unity-design team mailing list archive

[Conscious User <conscioususer@xxxxxxx>]

> Disagree. Because update-manager does not require gksudo, there is no
> screen dimming or anything else that indicates in an obvious manner
> that it is an actual update window and not a popup coming from the
> browser.
> 
> (I'm not talking about popup in the browser window sense, I'm talking
> about popups in the z-index sense, they can work because it is
> very common for the user to use the browser fullscreen)
> 
> Thinking better, *even* with screen dimming the user can be tricked:
> all it needs is from him to have a dark theme (so the non-dimming
> of the browser toolbar and the panel would be less noticeable)

To illustrate my point, go to this site:

http://www.huddletogether.com/projects/lightbox2/

and click on an image.

This pretty much convinces me that faking the update window is trivial.