GUI: explain some confusing button options

[tredondo]

I'm an experience user of firewalls and in general, but I couldn't figure out two things in the connection pop-ups:

1. What's the difference between "Reject" and "Deny? This isn't explained in the Getting Started wiki, or in the FAQ. Pardon the stupid question but IMO the user shouldn't have to read a manual to discern between the most basic actions to take.
2. What's the difference between the two "Allow" buttons? Is the "Allow" on the right temporary, and doesn't create a rule? That's a wild guess.

Adding tooltips would help, as well as updating the wiki. The screenshots are also many versions old. I started #1268 but I just don't know what these buttons are supposed to do. This should be covered in Getting Started.

[Danny3]

Some tooltips with explanations would be nice!
But if they are implemented, I think there should be an option in the settins to turn them off because after a few times of seeing them we can remember what each thing means and we will know it for next time and we don't need to be annoying by the tooltip popping up again.
There's also the possibility to add small buttons next to them with an "i" letter inside so the tooltip only shows when that small button is clicked, like KDE Plasma does in its System Settings control panel.
I would prefer the first option with being able to turn off the tooltips after a while.
And yes, it would be nice is the wiki is also updated.

[tredondo]

Agree with everything @Danny3 said.

In the meantime, what IS the difference between those two Allow buttons?

Maybe rename the "Allow" on the right "One-time allow", if that's what it really does? Why does the "Allow" in the drop-down exist? What happens when you select "forever" and click the Allow on the right, instead of the Allow in the drop-down?

[gustavo-iniguez-goya]

There's no difference between the two Allow buttons. The button on the right is a fixed option to allow a connection. The combobox is configured dynamically, based on the option configured from the Preferences.

What's the difference between "Reject" and "Deny? This isn't explained in the Getting Started wiki, or in the FAQ. Pardon the stupid question but IMO the user shouldn't have to read a manual to discern between the most basic actions to take.

The difference between both options is that Deny will silently discard the connection. The application initiating the outbound connection typically will try up to 6 times to connect to the destination host/IP (/proc/sys/net/ipv4/tcp_syn_retries), until it gives up exiting by timeout.

The Reject option kills the socket inmediately.

There's also the possibility to add small buttons next to them with an "i" letter inside so the tooltip only shows when that small button is clicked, like KDE Plasma does in its System Settings control panel.

I only see the (i) icon on the Keyboard and Session settings, next to the Spare layouts or Ignored apps. The rest of the options have a global Help button of the section.
https://develop.kde.org/hig/displaying_content/#inline-help-and-tooltips

We could add tooltips to the buttons, but I think that it'd be better to redirect users to the wiki page (there's little space in the popups, and they're already saturated with information). I might be wrong, but these doubts arise the first times you use the application.

The rules editor and Preferences dialogs are different. They have a lot of tooltips to help users understand things without having to read the wiki page.

[tredondo]

Thank you for the explanations!

There's no difference between the two Allow buttons. The button on the right is a fixed option to allow a connection. The combobox is configured dynamically, based on the option configured from the Preferences.

Any thoughts of showing all three buttons at once, and no combo box? Or cutting Allow from the drop-down, since it's identical to the one on the right. Or... have just two buttons, Reject and Allow, if I understand the explanation of the difference between Reject and Deny. Based on that, it seems Reject should always be favored over Deny, no?

The combobox is configured dynamically, based on the option configured from the Preferences.

I've just checked and apparently Allow can be set as the default:

That will lead to two Allows on the screen - a little strange, but I think the utility here to show the default action (Allow).

There's got to be better UX for this... for example with no combo but two buttons, Reject and Allow, if the default action was Allow, then the counter could count down in the Allow button instead of in the (former) combo. If the combo box is maintained, with Reject and Deny, if there's a useful difference between them, the counter can still count down in the fixed Allow button if Allow was the default action. The improvement would be removing Allow from the combo box.

The application initiating the outbound connection typically will try up to 6 times to connect to the destination host/IP

Indeed, I've seen applications repeatedly attempt the same connection I would Deny once, which became frustrating real quick, so I would choose 30s and click Deny. But if Reject was the default, then problem solved... Actually, that doesn't seem to be the case, at least not for WebStorm. I clicked Reject instead of Deny, and it still attempted to phone home 6 or 7 times. Maybe this behavior is application-specific. But anyway, what's the use case for Deny? As a not-super-technical user, I don't see it :)

[e3dio]

Maybe this behavior is application-specific. But anyway, what's the use case for Deny?

Yes every application can handle Reject/Deny differently. Some apps freeze up waiting for a response if you Deny, so better to Reject. Other apps for example Chrome web browser will constantly port knock localhost:9229 and with Reject it retries every second. If you Deny it will wait 30 seconds for a response before trying again. This will reduce annoying event logs by 30x

[gustavo-iniguez-goya]

that's it, thanks @e3dio :)

Also when you Reject a connection is obvious that there's something blocking the connection. If you discard it, it's a bit harder to know if something is being blocked or if something is not working. For regular use, like benign apps phoning home it probably doesn't matter much in this respect.

That will lead to two Allows on the screen - a little strange, but I think the utility here to show the default action (Allow).

The default combobox action is Deny, and the countdown timer is set in the Allow button. At least with latest sources:

The improvement would be removing Allow from the combo box.

Yeah, mmh, it doesn't have much sense actually to have that option. I think it can be removed 👍