Sven Slootweg @joepie91@pixie.town

An interesting #UX lesson from a *very* old blog post by, I think it was Yahoo?

Never do total UI overhauls. Instead, take your "target UI", the thing that you're trying to work towards... and just change one thing. A single thing. A small one, that's easy to get used to.

Next week, do the same. The week after that, do the same. Introduce the changes very gradually and very slowly, so that the end user never feels lost, and never suddenly has to adapt to a new UI to get their work done. Ideally they shouldn't even notice the change.

There's a reason that so many especially older folks kept insisting on using Yahoo services, despite the severe mismanagement within the company.

Likewise, I think 'fake' vegan minced meat may now be cheaper than the real thing (though it's still of extremely questionable quality)

It's official: vegan 'fake' cheese is now cheaper in NL than real cheese

(Corollary: packages that boast "zero dependencies" on average tend to contain far more bugs and even security issues than equivalent packages with transitive dependencies; which is not that surprising, when you consider that this means it'll be reinventing a lot of wheels inline)

As a bit of extra background: I've been professionally auditing (probably thousands of) FOSS dependencies for years now, in a high-risk environment, and *not once* have I run across deliberately malicious code, not even questionably broken code, really.

Every single issue so far has been a security issue, none that were likely to be disguised backdoors. Many of them very common security issues that most developers are likely to create themselves when reinventing wheels (eg. when avoiding dependencies out of a misguided fear of malicious code).

That's where the *real* risk is.

This also feels like one of those cases of the metaphorical-law-I-forgot-the-name-of, where people perceive an uncommon event as being really common because it's so uncommon that it gets widely reported every time it happens, and therefore skews people's perception of its frequency

And no, it's not *just* security folks overestimating the threat level, tons of software developers do it too (and often at the same time overlook the things that are *actually* dangerous)

I don't think computer people really realize just how little (relevant) malicious code actually exists on the anyone-can-upload package registries, and folks seem to consistently overestimate the actual threat level here

Tired: who would ever buy these useless home shopping gadgets?

Wired: oh, the target demographic is disabled folks, not me, some of them turn out to be really useful though...

Inspired: wait, my ADHD motor control issues are a disability, and I *am* the target demographic