Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add threat model labels #2605

Closed
wants to merge 29 commits into from
Closed

Conversation

friadev
Copy link
Contributor

@friadev friadev commented Jun 2, 2024

Changes proposed in this PR:

  • add threat model labels
  • I agree to the terms listed below:
    Contribution terms (click to expand) 1) I am the sole author of this work. 2) I agree to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute my contribution as part of this project. 3) I have disclosed any relevant conflicts of interest in my post. 4) I agree to the Community Code of Conduct.

Copy link

github-actions bot commented Jun 2, 2024

Your preview is ready!

Name Link
🔨 Latest commit de739fe
😎 Preview https://2605--glowing-salamander-8d7127.netlify.app/

@friadev friadev changed the title Add threat model labels feat: Add threat model labels Jun 4, 2024
@friadev friadev marked this pull request as ready for review June 28, 2024 12:33
@dngray dngray added the c:enhancements new features or other enhancements to the website itself label Jul 19, 2024
Copy link
Member

@redoomed1 redoomed1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First of all, I think that adding threat model labels is a great idea! It helps promote the "right tools for the right job" approach that I find far more productive than the absolutist "does using x tool(s) make me private/secure" discourse that is unfortunately so common in privacy spaces. In the same vein, these labels can direct people to the resources about threat modeling if they somehow skipped the Knowledge Base.


(Apologies in advance for the wall of text)
Having reviewed the deploy preview, here are some suggestions on how you can improve this feature:

  1. I don't think having an icon next to a tool alone is that helpful, since readers don't know what the icon signifies. What you can do to make the threat model labels more helpful is to embed them with an internal link to the Common Threats KB page. That way, readers have a reference of what each label signifies.
    • Ideally, on the Common Threats page, the explainers for each threat would have their own hyperlink that could then be embedded to the threat model labels on the Recommended Tools pages. That way, when readers hover over a specific label, the instant preview that pops up gives them the respective explainer at a glance. Right now, not every threat explanation on the Common Threats page has its own hyperlinked section, but that can be changed with a simple PR.
  2. There are some pages (and sections of pages) in the deploy preview where, according to the threat model labels, there are multiple tools that protect against the same threats. One example of this is the Password Managers page. This can lead to unnecessary redundancy, especially when there are a lot of tools on a page (hence why I brought up the example of the PwdMgr page). What you can do to alleviate this issue is that, for a set of tools that protect against the same types of threats, the labels can be placed next to either the title of the page/section or right before the first introductory sentence of the page/section. Then, these labels don't need to be repeated anywhere else on the page.
    • I'm aware of some recommendation pages that feature one tool which protects against an additional threat that other tools on the page don't (e.g., Peergos on the Cloud Storage page). For such cases, the previous suggestion applies, and there can be an additional sentence or two in the recommendation card that expands on how this tool protects against this additional threat. This explanation does not need to compare e.g., Peergos to Proton Drive or Tresorit; it could simply highlight its P2P architecture as an advantage against censorship.

These are my notes for how you can improve the implementation of the threat model labels. I hope that any part of this wall of text helps.


Also, here are some technical suggestions related to your PR:

  • You might want to rebase your PR with the latest updates in main, especially considering that the Android and Productivity Tools pages were recently completely overhauled 😅
  • There are some pages in the deploy preview where the labels were not visible for some reason, like the ones on the Tor and VPN pages.

redoomed1 added a commit that referenced this pull request Aug 2, 2024
redoomed1 added a commit that referenced this pull request Aug 2, 2024
@friadev friadev marked this pull request as draft August 3, 2024 18:54
@dngray dngray closed this in #2689 Aug 10, 2024
@friadev friadev deleted the pr-labels branch August 10, 2024 05:01
@privacyguides-bot
Copy link
Collaborator

This pull request has been mentioned on Privacy Guides. There might be relevant details there:

https://discuss.privacyguides.net/t/2024-08-19/20197/1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c:enhancements new features or other enhancements to the website itself
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

4 participants