Installing Applications on the Mac is Broken

When recently visiting my parents, my dad asked me to help him install Firefox on his Mac. He was able to download the application just fine, but actually installing it proved a bit more confusing. The reason for this is that installing applications under Mac OS X is essentially broken.

How it used to be

Installing apps on a Mac used to be simple. In Mac OS 9 and earlier versions, you would typically download a StuffIt file. All Macs came with StuffIt Expander, which would open the .sit file, put the contained application or a folder with the application in its place, and remove the .sit file. You could then simply use the application right where it was, or you could move it somewhere else. That is not the case anymore.

How it is today

Apple probably realized that relying on a third-party application for installing apps was not a good idea. So they stopped bundling StuffIt Expander with Mac OS X. Instead, developers started to abuse images to deliver downloadable applications. Nowadays, most Mac applications come on .dmgs. After the user downloads the application, Mac OS X mounts the image. The user is then supposed to drag the application to the applications folder, unmount the image’s volume and throw the .dmg to the Trash. This is too complicated. Most “normal” Mac users don’t understand that the application on the mounted .dmg is not really on their system. They start the application from the .dmg and end up confused when it disappears after a restart. To fix this, developers started adding instructions to the mounted dmg’s window. Here’s how’s Adium’s mounted image window looks:

The picture is supposed to show the user that he should drag the Adium icon to the Applications icon. Of course, this is still too confusing for many users. Even worse, it doesn’t work like this for all applications. Here is the mounted image window for the aforementioned Firefox:

If you thought you could actually drag the Firefox icon to the Applications folder icon, well, tough luck. The Application folder icon isn’t actually an icon at all, it’s part of the background image. The idea is that you open a second window and drag the Firefox icon to the second window’s Applications folder.

These are more than two kinds of Mac “installers.” Google (among other companies) rolls its own installation thing. Adobe uses a third-party for its installers, which are often less than perfect. Some applications use what Apple confusingly calls “internet-enabled images.” These are images which, upon double-clicking, replace themselves with their content and then move the .dmg file to the Trash. Obviously, Apple saw the issue with images and tried to fix them, but only managed to create additional confusion. And of course, Apple doesn’t use any of these solutions. Apple generally delivers its software as normal .dmg files with files which start Apple’s own installer application. Some applications have now started alerting the user when they are launched from a mounted .dmg, asking whether they should move themselves to the Applications folder.

All told, installing applications on the Mac has become inconsistent, confusing, and just plain broken. It’s time for some kind of usable standardized consistent behaviour to emerge. Perhaps having the application work as its own installer, asking the user whether it should move itself to the Applications folder if it’s launched from a .dmg (and afterwards ejecting the .dmg, and launching the installed application, as wel as optinally installing an icon in the Dock), would be a good first step.

Addendum: Michel Fortin, author of the excellent Sim Daltonism, a color blindness simulator which I use to test user interfaces for “compatibility” with color-blind people, has an article on the subject. His solution is to provide applications as downloadable ZIP files. Safari will open such files automatically, replicating how Mac OS used to work before OS X. This is a reasonable solution; the issue I see with this is that downloadable .dmg files have trained people to expect some kind of window showing the new application to open automatically. Downloadable ZIP files simply place the application in the downloads folder, where the user may then promptly forget about them.

Addendum 2: Versions, a Mac Subersion client, throws up a dialog box saying “Versions is downloading, you’ll find it in your downloads folder.” after you click on the download link. The download itself is a ZIP file. Quite a neat solution, I think.

April 6th, 2008 / Tags: mac os x, apple, installer, firefox, adium, user interface, usability / Trackback

How to avoid catching a Computer Virus

First of all, forget about Antivirus Software. As Jeff Atwood writes, blacklisting viruses does not work. The sum of all issues Antivirus software causes is a lot bigger than the sum of all issues you avoid by having Antivirus software installed. In other words, the problems Antivirus software causes are worse than the viruses you get by not having Antivirus software.

So how do you avoid viruses? Here are a few hints:

• Avoid market leaders. Viruses generally target software with large installation bases. Use a Mac or Ubuntu instead of Windows. If you have to use Windows, use Firefox (preferably with NoScript) instead of Internet Explorer. Do not use Microsoft’s e-Mail applications. Do not use Office applications such as Word, Excel or Powerpoint if you don’t have to. If you have to read documents from these applications, use third-party applications which can read the formats such as Open Office, Google Docs, Text Edit in Mac OS X, or iWork.

• Do not run as Administrator or root. Create a second, normal user account and use your computer running this account.

• Think before you enter your Administrator password. When you’re not running as Administrator, applications will sometimes request additional privileges to access data your current user does not have the rights to. Don’t just enter your password. Consider the application requesting additional rights. Does it really need those rights? What for?

• Run a firewall. Most modern operating systems come with a firewall installed out of the box. Activate it if it’s not activated by default (bad Apple!). Use a spam filter. A good solution is to use gmail to access your mail accounts, and then access gmail from your mail application. Gmail has a built-in spam filter, as well as a malware detector. Furthermore, it’s generally a good idea to discard spam messages without opening them. Opening a spam message could potentially exploit a buffer overflow issue in your mail application or browser. If you can identify spam by its subject and sender, just delete it without opening it. Do not run applications you did not get from a trusted source. There are only two trusted sources: CDs given to you by an official vendor, and the software vendor’s official homepage.

• Use virtualization for risky applications. You can use Internet Explorer without any risk, as long as you run the application within a virtual computer. Use VMWare, Parallels or a similar solution to run risky applications. Make sure that the application is sandboxed, i.e. has no access to your “real” computer from within the virtualized computer. Keep incremental backups. There is no absolute security, no matter what you do. Chances are, you’ll get a virus sooner or later, and you’ll lose data. If that happens, don’t try to get rid of the virus. Instead, roll your whole system back to the state before the infection. Mac OS X makes this extremely easy, just buy a big external disk, plug it into your Mac, and it’ll ask you whether you want to use it for your backup. That’s it. It’s easier to backup than to not backup, so just do it.

Above all, don’t be stupid. If you don’t du dumb things like visiting untrusted sites with Internet Explorer, or launch applications you’ve downrobbed from some torrent site, you probably won’t get infected.

TidBITS agrees :-)

January 8th, 2008 / Tags: virus, virtualization, parallels, vmware, internet explorer, firefox, ubuntu, mac / Trackback