ExitStrategy

Revision 9 as of 2007-11-15 17:33:36

Clear message

Please check the status of this specification in Launchpad before editing it. If it is Approved, contact the Assignee or another knowledgeable person before making changes.

  • Launchpad entry: logout-dialog

  • Packages affected: gdm, gnome-panel, gnome-power-manager

Summary

We should comprehensively simplify how people exit an Ubuntu session. We should split off “Lock Screen” and “Switch User” into separate commands. We should merge “Suspend” and “Hibernate” into a configurable “sleep” command, activated by closing the lid for laptops, and a configurable timeout for all computers. We should make “Restart” available when and where needed, rather than an omnipresent command. And we should offer a configurable shutdown timeout for the login screen, so that people can choose “Quit” and walk away from their computer assured that it will shut down when appropriate.

attachment:summary.jpg

Release note

Rationale

From 6.06 to 7.10, Ubuntu has had a “Quit” dialog with up to eight items: “Log Out”, “Lock Screen”, “Switch User”, “Suspend”, “Hibernate”, “Restart”, “Shut Down”, and “Cancel”. This design was well-intentioned, following the principle of forcing commitment as late as possible (rather than making people climb out of one confirmation alert and into another).

Unfortunately, this benefit has been outweighed by the choice being confusing and daunting. The Quit dialog gives too many options, with the difference between them being unavoidably difficult to explain. And people can get used to clicking a particular button in the dialog, such that they click it even when they didn't mean to.

No other common appliance has this many exit modes, and we shouldn’t accept it in personal computers either. That other OSes make it complicated is not an excuse to be like them, but an opportunity to be better than they are.

What other systems do

Gnome upstream

Three menu items:

  • “Lock Screen” locks the screen immediately.
  • “Log Out” leads to an alert: “Switch User”, “Cancel”, “Log Out”. It automatically logs out after one minute.
  • “Shut Down” leads to an alert: “Suspend”, “Hibernate”, “Restart”, “Cancel”, “Shut Down”. It automatically shuts down after one minute.

You can try these options in Ubuntu by setting the gconf key /apps/panel/global/upstream_session (and then either restarting the panel or adding a new menu bar).

Fedora

Alters the Gnome design by splitting “Suspend” and “Hibernate” off into a fourth alert.

OpenSUSE

[http://calvinrg.blogspot.com/2007/08/gnome-logout.html A single dialog], with "Log Out", "Lock Screen", "Shutdown" [sic], and "Restart", all explained inline.

Windows Vista

The Start menu has two buttons — a power icon, and a lock icon — then one menu with seven choices: “Switch User”, “Log Off”, “Lock”, “Restart”, “Sleep”, “Hibernate”, and “Shut Down”.

[http://joelonsoftware.com/items/2006/11/21.html Joel Spolsky]: “Inevitably, you are going to think of a long list of intelligent, defensible reasons why each of these options is absolutely, positively essential. Don't bother. I know. Each additional choice makes complete sense until you find yourself explaining to your uncle that he has to choose between 15 different ways to turn off a laptop.”

[http://moishelettvin.blogspot.com/2006/11/windows-shutdown-crapfest.html Moishe Lettvin], Windows Vista developer: “I would like to try to explain how this happened.”

Mac OS X

[http://en.wikipedia.org/wiki/Apple_menu The Apple menu] includes four relevant items:

  • “Sleep” suspends to RAM. On newer machines, it ([http://db.tidbits.com/article/9090 slowly and sometimes unreliably]) does “Safe Sleep”, which suspends to disk and then to RAM in one go.

  • "Restart..." leads to an alert asking if you're sure. It automatically restarts after 120 seconds.
  • “Shut Down...” leads to an alert asking if you're sure. It automatically shuts down after 120 seconds.

  • “Log Out login-name-here...” (with a system-wide keyboard equivalent of Shift+Command+Q) leads to an alert asking if you're sure. It automatically logs out after 120 seconds.

(With the latter three commands, holding down the Option key bypasses the alert, which is indicated by the menu items no longer having ellipses. The commands time out with an explanatory alert if any application failed to quit by itself.)

[http://arno.org/blog/2006/11/design-of-mac-os-x-shutdown-feature.html Arno Gourdol], Mac OS X developer: “I actually think that the result could have been even better than what we ended up with. I argued against including Restart, Shut Down and Sleep in the Apple menu.”

What we should do

Assumptions

First, we will take a deep breath and make these assumptions.

  • A panel menu is sufficient as the only interface for fast account switching.
  • “Lock Screen” is a security function — something you do when you’re leaving the computer temporarily and you don’t entirely trust everyone nearby. It is fundamentally different from the other options, and therefore it’s reasonable to separate it out.
  • Those people technical enough to care about the distinction between “Suspend” and “Hibernate” can tolerate it if we expose that distinction in power management preferences (including an optional timed transition from suspend-mode to hibernate-mode), and in terminal commands, but not in the Quit interface. (This does not mean we are forcing anyone to use the terminal: the primary interface for choosing between suspend and hibernate will be the power management preferences.)

  • If you’re using a laptop, and you want it to suspend or hibernate, closing the laptop lid can be the way to do that. Those people who don’t want their laptop to suspend or hibernate when closing the lid, but do want it to suspend or hibernate on other occasions, are technical enough that we can trust them to suspend or hibernate with terminal commands rather than in the graphical interface. (Again, this does not mean we are forcing anyone to use the terminal: the primary interface will be closing the lid.)

  • Putting a non-laptop machine to sleep is rare enough that we can make it something that happens after a configurable timeout (or from a terminal command), rather than a command in the Quit interface.
  • For many occasions where the computer needs restarting, such as a kernel update, Ubuntu can offer a transitory interface for doing it (such as an alert, or a menu item in the relevant program). The remainder of cases will be rare enough that people will not mind logging out before choosing the Restart command (or, alternatively, using a terminal command).

  • We can make gdm fast and accessible.

  • Having a simple Quit interface, and more complex power management preferences, is better than the reverse.

Lock Screen

The penultimate item in the System menu (and the Main Menu) should be “Lock Screen”.

Quit

The last item in the System menu (and the Main Menu) should be “Quit”, without ellipsis. (Sometimes quitting does require more input, which implies ellipsis, but currently we can’t tell that ahead of time.)

Choosing “Quit” should log out as quickly as possible. If an application cancels the logout, this should be explained using a note alert, using the application's human-readable name if known.

attachment:logout-cancelled.jpg

Account switching

When the system has multiple user accounts set up, and you have fast account switching turned on, the menu should be added to your panel automatically, immediately to the left of the Big Red Button. This will be the method of switching accounts while staying logged in.

Welcome screen

The welcome screen (otherwise known as GDM) should, at the bottom, have a line of text then “Shut Down” and “Restart” buttons.

attachment:welcome.jpg

The line of text should appear if Ubuntu is configured to shut down automatically: “Will shut down if undisturbed for n units”. To avoid distraction, n should be rounded to the nearest hour if n ≥ 59m 30s, to the nearest minute if 59.5s ≤ n < 59m 30s, and to the nearest second only if n < 59.5s. Also to avoid distraction, the beginning edge of the text (e.g. the left edge in left-to-right languages) should remain aligned as it was when centered using the width of the initial value, rather than being re-centered with each new value.

If Ubuntu is configured to shut down automatically, the “Shut Down” button should instead be labelled “Shut Down Now”. When the time runs out, the button should visibly appear clicked for 1 second. After the button is clicked (whether manually or automatically), all controls on the screen should become insensitive, then the line of text should change to read “Shutting down…”, then the computer should shut down.

When “Restart” is clicked, all controls on the screen should become insensitive, then the line of text should change to read “Restarting…”, then the computer should restart.

Startup & Shutdown settings

The Power Management Preferences window should be converted to a “Startup & Shutdown” settings window. The window should have three tabs: “When Starting Up”, “When Using Mains”, and “When Using Battery”.

The “When Starting Up” tab should be a simplified version of the [https://launchpad.net/ubuntu-bootloader-manager Bootloader Manager], and is not discussed further in this specification. (If this cannot be done in time, the window should be called "Power Settings" instead.)

attachment:mains.jpg attachment:battery.jpg 

The computer should sleep after being inactive for:
    5 minutes ==O===== Never

    The computer will stay awake whenever playing music or movies.
    The computer will stay awake whenever docked, or playing music or movies.

[/] Go to sleep whenever the lid is closed

When asleep, go into zero-power mode (“hibernate”):
    Immediately ==O===== Never
    [battery tab only] Zero-power mode will always activate when the battery is critically low.

The display should sleep after the computer is inactive for:
    5 minutes ==O===== Never
[/] Dim the display when idle [no slider for how much]

Big Red Button

Index to the previous options

Log Out: Activated by choosing “Quit”.

Lock Screen: Activated by the “Lock Screen” menu item.

Switch User: Activated by the account menu in the panel.

Suspend and Hibernate: Merged into “Sleep”. Activated by closing a laptop’s lid. Can happen after a period of inactivity (on any type of computer), if configured in the Startup & Shutdown settings.

Restart: Activated by choosing “Quit” then “Restart”, as before.

Shut Down: Activated by choosing “Quit” then “Shut Down Now” (much as before), or just by choosing “Quit” and leaving the computer undisturbed for a period configured in the Startup & Shutdown settings.

Migration

Test/demo plan

Unresolved issues

  • For people dual-booting, it would be nice to offer them a convenient way of restarting into a selected OS.
  • How should the sleep settings for GDM itself be set?

BoF agenda and discussion

  • Split the dialog into multiple ones?
  • What are the most important options?
  • Are suspend/hibernate better placed with g-p-m (where they already are)
  • Plan for future of session management? (it shouldn't matter what you do, your session is still safe)
  • Logout Icon in top-right still?

If the logout is designed newly one should consider the use of tooltips for the short explanation of the different options. Tooltips are used everywhere else in the GUI and there is no obvious reason why they are not used in the logout dialog. This would lead to a more consistent look and feel since the design and behaviour of the logout dialog would match the look and feel of the GUI (e.g. Gnome).

  • If we have a single user, don't offer "Switch User".
  • Make Fusa a compulsory panel applet if you have user-switching available, and impossible if you don't.
  • Split out one or more commands into their own menu items.
  • Make GDM the giant logout dialog?

    • Would require an obvious indication in facebrowser that the person is still logged in (and default to them for easy returning to their session).

      • Maybe rename "Log In" to "Continue" in that case.

    • Would require GDM to be accessible if any account on the computer requires it.

    • Would still require you to return to your session to deal with save-changes alerts, etc.
  • Most PCs have a wakeup timer in Bios. We could use this to merge suspend and hibernate: hibernate if suspended for X minutes/hours. (Perhaps a slider on power management prefs: Immediately - 1 hour - 2 -hours ... - Never. "[i] The computer may hibernate sooner if the battery is nearly exhausted.")
  • We could get rid of "Restart". If updates need restarting, they can have a specific Restart button.
  • If the shutdown process is slow enough, we could make restarting a command available during the shutdown process.
  • Or we could make restarting something that happens if you hold down a key during the shutdown.
  • Have a "Restart Into..." option for other OSes? (Is this relevant to this spec?)
  • Two/three options:
    • "Suspend" suspends, and then hibernates after delay/flat battery.
    • "Shut Down" hibernates.
    • "Restart Into Windows" if Windows is installed.
  • .. Not practical, says mjg.
  • Merge "Switch User" into "Lock Screen"?
  • Merge "Switch User" into "Log Out"?
  • Hibernate just the user session, and shut down the rest?
  • Kill the logout and shutdown sounds! (or make it an accessibility option)
    • No use case except for blind wanting a clue as to when shutdown is occurring
  • "Pause" and "Stop"?
  • "Restart" appears in the big dialog only if:
    • you chose "Restart Later" earlier
    • you have other OSes installed.

What would the Big Red Button In The Corner do?

We keep trying to work around the problem of poor session management. Could we at least start a fix to this?

Comments/questions

Regarding the assumption that "Putting a non-laptop machine to sleep is rare enough that we can make it something that happens after a configurable timeout (or from a terminal command), rather than a command in the Quit interface":

I don't think that is true. I know desktop users who fits this profile:

  • 1) They tend to have many windows open doing many different things. 2) Because of that, they often hibernate their system when they leave it for a long time, in order to keep their session for next time. 3) Using a terminal to hibernate would be far too technical for them. 4) A timeout is not the solution for them, because they don't want their computer to hibernate automatically.

Another of the above asssumptions is that "Having a simple Quit interface, and more complex power management preferences, is better than the reverse". In the power management preferences, next to the other sleep settings, could be added a checkbox, defaulting to off, which when turned on would cause an extra entry to appear in the System menu, near Quit and Lock Screen, which the user can choose to manually initiate hibernating the system -- thus providing a simpler quit interface (menu entry instead of terminal command), on the cost of one extra checkbox in the preferences.

This would of course also help the laptop users (such as myself) who don't want the system to sleep when they close the lid, but want to be able to hibernate when they choose to.

Mpt, what do you think about this idea? I know in general it's terrible to have a preference only controlling the visibility of some UI element, but in this case would it not be a better solution than leaving people with no way to initiate a hibernation? --JonasJørgensen

CategorySpec