No More Confirmation, pt 2: To Confirm Is Useless; to Undo, Divine

The common technique of confirmation, popping a dialog box into the user's face and asking, "Are you really Really REALLY sure you want to do that?" is evil. It's unfriendly, it's distracting, and it's completely ineffective. Have you ever, even once, said, "Whoa! I didn't want to do that. Thanks," and clicked No? Have you seen anyone do that? Have you even heard of anyone doing it? I haven't. It shouldn't exist. Anywhere. Ever.

Confirmation is so vastly overused that it has become completely useless. Because the box constantly cries "wolf!" like the shepherd boy in Aesop's fable, no one pays attention to it, even when it's warning you of something you really don't want to do. You cruise through it on auto-pilot, clicking Yes without thinking, an action the cognitive scientists call "chaining".

We might just tolerate the annoyance of confirmation if it actually made us safe, but research has shown again and again that it does not. On the contrary, mistakenly believing that a confirmation box will prevent users from making mistakes gives programmers a false sense of security. It keeps programmers from having to clearly explain to the user what he's doing, and providing a way to recover when he does something that he later regrets, despite having originally confirmed it.

No human being is ever 100% certain about anything; just ask anyone who's married. An application with undo capability recognizes and honors a user's humanity. One that lacks Undo is insisting that a user become something other than human to use that application successfully. Which would you rather buy?

Other operations in life don't require confirmation. Your car does not ask, "Do you really want to start the engine?" when you turn the key. The supermarket clerk does not ask, "Do you really want to buy these?" when you place groceries on the register belt. Programmers constantly ask for confirmation because they think users don't understand the consequences of their commands. That may be true, given the poor quality of the user interface. But confirmation doesn't solve this problem. If the user was confused when he first gave whatever command triggered the confirmation box, he'll be even more confused when he sees it.

But what if the user really has made a mistake? If you put a flashlight on the register belt with a package of the wrong size batteries, wouldn't an attentive clerk ask, "Are you sure you want this size and not the one that fits the flashlight you're buying?" A good user interface should and can save us from mistakes like that, but it won't happen by blindly and stupidly asking, "Are you sure?". Instead, a good user interface prevents the problem initially by Just Working. Perhaps the Web page selling flashlights would contain a check box saying "include batteries," checked by default. Better still, the flashlight would come with batteries already inside it, so it'd work the instant you unwrapped it and no one would ever have to worry about buying the correct size. Now that's a design that Just Works.

Another reason that you aren't asked to confirm starting your car or buying groceries is that these operations are easy to undo. You just turn off the key or return the unwanted item. Programmers often put "undo" capability in their programs, where it's the greatest design advance since the mouse. It takes an enormous amount of effort to make this feature work so that users don't even have to think about it ("easy is hard, the saying goes"), but the programmers who implement it are any user's best friends. I buy them beer whenever I meet them.

The worst confirmations are those of undoable actions, such as moving a file to the Recycle Bin, shown below:

It's much more efficient to fix the relatively small number of errors that actually do occur (for example, a slip of the mouse deleting the wrong file) than attempt to prevent them by annoying the user with a confirmation box every time (which are usually ignored out of habit). An ounce of cure is not worth five pounds of prevention, especially when what the programmer THINKS is prevention does not prevent anything.

The beauty of undo is that it allows users to explore a program. It's not always easy to understand a new program's operation from menu items and toolbar pictures. With undo, a user can try different commands, knowing that he won't damage something that can't be repaired with a few keystrokes. Programmers often regard incorrect user input as the act of an idiot who should have read the %*$#% instruction manual. It isn't. It is the primary mechanism by which the human species learns.

If undo is implemented correctly, then there's only one destructive operation in the entire system: emptying the Recycle Bin. Some would say that this operation should have a confirmation box, as it currently does. But even here, the confirmation dialog exists only to guard against another bad design, placing the "Explore" context menu item next to "Empty Recycle Bin." One slip of the mouse, sliding down three spaces instead of two, and you get the latter instead of the former. That's bad. Emptying the Recycle Bin should have a special action used for no other purpose, perhaps clicking on it while holding down some key. Better still, the Recycle Bin should automatically delete files after some configurable period of time so you'd seldom have to empty it manually. Don't you wish that your real trash cans Just Worked like that?

A good application should never ask permission. Programmers should provide undo capability, and not ask for confirmation. That's the way to write an applicatin that Just Works

No More Confirmation, Pt. 1

One major mistake that programmers make when they design user interfaces is to force users to understand the internal workings of their programs. Instead of the programmer adjusting her user interface to the user’s thought processes, she forces the user to adjust to hers. Furthermore, she’ll usually see nothing wrong with that approach. “That’s how my program works,” she’ll say, puzzled that anyone would even ask the question of why her user interface works the way it does.

Here’s an example of what I mean. Open Windows Notepad, or any other type of editor program, and type in any random text. Now select “File – Exit” from the main menu, or click on the X box in the upper right of the title bar. You see the following message box:

What exactly is this box asking us? It seems to be saying that some file changed, but I haven’t seen any file anywhere. What the hell does “save the changes” mean?

The answer is that Notepad usually edits documents, (called “files” by computer geeks) which live on your computer’s hard drive. When you open a document, Notepad copies it from the disk into the computer’s memory. As you add or remove text by typing, the program changes the contents of this memory copy. (In this example, we didn’t open an existing document, but the program created a new one in memory, giving it the name ‘Untitled’.) When you’re finished working on the document, the program has to write the memory copy back to the disk, called “saving the file”. Otherwise the work that you’ve done will disappear, and you’ll get very angry.

The programmer wrote the program this way (copy the document from disk to memory, make changes on the memory copy, write it back to disk) because that was easiest for her. And it’s not a bad way to write a program. Reading or writing characters from the disk (spinning iron platters with moveable parts) is roughly a thousand times slower than doing it in memory (electrons moving at the speed of light), so this probably IS the best way for this simple program to work internally.

But the programmer’s user interface exposes these workings directly. How can that be bad? She’s forcing you to understand that she’s written the program this way. You shouldn’t have to know or care about her program’s internal workings to use it successfully, as you shouldn’t have to know or care (and you probably don't, either of them) whether your car’s engine uses fuel-injection or a carburetor in order to drive it.

You don’t normally think in the way that this program works. Most people think of editing a computer document as analogous to the paper-and-pencil (remember those?) method. You make marks with the pencil and there they are on the paper. You erase the ones you don’t want. If you don’t want any of them, you crumple up the paper and throw it away. The work that you’ve done is permanent, unless you expend energy to get rid of it. But that’s not the choice that Notepad gives you. Every single new user of computers gets caught on this – selecting No, in which case Notepad discards the work that you’ve done – hopefully not too much of it. Eventually, the user learns to think like a computer program, or more precisely, like the programmer who wrote this mess.

The question and its answer would be much clearer if the message box asked “Throw away everything you’ve just done?” It’s exactly the same question, just asked from the user’s point of view. But the programmer is thinking only of her program’s operation, writing to the disk, and asks you whether to do that. She’s requiring you to wear her shoes; she hasn’t even tried to put herself in yours. If she had, she’d ask the question a different way. She then might see the ridiculousness of asking it at all, and design a better user interface, even if the underlying program worked the same way.

That’s one major reason that programs are hard to use and you feel dumb. You’re being forced to think like a programmer, even though you’re not and don’t want to be. You shouldn’t have to. You don’t have to think like a mechanic to drive a car, you don’t have to think like a doctor to take an aspirin, and you don’t have to think like a butcher to grill a hamburger. You’re paying your hard-earned money for this product. It’s the programmer’s job to adjust to you, not the other way around.

Quicken, the personal finance program, does a better job . Their designers understand that the user’s mental model is a checkbook, and their screen looks like a checkbook register:

It feels familiar and comfortable (well, relatively) to a new user and doesn't hamper an experienced user. The check that you’re currently working on is shown in a different color. You enter the check’s details and press Enter. The check moves up, changes color to look like the rest of them, and a new empty check appears in the work area. If you have sound turned on, you hear a “ka-ching” cash register type of sound. The program doesn’t ask you whether or not to save the check. The act of pressing Enter tells the program that you want to keep that information. If you later change your mind, and want to change the data on a check or delete one entirely, you click on that check in the register and type in the new information. When does Quicken read its data from the disk to memory, and when does it write it back again? I don’t know and I don’t care. And I don’t want to and neither do you. The program’s user interface follows your mental model, instead of forcing you to learn and deal with the internal design choices of its programmers.

Most programs ought to work this way -- save data automatically unless the user says otherwise -- because users save their data much more often than they throw it away. That's one good example of what I mean by Just Working.

Disk Backup that Just Works

When was the last time you backed up your hard drive? Almost nobody does. I never did until my disk crashed containing a) all my financial records and b) all of my daughters' baby pictures, and it cost me $1500 to have it recovered. I then did what everyone else does who loses his data – bought a backup program and a network drive, ran it two or three times, then forgot all of my virtuous resolutions and ignored it; just as I did with my gym membership.

I first tried Genie Home edition, which had won a PC Magazine editors' choice award. I knew right away that I'd made a bad choice when I saw the following dialog box at installation:

This is a product whose designers consider Easy to be the opposite of Normal. It reminds me of the Three Stooges comedy short No Census, No Feeling (1940), in which Moe asks a man, "Are you married, or happy?" And they make "not easy" the default choice. Not the right product for me.

Genie offers many, many choices, as shown here:

It is immensely powerful. It can do almost anything one might ever want to do with backup. But this flexibility is not what home users, small business users, and arguably many large business users need or want. They want to be safe, but not so badly that they'll think about it or lift a finger to do it. And they shouldn't have to.

Like seat belts or birth control, disk backup schemes only work if you use them. Therefore the right method for you is not the one that works best in the laboratory, but the one that impinges on your lifestyle the least so that you actually do use it. Since backup programs require thought to set up, and then effort to use, no one ever does it. We all have a "hierarchy of needs", as one of my students once described it, and any given disk backup ranks low in that hierarchy. It's really, really easy to let this one slide, because it doesn't bite you TODAY, and lots of other stuff does. They (and I, and probably you, too) need disk backup that Just Works.

Such a program is Carbonite automatic online disk backup (http://www.carbonite.com/). (Note: I have no business relationship with Carbonite other than as a satisfied customer. Another product called Mozy does similar things. I haven't used it, but Walter Mossberg liked both products in a recent review.) You download and install a program which runs in the background whenever your system is running. Every time a data file changes, Carbonite waits 10 minutes to see if it'll change again, then automatically sends the file over your broadband connection to its backup server. You don't have to think at all, or touch anything. It's completely fire-and-forget. Compare the Genie screen shown above with Carbonite's status screen here. Which would you rather see?

Carbonite does the things that most users care about most of the time – protects against disk crashes, or your machine getting lost or stolen. It stores the backed-up data off your site to protect it against fire or disaster, and keeps files for a month after you delete them from your hard drive to protect against accidental deletion. If you lose data (WHEN you lose data, the Second Law of Thermodynamics guarantees that you will), you restore it through the Windows Explorer. It costs $50 / year for unlimited storage, so you don't have to think about the size of your backup data (mine's about 13 gigabytes).

Carbonite omits the features that few users care about, and the product is much more reliable and easy to use as a result. Its option screen is shown in the following picture, and you can see that there aren't many:

I consider this absence of frills to be a very attractive feature. You can't, for example, schedule Carbonite to run at particular times. There's no need, because it's always sitting in the background, backing up changed files as soon as it can. You can't easily get it to back up your program files or system registry unless you go digging. Again, that's not what most people care about most of the time. If you lose your data, you have probably lost your whole disk, in which case you are better off with a clean install of programs from their sources. Your data, like my daughters' baby pictures, can't be replaced by a commercial vendor. Carbonite won't back up any file larger than 4 gigabytes, but few users have files that large (about 7 CDs worth in a single file; we're talking full-length full-size movie here.) It only keeps deleted files for a month, and doesn't keep multiple versions of a file, only the most recent. To my mind, adding these so-called features would detract from its main benefit – protection against the primary hazards (hardware failure, loss, or theft; site disaster; inadvertent deletion) with exactly zero thought or effort.

Developers ask me, "My sales people will laugh in my face if I send them out without a list of features as long as my arm, like Genie has. How the hell can I give them something that Just Works?" That's looking at the problem exactly backwards. Your user isn't you. What home user, what small business administrator, and even how many enterprise-scale administrators could turn down the sales pitch, "Write me a check, then scratch 'disk backup' off your to-do list forever. Or at least until next year, when you spend five minutes to write me another check, then go back to ignoring me." None, none, and not many.

Carbonite is the best example I've found so far of a good, useful program that Just Works. We need more programs to work this way. Send me your examples, good or bad, so I can trumpet them from the rooftops.