-
-
Notifications
You must be signed in to change notification settings - Fork 210
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Add threat model labels #2605
Conversation
✅ Your preview is ready!
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
First of all, I think that adding threat model labels is a great idea! It helps promote the "right tools for the right job" approach that I find far more productive than the absolutist "does using x tool(s) make me private/secure" discourse that is unfortunately so common in privacy spaces. In the same vein, these labels can direct people to the resources about threat modeling if they somehow skipped the Knowledge Base.
(Apologies in advance for the wall of text)
Having reviewed the deploy preview, here are some suggestions on how you can improve this feature:
- I don't think having an icon next to a tool alone is that helpful, since readers don't know what the icon signifies. What you can do to make the threat model labels more helpful is to embed them with an internal link to the Common Threats KB page. That way, readers have a reference of what each label signifies.
- Ideally, on the Common Threats page, the explainers for each threat would have their own hyperlink that could then be embedded to the threat model labels on the Recommended Tools pages. That way, when readers hover over a specific label, the instant preview that pops up gives them the respective explainer at a glance. Right now, not every threat explanation on the Common Threats page has its own hyperlinked section, but that can be changed with a simple PR.
- There are some pages (and sections of pages) in the deploy preview where, according to the threat model labels, there are multiple tools that protect against the same threats. One example of this is the Password Managers page. This can lead to unnecessary redundancy, especially when there are a lot of tools on a page (hence why I brought up the example of the PwdMgr page). What you can do to alleviate this issue is that, for a set of tools that protect against the same types of threats, the labels can be placed next to either the title of the page/section or right before the first introductory sentence of the page/section. Then, these labels don't need to be repeated anywhere else on the page.
- I'm aware of some recommendation pages that feature one tool which protects against an additional threat that other tools on the page don't (e.g., Peergos on the Cloud Storage page). For such cases, the previous suggestion applies, and there can be an additional sentence or two in the recommendation card that expands on how this tool protects against this additional threat. This explanation does not need to compare e.g., Peergos to Proton Drive or Tresorit; it could simply highlight its P2P architecture as an advantage against censorship.
These are my notes for how you can improve the implementation of the threat model labels. I hope that any part of this wall of text helps.
Also, here are some technical suggestions related to your PR:
- You might want to rebase your PR with the latest updates in
main
, especially considering that the Android and Productivity Tools pages were recently completely overhauled 😅 - There are some pages in the deploy preview where the labels were not visible for some reason, like the ones on the Tor and VPN pages.
Co-authored-by kimg45 <[email protected]> Signed-off-by: redoomed1 <[email protected]>
Co-authored-by kimg45 <[email protected]> Signed-off-by: redoomed1 <[email protected]>
This pull request has been mentioned on Privacy Guides. There might be relevant details there: |
Changes proposed in this PR:
Contribution terms (click to expand)
1) I am the sole author of this work. 2) I agree to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute my contribution as part of this project. 3) I have disclosed any relevant conflicts of interest in my post. 4) I agree to the Community Code of Conduct.