link.

They would have said so if it did. Besides, that screen screams "amateur"--the confirmation is almost certainly not done right, either.

 

[Keith&Co.]

You don't know it does just that after one clicks on the link.

They would have said so if it did.

It also DOES NOT MATTER how many clicks are actually required. People stop reading the prompts, they just click through them because that's the habit they develop. So more clicks will not solve a problem of complacency.

 

[barbos]

You don't know it does just that after one clicks on the link.

They would have said so if it did. Besides, that screen screams "amateur"--the confirmation is almost certainly not done right, either.

I meant "You don't know it does not do just that after one clicks on the link"

 

[RavenSky]

You don't know it does just that after one clicks on the link.

They would have said so if it did.

It also DOES NOT MATTER how many clicks are actually required. People stop reading the prompts, they just click through them because that's the habit they develop. So more clicks will not solve a problem of complacency.

I think that is Loren's point, too.

His suggestion was to require the operator to type a word like "CONFIRM" rather than just clicking a "confirm' button in order to avoid exactly what you said happens.

I think it is a sensible suggestion, though his suggested phrases were way too long for an emergency situation.

I think just typing "YES" would be sufficient to avoid mindless clicking.

 

[Keith&Co.]

I think just typing "YES" would be sufficient to avoid mindless clicking.

Or a physical interlock. The Navy's big on physical interlocks. You can get the TEST plug out of a drawer, and the OHSHIT plug out of a safe...

 

[Loren Pechtel]

You don't know it does just that after one clicks on the link.

They would have said so if it did.

It also DOES NOT MATTER how many clicks are actually required. People stop reading the prompts, they just click through them because that's the habit they develop. So more clicks will not solve a problem of complacency.

You forget, I build software for a living, I perfectly well know 10 billion confirmation prompts will only work by making it take so long they don't accomplish it.

What I have never seen fail is:

"To confirm that you wish to send out a real ballistic missile alert type 'not a drill' in the box below."

 

[Loren Pechtel]

It also DOES NOT MATTER how many clicks are actually required. People stop reading the prompts, they just click through them because that's the habit they develop. So more clicks will not solve a problem of complacency.

I think that is Loren's point, too.

His suggestion was to require the operator to type a word like "CONFIRM" rather than just clicking a "confirm' button in order to avoid exactly what you said happens.

I think it is a sensible suggestion, though his suggested phrases were way too long for an emergency situation.

I think just typing "YES" would be sufficient to avoid mindless clicking.

No--that would be a bit better but would still fail. The key to what I'm saying is to make them type something relevant to what they are doing--not a static piece of text!

The common case for this is delete operations--where I require the user to type the name of the object they wish to delete.

 

[Loren Pechtel]

I think just typing "YES" would be sufficient to avoid mindless clicking.

Or a physical interlock. The Navy's big on physical interlocks. You can get the TEST plug out of a drawer, and the OHSHIT plug out of a safe...

I'm not sure getting the plug out of the safe is good in a situation like this. Other than that--yes, but this is an amateur job, they wouldn't have recognized the need, nor gotten the authorization if they did recognize it. (Obviously the boss also doesn't see the problem.)

 

[RavenSky]

I think just typing "YES" would be sufficient to avoid mindless clicking.

Or a physical interlock. The Navy's big on physical interlocks. You can get the TEST plug out of a drawer, and the OHSHIT plug out of a safe...

I don't want to know where the OHSHIT plug goes

 

[RavenSky]

It also DOES NOT MATTER how many clicks are actually required. People stop reading the prompts, they just click through them because that's the habit they develop. So more clicks will not solve a problem of complacency.

I think that is Loren's point, too.

His suggestion was to require the operator to type a word like "CONFIRM" rather than just clicking a "confirm' button in order to avoid exactly what you said happens.

I think it is a sensible suggestion, though his suggested phrases were way too long for an emergency situation.

I think just typing "YES" would be sufficient to avoid mindless clicking.

No--that would be a bit better but would still fail. The key to what I'm saying is to make them type something relevant to what they are doing--not a static piece of text!

The common case for this is delete operations--where I require the user to type the name of the object they wish to delete.

At the same time, in an emergency, the phrase needing to be typed needs to be simple enough to avoid delays. Someone freaking out might take several tries to type 'not a drill'. I understand your point about making the word relevant to the intended action, but a one word response should be sufficient and avoid delays when time is of the essence.

 

[Keith&Co.]

You forget, I build software for a living, I perfectly well know 10 billion confirmation prompts will only work by making it take so long they don't accomplish it. "

I don't forget, i was agreeing with you.

I think just typing "YES" would be sufficient to avoid mindless clicking.

Or a physical interlock. The Navy's big on physical interlocks. You can get the TEST plug out of a drawer, and the OHSHIT plug out of a safe...

I'm not sure getting the plug out of the safe is good in a situation like this.

The Navy's philosphy is to decide what's the worst possible outcome and make THAT the most difficult thing to accidentally achieve.

In this situation, the false alarm caused an unnecessary panic, which seems less desirable than an additional ten seconds to send out a real alarm.

Maybe a switch under a cover. In case of fucking missiles break glass. Something completely unlike what they'd do for training. OR even a six foot jumper cable that must be installed between two connections to initiate a real alert.

 

[Keith&Co.]

might take several tries to type 'not a drill'.

On m BEST days there's a 10% chance i'd type 'this is not a dirll' just to demonstrate the system requirements to a class of operators...

 

[ZiprHead]

CNN is reporting that the guy that did this and was fired for it is considering suing the state. He says the mistake was on the part of the system that called him to release the warning. The usual "This is an exercise" said repeatedly was not included and the message also stated "This is not a drill."

 

[Loren Pechtel]

I don't forget, i was agreeing with you.

I think just typing "YES" would be sufficient to avoid mindless clicking.

Or a physical interlock. The Navy's big on physical interlocks. You can get the TEST plug out of a drawer, and the OHSHIT plug out of a safe...

I'm not sure getting the plug out of the safe is good in a situation like this.

The Navy's philosphy is to decide what's the worst possible outcome and make THAT the most difficult thing to accidentally achieve.

In this situation, the false alarm caused an unnecessary panic, which seems less desirable than an additional ten seconds to send out a real alarm.

Maybe a switch under a cover. In case of fucking missiles break glass. Something completely unlike what they'd do for training. OR even a six foot jumper cable that must be installed between two connections to initiate a real alert.

Getting it out of the safe could take a lot more than 10 seconds.

I have no problem with the break glass switch.

 

[bilby]

I don't forget, i was agreeing with you.

Or a physical interlock. The Navy's big on physical interlocks. You can get the TEST plug out of a drawer, and the OHSHIT plug out of a safe...

I'm not sure getting the plug out of the safe is good in a situation like this.

The Navy's philosphy is to decide what's the worst possible outcome and make THAT the most difficult thing to accidentally achieve.

In this situation, the false alarm caused an unnecessary panic, which seems less desirable than an additional ten seconds to send out a real alarm.

Maybe a switch under a cover. In case of fucking missiles break glass. Something completely unlike what they'd do for training. OR even a six foot jumper cable that must be installed between two connections to initiate a real alert.

Getting it out of the safe could take a lot more than 10 seconds.

I have no problem with the break glass switch.

Doesn't need to be a particularly robust safe. You are protecting against idiots, not determined criminals. An unlocked cupboard with a big sign on it saying "do not open during a drill or exercise" would do; a locked cupboard with the same notice, and with key attached on a chain would probably be better.

Make the cupboard fairly flimsy so that in a time-critical emergency you can smash it open with your fist; that's not something that you would do during a drill.

 

[Loren Pechtel]

I don't forget, i was agreeing with you.

I'm not sure getting the plug out of the safe is good in a situation like this.

The Navy's philosphy is to decide what's the worst possible outcome and make THAT the most difficult thing to accidentally achieve.

In this situation, the false alarm caused an unnecessary panic, which seems less desirable than an additional ten seconds to send out a real alarm.

Maybe a switch under a cover. In case of fucking missiles break glass. Something completely unlike what they'd do for training. OR even a six foot jumper cable that must be installed between two connections to initiate a real alert.

Getting it out of the safe could take a lot more than 10 seconds.

I have no problem with the break glass switch.

Doesn't need to be a particularly robust safe. You are protecting against idiots, not determined criminals. An unlocked cupboard with a big sign on it saying "do not open during a drill or exercise" would do; a locked cupboard with the same notice, and with key attached on a chain would probably be better.

Make the cupboard fairly flimsy so that in a time-critical emergency you can smash it open with your fist; that's not something that you would do during a drill.

Acceptable, that's basically a different version of the break glass.

 

[Jimmy Higgins]

I don't forget, i was agreeing with you.

Or a physical interlock. The Navy's big on physical interlocks. You can get the TEST plug out of a drawer, and the OHSHIT plug out of a safe...

I'm not sure getting the plug out of the safe is good in a situation like this.

The Navy's philosphy is to decide what's the worst possible outcome and make THAT the most difficult thing to accidentally achieve.

In this situation, the false alarm caused an unnecessary panic, which seems less desirable than an additional ten seconds to send out a real alarm.

Maybe a switch under a cover. In case of fucking missiles break glass. Something completely unlike what they'd do for training. OR even a six foot jumper cable that must be installed between two connections to initiate a real alert.

Getting it out of the safe could take a lot more than 10 seconds.

I have no problem with the break glass switch.

Fine, inside the recessed Russian dolls.

 

[Keith&Co.]

Make the cupboard fairly flimsy so that in a time-critical emergency you can smash it open with your fist; that's not something that you would do during a drill.

Acceptable, that's basically a different version of the break glass.

One of the critical components for missile launch on the Trident is 'locked' in a cabinet that's sealed with the yellow plastic tag also used to detect fire extinguisher tampering.

Just something physical that requires a pause to reflect exactly what is being done...

- - - Updated - - -

Fine, inside the recessed Russian dolls.

Well, they'd be recessed Freedom dolls in the final system...

 

[Loren Pechtel]

One of the critical components for missile launch on the Trident is 'locked' in a cabinet that's sealed with the yellow plastic tag also used to detect fire extinguisher tampering.

Just something physical that requires a pause to reflect exactly what is being done...

We have the same basic idea--make the real case involve something that forces them to think a bit.

I'm just a software guy so I figure how do to such things in software rather than in hardware.

(Now, when it comes to the big booms there should be an essential hardware component--not merely some sort of lock, but something without which no possible action by the software can bypass. We do not want a Therac-25 incident with a missile!)