Hacker News Reader

Comment by golergka | Hacker News Reader

Typical result of developers overestimating users. If a browser developer sees that some file suddenly downloaded automatically, he would notice it instantly and delete it if it's something fishy. But a lot of typical users wouldn't notice (the kind that never closes download bar in chrome anyway) and would never clean up their downloads folder. Damn, a lot of them would even run it to find out what it is.

View on HN

No, I think it has more to do with the way that executables on Windows are 'tagged' as having been downloaded from the internet. When a user opens one of them (such as an installer) they get a prompt if they want to run this code from the internet. Generally, this is considered a good thing.

Browsers, in a stroke of unassailable logic, have decided that the existence of this new security feature should mean they should now start silently downloading executables from websites. After all, what good does it do to have two pop-up warnings that users simply click through?

This is just my impression, I could be wrong about all this.

This is an interesting point because there's no corresponding warning when loading a DLL from the internet zone. hm.

> they get a prompt

Yeah. About prompts and real users. In my experience, once user clicks on a given prompt 5 times, after that he's completely trained to close it automatically without giving a slightest regard to it.

In this case, the user clicking through the prompt isn't the issue. They wanted to run the non-malicious installer and so they did. If they read and re-read the prompt, they would still make the same decision

Reply on news.ycombinator.com