Is the Adobe AIR "Install Now" Badge on Web Pages a Bad Idea?
Now that the AirDerby deadline has passed, people are starting to show off their cool applications. I’ve been to a few sites that have an “Install Now” badge (like the Adobe AIR Sample Gallery). These badges allow the user to click on a link and both the AIR runtime and AIR application will be installed for the user. This sounds very enticing and is a very easy method for the user to install your application. However, despite not even working on my system (Windows XP SP2, Firefox and the latest Flash beta), and despite Adobe’s touting of this as a feature (AIR Install Badges), THIS IS A VERY BAD PRACTICE. There’s negative stigma associated with installing software from the web browser, especially software that can access local files. A CTO sees this and their scared-off searching for other development options.
JUST SAY NO TO WEB-BASED INSTALL
The stigma of installing software from links on websites to my local system scares me. Over the years, I’ve trained all my users and friends that it should scare them, too. We can probably thank Internet Explorer and the days of ActiveX Controls for this. Using the AIR “Install Badge” gives the user a very similar experience as ActiveX in the old days, which nobody in their right mind uses anymore because it’s associated with the virus mayhem (not to mention C++ complexity). Why do we want to bring this into the new and exciting world of Adobe AIR?
Users of fine software understand the need to install software to their local system, and that when they do, they should really trust the source of where that software came from. For this process, they’re trained to download the .DMG(OSX), .MSI (Win), etc. to their desktop, and then double-click to invoke the installer. This is something they are comfortable with, and more importantly it’s also a process that raises the user’s awareness that what they’re about to install could be dangerous to their system. Installing AIR applications from a web-page doesn’t make me feel comfortable, despite being prompted with dialog boxes announcing that the code is signed code and asking me where I want to install it. (Adobe is doing a good thing by requiring AIR applications to be signed.)
The use of these badges, and the prompts a user reads, is very reminiscent of Internet Explorer and it’s ActiveX control installation process. And no one trusts that these days, so why duplicate that installation process with the Adobe AIR product? Some proponents of the badge might argue that there’s the automatic FLASH installers. For this, I’d say that Flash is ubiquitous enough, and has enough familiarity that this falls into a different category because users are comfortable installing FLASH. It’s the Coke-a-cola of multimedia viewing on many web sites.
Let’s not confuse users, nor tarnish AIR applications by even offering this service from a web page. Instead, have your users download the AIR file, and then manually install it. This sends a clear message: you’re installing a full desktop application that might be bad for your system, you should be aware of this. This physical act is more important than the reading of dialog boxes.
A suggestion for a better install process
To go a step further, I’m really hoping that Adobe offers some form of packaging for AIR that is native to each operating system. As a developer I can distribute a single DMG or .MSI file that the user downloads. Inside this DMG or .MSI file is the AIR runtime (the version that my application was developed with) and my custom AIR code. I don’t mind the 8 to 10 megs of overhead this brings. This way, users can install software with the appropriate prompts that they are used to from native installs. The Mac users can drag the application to their Applications directory; Windows users can answer all the appropriate prompts. This is an installation process that end-users are both familiar and comfortable with.
Not to mention, this install badge doesn’t even work for me!
I’m on Windows XP sp2 and Firefox, and the latest Flash Beta. It seems most AIR developers are on OSX, so maybe my Windows security configuration is protecting me — or maybe it’s just a bug with the Install Badge? Personally, I’m glad this is failing. However, since I’ve seen this “Install Now” badge on several sites, I have to assume it works on people’s computers. Every application on the Adobe page that I tried to install with the Install Badge, fails.
Summary
The AIR Install now badge is reminiscent of being prompted to install ActiveX controls. Internet users don’t feel good about doing this. Though it’s only in perception, there could (and will) be many malicious applications written in AIR that will do things like erase users images, send files to remote web servers, etc. This is the price you pay for writing applications that run in the user space. Let’s just not confuse the users, nor tarnish the AIR reputation by using these INSTALL NOW badges for your legitimate applications. Let’s leave that circumnavigation to the nefarious webistes. And Adobe, please offer us some form of native install user experience for our applications.
What’s your take on it?
You can learn more about creating AIR install badges by reading AIR Install Badges, How to: Creating an AIR Express Install Badge, and Using SWFObject and the AIR install badge for easy deployment.
Comments
Comment from Paul Neave
Date: September 7, 2007, 11:45 am
Perhaps the terminology is wrong. If instead of “INSTALL NOW” it said “DOWNLOAD NOW” that would be more reassuring, as it would explain that it’s a desktop app not something that’s going to take over your browser and computer.
What do you think?
Comment from Mike Huntington
Date: September 7, 2007, 11:50 am
Well you know Paul …. the install badge is 100% customizable .. it comes with the .fla file.. so the badge can look however you like it to. The main point of the badge is not JUST to install the application … but allow people who don’t have the AIR Runtime to get it without install 2 different programs.
The “average” user doesn’t like having to install 1 program just to install another…. The badge makes this process so much easier.
Comment from taude
Date: September 7, 2007, 12:38 pm
Also, I almost forgot about ClickOnce install that MSFT had in .NET 2.0 Read about ClickOnce Deployment. (Of the many enterprise environments I’ve seen in the past few years, none employed Microsoft’s ClickOnce, they use their systems management software to push bits to all the desktops — I imagine they’d want do the same if they used AIR for a project).
@Paul, I’m not sure it’s a terminology thing. I think it’s more of a clicking-something in the browser, and next thing you know, you’re being prompted to have software installed on your harddrive. With “Download Now” I like the idea of bringing the bits onto your desktop, and then forcing the user to install.
@Mike: having to install 2 things does suck. That’s why I’d prefer Adobe to offer some packaging that will just wrap the AIR runtime with the AIR application so the user only has to install one thing. Using AIR to write desktop software, I don’t really want or need it to be obvious to the user installing my software that it’s written in AIR. What I really care about is that they click on the deployment, or drag the application, and the software is on the user’s machine. They don’t even need to know AIR exists. In fact, if they don’t know AIR exists, that’s all the better, they only care that they have a great application. Also, I was just thinking if the AIR runtime and Air Apps were wrapped in .MSI files, they could be deployed current systems management software.
Adobe AIR really has some potential with creating desktop applications, there’s even space in the enterprise for it. One of the first things a someone said to me during a presentation was “Is this trying to install an ActiveX control?”. There, right off the bat, that’s the gut-reaction AIR impression for someone who has a big budget for development. I think installing from the browser doesn’t send the right message and that AIR isn’t going to be well accepted for this. There’s a lot of people out there looking for a solution to make their website more sticky: Think financial institutions with their customizable Quicken-like set of tools. Sure, the option is there to install from your local desktop after downloading, but it doesn’t take long before people start assuming that AIR Applications install from the web-browser and that’s bad.
Comment from Rob McKeown
Date: September 7, 2007, 12:47 pm
I disagree. If you have ever had to explain to someone, that they need to go download a “runtime” from somewhere, then download and install your app, you would see the glazed look on the end-users face. The one-click install is something that is much easier to explain. “Go here… and click” is much easier for a novice user to wrap their head around and much more error-proof. Granted AIR is still in beta so if there are issues with it not working on a particular system, that doesn’t mean that the official 1.0 release won’t work. Adobe has done such a good job getting people out there to develop on the beta, that we sometimes forget that it isn’t completely done yet.
Comment from Joshua Beall
Date: September 7, 2007, 12:55 pm
While user (mis)perceptions are important, I think we shouldn’t let them make decisions for us.
1) AIR is not an ActiveX control
2) The AIR installer badge *does* require user intervention
3) People *should* be cautious about installing AIR applications! Just like any other app, you should only install an AIR app if you know where it’s coming from and trust that source.
Personally, I think the installer badge is great. It allows you to get the AIR runtime (Adobe Integrated Runtime runtime?) on the client, but they have that 8-10 meg download *only* if they don’t already have it. A packaged installer that includes the download either way doesn’t give you that choice. And if I have a small app (800k), and I now include the AIR runtime, I’ve increased the size of my app by over 10 times. Eek!
But if you don’t like the badge — don’t use it!
Comment from enefekt
Date: September 7, 2007, 1:24 pm
I think the Install Badges are awesome too. Maybe there is some way to design the install badge so it conveys more information to the user somehow, letting them know what happens when they click it.
Comment from taude
Date: September 7, 2007, 1:48 pm
Well, it sounds like the perfect solution it to continue promoting the Install Badge (I agree, a 2-step install is bad), as well as give me the option of wrapping the entire runtime and my code up into a proprietary OS-install. This way, the web-developers that use AIR have their cake with a simple web install (and their customers, most likely home computer users have simple access to their applications), and me (from the angle of a desktop developer) can offer my users software with them never even aware that they’re installing an Adobe AIR application (and I get to keep my application from being associated with the platform that can potentially enable nefarious software installs). Think of how installing Flex Builder works versus the act of knowing that it’s installing JAVA, the ECLIPSE IDE, and then all of Adobe’s customizations.
Remember, all I’m talking about is the perception of installation and what user’s expectations. Maybe 5 years down the road, things will be different and Adobe AIR is only associated with high-quality tools and programs. Right now, I’m not even sure being able to wrap an AIR installer and application up into a proprietary install would fix this perception thing. (Look at how some desktop applications written in JAVA handle this, though I hear the newer Java has gotten a lot better)
My main goal for my products would be to not have them associated with any proprietary development tools. In the old days, I’d write MFC or VB or Delphi, and then create an installer. The user’s never aware of what’s going on behind the scenes, whether is the VB runtime, MFC class libaries, etc. being installed. This is the prefered method for me, as a developer of fine desktop tools. How would Adobe prefer to handle this, like say if they developed PHOTOSHOP CS5 in AIR (not that they would…)? Would Adobe want their premium tools that cost good money potentially associated with a bunch of quick “install now” applications spread throughout the web? Or, would they silently install the required dependencies, and let the tools speak for themselves. Remember, I’m only really discussing PERCEPTION of the end user.
@Rob, I know it’s beta, that’s why I’m mearly offering an opinion. Maybe I’ll get my advanced installation by the time AIR is released in January…
@Joshua What will become more curious is how often the AIR runtime gets updated. I can very easily picture a world just like Java where there’s going to be AIR 1.0, 1.0.1, 1.0.2, 1.0.3, 1.1, 1.2, etc…in which case, I’d prefer to just ship the appropriate AIR runtime file with my application than depend on the user being connected to the network to get the new version, or having the correct version of the runtime installed on their machine. Lots of places that purchase software, just have the install bits located on a network share, and the employees navigate to that share, double-click to install it. Then, let’s not even get started about all the places that have FLASH (soon to be AIR) banned with firewall filtering.
Comment from taude
Date: September 7, 2007, 2:18 pm
One thing I’ve discovered today, I went back and searched the AIR FAQ on the Adobe site — which does get updated. I found the following tasty tid-bit, that I didn’t notice when I first read the FAQ a few months ago:
“Will developers be able to distribute the Adobe AIR installer with their applications? Yes, in addition to creating and distributing cross-platform Adobe AIR application installer files, it will be possible for developers to write their own custom native installers that install Adobe AIR and the Adobe AIR application. ”
So, I know what I’m going to be looking for in the next beta release after MAX 2007, DMG and MSI installations. Or, maybe this will just come in the form of a silent-install that can be customized from the command line? Who knows, I’m anxiously awaiting this!
Comment from Joshua Beall
Date: September 7, 2007, 2:20 pm
I didn’t quite say but: I think having the option to package up the AIR runtime and transparently deploy it alongside your app is a *very* good idea. It’s my understanding that we’re going to get this with the v1.0 release.
Comment from taude
Date: September 7, 2007, 2:35 pm
@Joshua, I bet we were reading that right about the same time!
Comment from Chris S
Date: September 7, 2007, 2:53 pm
I’m confident that of all the aspects of AIR, the installation process will be spot on and painless just like Adobe Reader is commonplace these days. Adobe is well aware that their name is on the wrapper and will make every effort to make a pleasing experience with both the devlopers and end users in mind.
Don’t forget AIR is beta. I wholly expect major changes to the install process the nearer they get to 1.0 and I’m personally not using the badges simply because they may or may not even be the same when it’s all said and done. I know they work…I have installed apps that use them and had no issues (unless Moviestar was installed) but haven’t personally used them for my AIR code and will most likely wait till the upcoming next release to see what the deal is (just personal preference but none of it being security based issues or bad experiences or the like).
Comment from Max
Date: September 7, 2007, 3:41 pm
But you have seen Java applets once or twice in your life? These are potentialy dangerous applications that will simply run directly inside the page.
Comment from Jim Hayes
Date: September 7, 2007, 4:00 pm
>If you have ever had to explain to someone, that they need to go download a “runtime” from somewhere, then download and install your app, you would see the glazed look on the end-users face.
I’ve just been there myself (yesterday), with some close colleagues who are damn smart guys and an integral part of our product team.
They really didn’t want to know until I made an air badge for them, and they are not exactly average users (being quite happy to code scripts in python and c++ to control all their graphics renders, run their own render farm etc).
I actually agree with this post though, I do shout at people if I see them installing/running apps from a web page.
It’s a difficult subject, and not a new one!
Personally I’m aiming for a local disk (either downloaded installer or one provided on plastic disk) based install including runtime for distribution, though I’m still rather unclear on how much help I may get from adobe in this respect. I am planning to have to roll my own installer as a worst case scenario, always assuming that the AIR licence will allow distribution of the runtime (again I’m unclear on this, and not encouraged by the flash player redistribution terms).
It’s a deal breaker for me, on which i’m placing a (hopefully not unwise) large amount of faith in Adobe…
Comment from taude
Date: September 7, 2007, 4:08 pm
@Max…ahh, yes, the old days of Java applets. I haven’t seen a java applet since maybe around 2001? I haven’t allowed applets to run inside my browser since around the same time. Mostly because they seem to always hang the browser while they loaded.
We’re expecting more from Adobe, as they did deliver on the great, safe, sand-boxed functionality in Flash (minus a few issues). Also, I’m not really aware of much damage a Java applet would cause in a browser these days because of sandboxing…though maybe they have some form of elevated privileges that will install applications…which is probably bad? I don’t really know. Does anyone even use that technology anymore? (I can think of one enterprise-class application at the moment that does.) Maybe I’m wrong, though, and there’s a whole secret society on the web still using Java applets. Maybe taking another lesson from Java’s one-click install, I remember trying this out several years ago, since we don’t see it on the web, maybe it’s accepted that it’s just a bad idea? Who knows?
What Max reminds me of, and why I’m hammering home user perception so much, is an import point: we don’t want AIR to become a nuisance technology that people turn-off because of a few bad user experiences (and badge installs enable this potential because people will associate installing a bad application with the Adobe AIR runtime and therefore ban the,). Max pointed out that Java applets have a lot of access that this should be a good thing. I’ll point out out that I have the JAVA plugin disabled in my browser. We don’t want that for AIR’s future because of a few rogue applications.
Comment from taude
Date: September 7, 2007, 5:07 pm
@Jim, I think Adobe will award us with a flexible install solution, especially based on reading their FAQ (see my comment above).
I’m pretty confident that it’ll be wide open in distributing their runtime. It’s in their interest to have that runtime everywhere, and in their interest to have us developers pushing their platform. Not to mention every other company’s toolset I’ve ever used for creating desktop applications has included a pretty much free-range of installation options and licensing terms. I’m not expecting Adobe to be any exception to this.
Comment from milan
Date: September 10, 2007, 3:26 am
It is a interesting problem and I was thinking about this many times, and also believe that Adobe people were. AIR is quite a revolutionary thing and we’ll see if time for such a revolution has come or not :) So, I see the problem of RIA’s and AIR apps like this: Flex is such a good and free thing that a lot of web developers will use it easily. I mean someone who can produce web page (and this is a big crowd of people) can produce also a flex RIA and with AIR it can produce also a desktop application. But, do I want to install some web page on my desktop? NO.
The web is going to change, users are going to change their habits, suddenly people will became honest and will not try(again and again) to access my hard disc? NO. So I see quite a long process from security point of view to gain ubiquity with AIR. I want to believe different, but the facts says this.
I think the best way is to make online version of application, and when will users have enough confidence in authors and application as such, they will install it.
My 0.2 $
Comment from Y-boy.cn
Date: September 15, 2007, 2:53 am
I am chinese , but, I feel the install badges is very convenience…
Pingback from Adobe AIR 在线安装（AIR Express Install Badge） | 无雨之城
Date: September 16, 2007, 8:25 pm
[...] &entryId=BB5967F0-3048-7802-93A814E581EB8CEB ■ 从安全角度看 AIR Express Install Badge : http://www.simplifiedchaos.com/2 … [...]
Pingback from Flex Studio» Blog 存档 AIR Express Install Badge [在线安装AIR]
Date: April 2, 2008, 11:11 pm
[...] 安全 AIR Express Install Badge http://www.simplifiedchaos.com/2007/09/07/is-the-adobe-air-install-now-badge-on-web-pages-a-bad-idea... [...]
Comment from Mike Huntington
Date: September 7, 2007, 11:32 am
So for everyone I’ve talked to love the quick install badge feature. I have yet to hear one complaint. I guess everyone is different. I for one love the install badge feature.