Please check the status of this specification in Launchpad before editing it. If it is Approved, contact the Assignee or another knowledgeable person before making changes.

• Launchpad entry: exit-strategy

• Packages affected: gdm, gnome-panel, gnome-power-manager, linux-kernel

Summary

We should comprehensively simplify how people exit an Ubuntu session. We should split off “Lock Screen” and “Switch User” into separate commands. We should merge “Suspend” and “Hibernate” into a configurable “Sleep” command, activated by closing the lid for laptops, and a configurable timeout for all computers. We should offer a configurable shutdown timeout for the login screen, so that people can choose “Quit” and walk away from their computer assured that it will shut down when appropriate. Most use cases for “Restart” should be handled by application-specific UI, but “Shut Down Now” and “Restart” should also be available from GDM as a fallback.

Release notes

• Switching user accounts is now done using the “Fast User Switching” menu in the panel.
• “Suspend” and “Hibernate” have been combined into a Sleep command. In the new Power Saving settings, you can choose whether Sleep always suspends, always hibernates, or switches from suspending to hibernating after a particular time period.
• Ubuntu can now shut down the computer automatically if no-one uses it for a given period. Choose whether and when this happens in the new Power Saving settings.

Rationale

From 6.06 to 7.10, Ubuntu has had a “Quit” dialog with up to eight items: “Log Out”, “Lock Screen”, “Switch User”, “Suspend”, “Hibernate”, “Restart”, “Shut Down”, and “Cancel”. This design was well-intentioned, following the principle of forcing commitment as late as possible (rather than making people climb out of one confirmation alert and into another).

Unfortunately, this benefit has been outweighed by the choice being confusing and daunting. The Quit dialog gives too many options, with the difference between them being unavoidably difficult to explain. And people can get used to clicking a particular button in the dialog, such that they click it even when they didn't mean to.

No other common appliance has this many exit modes, and we shouldn’t accept it in personal computers either. That other OSes make it complicated is not an excuse to be like them, but an opportunity to be better than they are.

What other systems do

Gnome upstream

Three menu items:

• “Lock Screen” locks the screen immediately.
• “Log Out” leads to an alert: “Switch User”, “Cancel”, “Log Out”. It automatically logs out after one minute.
• “Shut Down” leads to an alert: “Suspend”, “Hibernate”, “Restart”, “Cancel”, “Shut Down”. It automatically shuts down after one minute.

You can try these options in Ubuntu by setting the gconf key /apps/panel/global/upstream_session (and then either restarting the panel or adding a new menu bar).

Fedora

Alters the Gnome design by splitting “Suspend” and “Hibernate” off into a fourth alert.

OpenSUSE

A single dialog, with "Log Out", "Lock Screen", "Shutdown" [sic], and "Restart", all explained inline.

Windows Vista

The Start menu has two buttons — a power icon, and a lock icon — then one menu with seven choices: “Switch User”, “Log Off”, “Lock”, “Restart”, “Sleep”, “Hibernate”, and “Shut Down”.

The two buttons in the windows Start Menu can change dynamically also. I've noticed the "Shutdown" button turns into a "Install pending upgrades then Shutdown" when there are updates available. Unsure if there are other modes, or this is just one special case.

Joel Spolsky: “Inevitably, you are going to think of a long list of intelligent, defensible reasons why each of these options is absolutely, positively essential. Don't bother. I know. Each additional choice makes complete sense until you find yourself explaining to your uncle that he has to choose between 15 different ways to turn off a laptop.”

Moishe Lettvin, Windows Vista developer: “I would like to try to explain how this happened.”

Mac OS X

The Apple menu includes four relevant items:

• “Sleep” suspends to RAM. On newer machines, it (slowly and sometimes unreliably) does “Safe Sleep”, which suspends to disk and then to RAM in one go.

• "Restart..." leads to an alert asking if you're sure. It automatically restarts after 120 seconds.
• “Shut Down...” leads to an alert asking if you're sure. It automatically shuts down after 120 seconds.

• “Log Out login-name-here...” (with a system-wide keyboard equivalent of Shift+Command+Q) leads to an alert asking if you're sure. It automatically logs out after 120 seconds.

(With the latter three commands, holding down the Option key bypasses the alert, which is indicated by the menu items no longer having ellipses. The commands time out with an explanatory alert if any application failed to quit by itself.)

Arno Gourdol, Mac OS X developer: “I actually think that the result could have been even better than what we ended up with. I argued against including Restart, Shut Down and Sleep in the Apple menu.”

What we should do

Assumptions

First, we will take a deep breath and make these assumptions.

• Making all applications restore their session perfectly is an important goal, but not one that we can achieve in the next year or two.
• A panel menu is sufficient as the only interface for fast account switching.
• “Lock Screen” is a security function — something you do when you’re leaving the computer temporarily and you don’t entirely trust everyone nearby. It is fundamentally different from the other options, and therefore it’s reasonable to separate it out.
• Those people technical enough to care about the distinction between “Suspend” and “Hibernate” can tolerate it if we expose that distinction in power management preferences (including an optional timed transition from suspend-mode to hibernate-mode), and in terminal commands, but not in the Quit interface. (This does not mean we are forcing anyone to use the terminal: the primary interface for choosing between suspend and hibernate will be the power management preferences.)

• If you’re using a laptop, and you want it to suspend or hibernate, closing the laptop lid can be the way to do that. Those people who don’t want their laptop to suspend or hibernate when closing the lid, but do want it to suspend or hibernate on other occasions, are technical enough that we can trust them to suspend or hibernate with terminal commands rather than in the graphical interface. (Again, this does not mean we are forcing anyone to use the terminal: the primary interface will be closing the lid.)

• Putting a non-laptop machine to sleep is rare enough that we can make it something that happens after a configurable timeout (or from a terminal command), rather than a command in the Quit interface.
• For many occasions where the computer needs restarting, such as a kernel update, Ubuntu can offer a transitory interface for doing it (such as an alert, or a menu item in the relevant program). The remainder of cases will be rare enough that people will not mind logging out before choosing the Restart command (or, alternatively, using a terminal command).

• We can make gdm fast and accessible.

• Having a simple Quit interface, and more complex power management preferences, is better than the reverse.

Lock Screen

The penultimate item in the System menu (and the Main Menu) should be “Lock”.

Implementation: Adding the menu item is trivial, change to gnome-panel.

Quit

The last item in the System menu (and the Main Menu) should be “Quit”, without ellipsis. (Sometimes quitting does require more input, which implies ellipsis, but currently we can’t tell that ahead of time.)

Choosing “Quit” should log out as quickly as possible. If an application cancels the logout, this should be explained using an error alert, using the application's human-readable name if known.

Implementation:

• First task is to adjust the system menu to be "Quit" instead of "Quit..." and the menu it goes to. Not difficult, just reworking some GTK+.
• The second task of reworking session management so we can query to see if it wants to interact with the user. It's unclear how it'll work with all applications. We can ask them to shutdown, see if they ask for an interaction, and then cancel the shutdown. This will take some experiementation and is probably risky for an LTS.

Account switching

If (and only if) the system has multiple user accounts set up, and you have fast account switching turned on, the menu should be added to your panel automatically. This will be the method of switching accounts while staying logged in.

Implementation: Would it be okay for the widget to exist, but be transparent if they are not enabled? That would be much easier, and only require a change to the applet. If dynamic adding and removing of the applet is required, that would be trickier.

Login screen

The login screen should have “Shut Down” and “Restart” buttons at the bottom.

If Ubuntu is configured to shut down automatically, the “Shut Down” button label should instead be “Shut Down Now”. The button should pulse subtly (about 5 seconds per cycle), and the icon inside the button should slowly rotate clockwise to indicate how close it is to shutting down. If any input device is touched (or storage device is attached) during the countdown, it should reset, and this should be shown by the Shut Down icon rewinding (in 0.5 seconds) back to its original position. When time runs out (so the icon reaches 360° rotation), the button should visibly appear clicked for 0.5 seconds. After the button is clicked (whether manually or automatically), all controls on the screen should become insensitive, then the computer should shut down.

When “Restart” is clicked, all controls on the screen should become insensitive, then the computer should restart.

Implementation: As part of GdmFaceBrowser development.

Future work: “Restart into Windows” and/or “Restart into Mac OS X” buttons alongside the “Restart” button, depending on what other OSes are installed. (These future labels will be too long to include inside an elegant button, which is why the current “Shut Down Now” and “Restart” buttons shouldn’t have the label inside them either.)

Future work: Solve the fsck-when-you-don’t-want-it problem by running disk checks just before automatic shutdowns, instead of during startups.

Power Saving settings

The Power Management Preferences window should be simplified into a “Power Saving” settings window. (Outside of a power station, nobody wants to “manage” power.)

The window should have two tabs: “When Using Mains” and “When Using Battery”. Each tab should have the same four menus and one checkbox.

• “The display should sleep when the computer is inactive:”
  • Options: “After 5 minutes”, “After 10 minutes”, “After 20 minutes”, “After 30 minutes”, “After 45 minutes”, “After 1 hour”, “After 1.5 hours”, “After 2 hours”, “After 3 hours”, and “Never”.
• “The computer itself should sleep when inactive:”
  • Options: “After 5 minutes”, “After 10 minutes”, “After 20 minutes”, “After 30 minutes”, “After 45 minutes”, “After 1 hour”, “After 1.5 hours”, “After 2 hours”, “After 3 hours”, and “Never”
• “When asleep, go into zero-power mode (“hibernate”):”
  • Options: “Immediately”, “After 5 minutes”, “After 10 minutes”, “After 20 minutes”, “After 30 minutes”, “After 45 minutes”, “After 1 hour”, “After 1.5 hours”, “After 2 hours”, “After 3 hours”, “After 4 hours”, “After 5 hours”, “After 6 hours”, and “Never”
• “When no-one is logged in, shut down after:”

  • This menu should be read-only by default, with an adjacent padlock button to make it modifiable by entering an administrator password (using PolicyKit).

  • Options: “Immediately” if there is only one user account or “After 1 minute” otherwise, “After 5 minutes”, “After 10 minutes”, “After 20 minutes”, “After 30 minutes”, “After 45 minutes”, “After 1 hour”, “After 1.5 hours”, “After 2 hours”, “After 3 hours”, “After 4 hours”, “After 5 hours”, “After 6 hours”, and “Never”.
• “Closing the lid puts the computer to sleep”
  • This checkbox should be present only if the computer is a laptop (or other device with a lid).

(The “Immediately” and “Never” options both need to be obvious for the “go into zero-power mode” setting. If it was presented as a slider, this would require tick marks. For visual consistency, all four controls would then need to be sliders with tick marks, but that would take up too much space. This is why the window should use option menus instead.)

Other than the tab labels, the only difference between the tabs should be that if we can detect that the computer is of a type that automatically wakes up when the battery is critically low, the “When Using Battery” tab should have, under the “When asleep, go into zero-power mode:” menu, the small print “Critically low battery will also trigger zero-power mode.”. The “When Using Mains” tab (and, if we can not confirm the required hardware, the "When Using Battery" tab as well) should have an empty space exactly the same size as that small print, so that the later controls are in exactly the same position in each tab. (In both cases, this will naturally visually separate the user-specific settings from the system-wide settings.)

Impossible combinations should be prevented by changing the selection in other menus if necessary. For example, if the computer-sleep menu is set to “After 1 hour” and you set the display-sleep menu to “After 2 hours”, the computer-sleep menu should automatically change to “After 2 hours” as well.

There should not be a setting for display brightness or dimming, because the desired brightness level will be highly dependent on the ambient light wherever the battery is being used; therefore, brightness should be configured manually instead (e.g. with function keys on the keyboard). Nor should there be a separate setting for dimming the display when idle; instead, dimming should function as a two-minute warning that either the display or the entire computer is about to go to sleep.

Implementation: This should be mostly GTK+ refactoring for gnome-power as far as the sliders are concerned. The GDM changes will have to be future work as there isn't currently any power management functions in GDM. There may be some PolicyKit issues when dealing with setting settings for GDM versus user functions. We'll need to work out how these different settings propigate for different users.

Future work: For maximum environmental points, merge screensaver settings into this window, perhaps as a new first tab.

Sleep

When the computer is due to go to sleep, if the “go into zero-power mode” setting is set to “Immediately”, it should hibernate. Otherwise, it should set itself to wake up either at the “Go into zero-power mode” timeout, or when it estimates that the battery will have 15 minutes of full power left, whichever is earlier, and suspend. When it wakes up in either of those two circumstances, it should wait until the hard disk is in a safe state to write to (if this is detectable), then hibernate.

Implementation: When told to sleep, Ubuntu should set the wakeup time for the necessary number of minutes. When waking up, the kernel should set a hal wakeup-reason flag. pm-utils should then read this flag, in deciding whether to (a) hibernate or (b) wake up X.

Big Red Button

The Big Red Button should be off by default, because if retained it would work identically to the “Quit” menu item. One access point for Quit in the GUI, and one access point on the actual hardware (the power button), is more than enough.

Index to the previous options

Log Out: Activated by choosing “Quit”.

Lock Screen: Activated by the “Lock” menu item.

Switch User: Activated by the account menu in the panel.

Suspend and Hibernate: Merged into “Sleep”. Activated by closing a laptop’s lid. Can happen after a period of inactivity (on any type of computer), if configured in the Power Saving settings.

Restart: Activated by choosing “Quit” then “Restart”, as before.

Shut Down: Activated by choosing “Quit” then “Shut Down Now” (as before), or just by choosing “Quit” and leaving the computer undisturbed for a period configured in the Power Saving settings.

Migration

... [need to adapt existing Power Management settings to the new settings]

Implementation: ...

Test/demo plan

Other ideas that were considered

• Split the Quit dialog into multiple ones, like Gnome upstream.
• Plan for future of session management? (it shouldn't matter what you do, your session is still safe)
  • We keep trying to work around the problem of poor session management. Could we at least start a fix to this?
• Make Fusa a compulsory panel applet if you have user-switching available, and impossible if you don't.
• Make GDM the giant Lock Screen dialog.

  • This would require an obvious indication in facebrowser that the person is still logged in (and default to them for easy returning to their session).

  • Maybe rename "Log In" to "Continue" in that case.

  • Would require GDM to be accessible if any account on the computer requires it.

  • Would still require you to return to your session to deal with save-changes alerts, etc.
• Most PCs have a wakeup timer in Bios. We could use this to merge suspend and hibernate: hibernate if suspended for X minutes/hours. (Perhaps a slider on power management prefs: Immediately - 1 hour - 2 -hours ... - Never. "[i] The computer may hibernate sooner if the battery is nearly exhausted.")
• If the shutdown process is slow enough, we could make restarting a command available during the shutdown process.
  • Or we could make restarting something that happens if you hold down a key during the shutdown.
• Two/three options:
  • "Suspend" suspends, and then hibernates after delay/flat battery.
  • "Shut Down" hibernates.
  • "Restart Into Windows" if Windows is installed.
• .. Not practical, says mjg.
• Merge "Switch User" into "Lock Screen"?
• Merge "Switch User" into "Log Out"?
• Hibernate just the user session, and shut down the rest?
• Kill the logout and shutdown sounds! (or make it an accessibility option)
  • No use case except for blind wanting a clue as to when shutdown is occurring
• "Pause" and "Stop"?
• "Restart" appears in the big dialog only if:
  • you chose "Restart Later" earlier
  • you have other OSes installed.

Unresolved issues

• The alert for a program that fails session management on logout needs an override button.
• Should GDM itself have sleep settings? If so, what should they be, how should they be set, and how should they be affected by the power source being used?

Comments/questions

Regarding the assumption that "Putting a non-laptop machine to sleep is rare enough that we can make it something that happens after a configurable timeout (or from a terminal command), rather than a command in the Quit interface":

I don't think that is true. I know desktop users who fits this profile:

• 1) They tend to have many windows open doing many different things. 2) Because of that, they often hibernate their system when they leave it for a long time, in order to keep their session for next time. 3) Using a terminal to hibernate would be far too technical for them. 4) A timeout is not the solution for them, because they don't want their computer to hibernate automatically.

Another of the above asssumptions is that "Having a simple Quit interface, and more complex power management preferences, is better than the reverse". In the power management preferences, next to the other sleep settings, could be added a checkbox, defaulting to off, which when turned on would cause an extra entry to appear in the System menu, near Quit and Lock Screen, which the user can choose to manually initiate hibernating the system -- thus providing a simpler quit interface (menu entry instead of terminal command), on the cost of one extra checkbox in the preferences.

This would of course also help the laptop users (such as myself) who don't want the system to sleep when they close the lid, but want to be able to hibernate when they choose to.

Mpt, what do you think about this idea? I know in general it's terrible to have a preference only controlling the visibility of some UI element, but in this case would it not be a better solution than leaving people with no way to initiate a hibernation? --JonasJørgensen

• If these people leave their computer “for a long time”, and do want it to hibernate, why is it they “don't want their computer to hibernate automatically”? In other words, why do they care so much about exactly when the computer goes to sleep, that they want to do it manually rather than just locking the screen and letting the computer sleep by itself after 30 minutes or whenever? -- MatthewPaulThomas

  • They are concerned about the environment, so when they do want it to hibernate, they don't like it wasting power for many minutes first, but some times they are leaving the computer untouched for a while but know that they will need it to be instantly ready later, without time for waking up. In other words, sometimes they want their machines to be hibernated when they leave it and sometimes they don't, so the current design would make them have to change power settings back and forth somewhat often, when they would prefer to be able to tell the computer to hibernate when they want to. --JonasJørgensen

    • How about an option to sleep sooner when the system is locked? Someone could set the computer to never sleep when inactive, but sleep after 5 minutes when locked. --NathanSchiffer

    What if the current "Shut down" pane was accessible by Control or Alt+clicking on the Quit button? This would hide complexity from the inexperienced user, but make more advanced options trivial to get at. It would be so much easier to tell someone on a forum "Ctrl+click on the Quit button" than to link to a tutorial full of terminal commands. The buttons from the current top row could be removed, leaving only Suspend, Hibernate, Restart, and Shut Down. --NathanSchiffer

    Problem solved! I just discovered something: Clicking the power icon in the panel brings up a menu allowing you to suspend or hibernate! You can make that icon always available by selecting "Always display an icon" in System->Preferences->Power Management, General tab. So this spec could be implemented as planned, and there would still be a way to manually initiate a hibernation! Yay! And I actually like that it's from the power monitor icon rather than a Quit dialog. Perfect! -- JonasJørgensen

I think that it is a bad idea to take this much control away from the user. On my laptop I often listen to music with the screen closed, so I would not want that to be the activation for suspend. If I am putting my laptop in my bag, but am going to use it soon, I put it in suspend. If I am going to be not using it for a longer period of time, I want to be able to hibernate it directly, rather than waste the battery power by leaving it in suspend for a while first. I also use hibernate to quickly switch between operating systems. I am a somewhat advanced user and suspend/hibernate from the command line is not a problem, but it is much more convenient to push the power button and click suspend. But I would imagine that there is a middle group of people who know and care about the different I think that the way that Ubuntu currently operates is better than the gnome default - a single dialog for all related tasks is much more usable, and a third menu for sleeping, which is almost identical in functionality to shutdown and reboot, would only complicate things unnecessarily (especially for people with laptops, who can normally press the power button to bring up the shutdown screen). If six or seven options in the shutdown screen is considered to complicated, then I would suggest a default as described above, but with checkboxes in the power management screen to enable additional buttons for suspend, hibernate, etc (kind of like how kde does it). Finally, with regard to the reboot option, I think that is dumbing it down too much - as mentioned above there are reasons to restart even with a single-os installation (such as a kernel upgrade). In the current description, it sounds like the reboot icon would appear only in those cases (i.e. the user clicked "restart later" in the update manager alert), which becomes inconsistent and confusing - the user is never certain whether or not the restart icon will be there when it is needed. Additionally, in order to keep the dialog centered, the placement of the other icons would have to be modified depending on whether restart is currently showing. This inconsistent placement thwarts any efficiency gained through muscle memory, as it the user must read each button every time rather than just remembering where the shutdown button normally is. --Elyk2

In regards to the idea of popping up a message box whenever you try to logout/restart/shutdown if any applications are left open, that's one thing I hate about Macs. When I say logout/restart/shutdown, that means logout/restart/shutdown. If there's an open application, shut it down for me, don't tell me "no, close the application first". Think of it like this, if you tell your kid to go to bed and he/she says, "no", is that not aggravating? --RossPeoples

• The alert should appear only if an application does not do session management, i.e. it is broken. In those cases it is important that you be given the chance to save any unsaved work yourself before the logout continues. Windows does the same thing with its “End Program” alert. However, your comment has made me realize that an invisible program could make logout near-impossible without an override button, so I’ll fix that in the spec. -- MatthewPaulThomas

• While the symbol is the power button, the text on mouse over is "quit". When YOU want to quit, it may be to let another user log on. I would rather present them with more choices at this level then have them go hunting for their options. Six options is not too hard.
• Some systems will suspend, and some will sleep, and a few systems will do both. I don't think we can take the control away (or hide it) until stability of entering and restoring from the low-power states is 100% reliable. The Gnome philosophy of hiding options from users is good when the remaining options are reliable and all you need. I think that Federico Mena himself said: "Make everything as simple as possible, but not simpler." (JK)
  • I second this opinion. There really is no reason to oversimplify shutdown. Although an option to suspend and hibernate afterwards seems tempting and simple, but is there any good use case for implementation? I would propose instead to have a checkbox to hibernate when suspended if battery falls bellow x%.

I find this new approach is very interesting in many ways (even revolutionary), but I think some things as to take the control away from users is not a good idea. I definitely want to decide myself when and how to exit, the computer should support but not control me (decide for me too, but only if I want it...). So I used some ideas from this specification and prepared another one, but with the goal to remain the control by users and, yes, to simplify the actual exit approach (but more in the classical way), please take a look: http://ubuntuforums.org/showthread.php?t=687369
PS: my proposal isn't a dogma, please feel free to change it, make it more better (or also worse ;-)), I think the both approaches could collaborate in many ways...
Else I would have the follow question: how are you going to care the situation if there are some other users logged in? Actually they just lost its data if one user performs "Shut Down" or "Restart" (actually there isn't even simple warning...). (Please take a look at the "Open Issues" section in my proposal).
Thank You, Roman Friesen (krokosjablik)

Using Terminal to manually trigged Suspend/Hibernate is *not* an only option. GNOME Power Manager notification area icon provides way to trigged both actions. This is my main way to suspend or hibernate mine laptop. -- Zdzichu 2008-04-01 10:33:09

Please, please expose gnome exit operations (esp. shutdown & restart) to the terminal, preferably with a mechanism to force the operation (i.e. avoid question dialogues). Existing commands 'shutdown' (beep!), 'reboot' (beep!) & 'telinit' (no beep) are no substitute. Gnome exit ops from the terminal would let advanced users create their own solutions independently of any GUI team decisions, e.g. reckless (make a big red button that shuts down without questions), simplified (make a simplified menu for that hypothetical uncle's laptop). -- FredCurtis. P.S. Was pleasantly surprised to see the harmless lock-screen op factored out as a button/shortcut in 8.10.

I think on "Sleep" command it should suspend AND hibernate at the same time. And after some delay, just shutdown (move to hibernate). If you wake up PC before that delay it would use RAM, after delay or if power was gone - HDD would be used. Why? To ensure that hibernate will succeed. Even if power was suddenly off while PC is in suspend mode, we have already done hibernate, so it won't hurt. So the idea is to do critical operation (hibernation) as soon as possible. --tonnzor

Those people who don’t want their laptop to suspend or hibernate when closing the lid, but do want it to suspend or hibernate on other occasions, are technical enough that we can trust them to suspend or hibernate with terminal commands rather than in the graphical interface.

• : Bug filed: "There is no way to turn off suspend-on-lid-close in graphical interface" (143254325 duplicates) : Please don't remove user control of things unless there's a really good reason to.

-Solve this use case: I want to shutdown my computer fast to put it into my bag, I don't want to be tripped up by errors from slow programs. My interpretation of this spec is that the process would be this: click "quit", wait for the delay while applications are closed, reach the shutdown screen, only then can I manually click the "shutdown now" button.

-Less importantly, I have no idea why the word "Mains" should be used, is that even part of the english language? Why not "Main Power"?

---

CategorySpec