Comment 311 for bug 332945

getut: By saying "If people are too unaware to investigate a new icon on the tray or to ignore it for months after it shows up, they deserve a compromised machine", you are -- though I know you don't intend this -- effectively saying that a majority of people who use a computer deserve a compromised machine. I know this can be terribly difficult to understand for people who are interested in every detail of what's on the screen. You think: "How could anyone possibly not notice the icon? And when they do notice it, how could they possibly not wonder what it's for?" Alas, most humans don't work that way; they're ruthlessly goal-centered, and learning the details of operating systems is not one of their goals.

mac_v, James Iry: There is already a mechanism for windows to request attention, and the updates window uses it whenever it opens automatically. Maybe that mechanism needs a more prominent presentation, but that should really be a separate discussion.

Uwe Schilling: You basically restated my point -- assuming that people will see a window that looks like the updates window, and behaves like the updates window, but be able to tell that it's fake solely because it opened automatically. I think that's quite unrealistic, because it would require a much better memory for past actions than people usually have. For example, if you open Update Manager yourself but get a phone call and have to switch to another task in a hurry, and don't return to Update Manager until the next day, you may have no memory of opening it the previous day. (Expecting people to then close it and reopen it, *just in case* the already-open instance was a fake one, would be even less realistic.)

mb_webguy: <https://lists.ubuntu.com/archives/ubuntu-devel/2009-February/027568.html>

bdoe: If there are security updates waiting in the archive and Update Manager doesn't open within a day, please report a separate bug about that. However -- and I apologize in advance if this affects your sleep -- it has never been true that "if there's no icon up there indicating important security updates, then my system is truly secure". A vulnerability may be found and exploited by bad guys before being found by good guys; once it is identified by good guys, it may be hours before it is fixed in a way that the developers are confident won't break anything else; after that, Launchpad may take up to an hour to rebuild the fixed package (depending on the complexity of the package); after that, there may sometimes be an embargo of hours or days agreed with other OS vendors; after it is released from embargo, it will be between 0 and 60 minutes before the new package is published in the Ubuntu archive; and after that, it will be between 0 and 24 hours until your computer next checks for security updates. This is all true regardless of whether that last step involves a notification area icon or the updates window itself.

Chauncellor: If I was turning a deaf ear to comments, I would have long since unsubscribed from this bug report.