Ubuntu Wiki

Please check the status of this specification in Launchpad before editing it. If it is Approved, contact the Assignee or another knowledgeable person before making changes.

• Launchpad entry: exit-strategy

• Packages affected: gdm, gnome-panel, gnome-power-manager

Summary

We should comprehensively simplify how people exit an Ubuntu session. We should split off “Lock Screen” and “Switch User” into separate commands. We should merge “Suspend” and “Hibernate” into a configurable “Sleep” command, activated by closing the lid for laptops, and a configurable timeout for all computers. We should offer a configurable shutdown timeout for the login screen, so that people can choose “Quit” and walk away from their computer assured that it will shut down when appropriate. Most use cases for “Restart” should be handled by application-specific UI, but “Shut Down Now” and “Restart” should also be available from GDM as a fallback.

attachment:summary.jpg

Release notes

• Switching user accounts is now done using the “Fast User Switching” menu in the panel.
• “Suspend” and “Hibernate” have been combined into a Sleep command. In the new Power Saving settings, you can choose whether Sleep always suspends, always hibernates, or switches from suspending to hibernating after a particular time period.
• Ubuntu can now shut down the computer automatically if no-one uses it for a given period. Choose whether and when this happens in the new Power Saving settings.

Rationale

From 6.06 to 7.10, Ubuntu has had a “Quit” dialog with up to eight items: “Log Out”, “Lock Screen”, “Switch User”, “Suspend”, “Hibernate”, “Restart”, “Shut Down”, and “Cancel”. This design was well-intentioned, following the principle of forcing commitment as late as possible (rather than making people climb out of one confirmation alert and into another).

Unfortunately, this benefit has been outweighed by the choice being confusing and daunting. The Quit dialog gives too many options, with the difference between them being unavoidably difficult to explain. And people can get used to clicking a particular button in the dialog, such that they click it even when they didn't mean to.

No other common appliance has this many exit modes, and we shouldn’t accept it in personal computers either. That other OSes make it complicated is not an excuse to be like them, but an opportunity to be better than they are.

What other systems do

Gnome upstream

Three menu items:

• “Lock Screen” locks the screen immediately.
• “Log Out” leads to an alert: “Switch User”, “Cancel”, “Log Out”. It automatically logs out after one minute.
• “Shut Down” leads to an alert: “Suspend”, “Hibernate”, “Restart”, “Cancel”, “Shut Down”. It automatically shuts down after one minute.

You can try these options in Ubuntu by setting the gconf key /apps/panel/global/upstream_session (and then either restarting the panel or adding a new menu bar).

Fedora

Alters the Gnome design by splitting “Suspend” and “Hibernate” off into a fourth alert.

OpenSUSE

[http://calvinrg.blogspot.com/2007/08/gnome-logout.html A single dialog], with "Log Out", "Lock Screen", "Shutdown" [sic], and "Restart", all explained inline.

Windows Vista

The Start menu has two buttons — a power icon, and a lock icon — then one menu with seven choices: “Switch User”, “Log Off”, “Lock”, “Restart”, “Sleep”, “Hibernate”, and “Shut Down”.

[http://joelonsoftware.com/items/2006/11/21.html Joel Spolsky]: “Inevitably, you are going to think of a long list of intelligent, defensible reasons why each of these options is absolutely, positively essential. Don't bother. I know. Each additional choice makes complete sense until you find yourself explaining to your uncle that he has to choose between 15 different ways to turn off a laptop.”

[http://moishelettvin.blogspot.com/2006/11/windows-shutdown-crapfest.html Moishe Lettvin], Windows Vista developer: “I would like to try to explain how this happened.”

Mac OS X

[http://en.wikipedia.org/wiki/Apple_menu The Apple menu] includes four relevant items:

• “Sleep” suspends to RAM. On newer machines, it ([http://db.tidbits.com/article/9090 slowly and sometimes unreliably]) does “Safe Sleep”, which suspends to disk and then to RAM in one go.

• "Restart..." leads to an alert asking if you're sure. It automatically restarts after 120 seconds.
• “Shut Down...” leads to an alert asking if you're sure. It automatically shuts down after 120 seconds.

• “Log Out login-name-here...” (with a system-wide keyboard equivalent of Shift+Command+Q) leads to an alert asking if you're sure. It automatically logs out after 120 seconds.

(With the latter three commands, holding down the Option key bypasses the alert, which is indicated by the menu items no longer having ellipses. The commands time out with an explanatory alert if any application failed to quit by itself.)

[http://arno.org/blog/2006/11/design-of-mac-os-x-shutdown-feature.html Arno Gourdol], Mac OS X developer: “I actually think that the result could have been even better than what we ended up with. I argued against including Restart, Shut Down and Sleep in the Apple menu.”

What we should do

Assumptions

First, we will take a deep breath and make these assumptions.

• Making session management Just Work is an important goal, but not one that we can achieve in the next year or two.
• A panel menu is sufficient as the only interface for fast account switching.
• “Lock Screen” is a security function — something you do when you’re leaving the computer temporarily and you don’t entirely trust everyone nearby. It is fundamentally different from the other options, and therefore it’s reasonable to separate it out.
• Those people technical enough to care about the distinction between “Suspend” and “Hibernate” can tolerate it if we expose that distinction in power management preferences (including an optional timed transition from suspend-mode to hibernate-mode), and in terminal commands, but not in the Quit interface. (This does not mean we are forcing anyone to use the terminal: the primary interface for choosing between suspend and hibernate will be the power management preferences.)

• If you’re using a laptop, and you want it to suspend or hibernate, closing the laptop lid can be the way to do that. Those people who don’t want their laptop to suspend or hibernate when closing the lid, but do want it to suspend or hibernate on other occasions, are technical enough that we can trust them to suspend or hibernate with terminal commands rather than in the graphical interface. (Again, this does not mean we are forcing anyone to use the terminal: the primary interface will be closing the lid.)

• Putting a non-laptop machine to sleep is rare enough that we can make it something that happens after a configurable timeout (or from a terminal command), rather than a command in the Quit interface.
• For many occasions where the computer needs restarting, such as a kernel update, Ubuntu can offer a transitory interface for doing it (such as an alert, or a menu item in the relevant program). The remainder of cases will be rare enough that people will not mind logging out before choosing the Restart command (or, alternatively, using a terminal command).

• We can make gdm fast and accessible.

• Having a simple Quit interface, and more complex power management preferences, is better than the reverse.

Lock Screen

The penultimate item in the System menu (and the Main Menu) should be “Lock Screen”.

Implementation: ...

Quit

The last item in the System menu (and the Main Menu) should be “Quit”, without ellipsis. (Sometimes quitting does require more input, which implies ellipsis, but currently we can’t tell that ahead of time.)

Choosing “Quit” should log out as quickly as possible. If an application cancels the logout, this should be explained using a note alert, using the application's human-readable name if known.

attachment:logout-cancelled.jpg

Implementation: ...

Future work: Decide exactly which shortcut buttons should be added to this alert. (“Try Again”? “Force Quit”?)

Account switching

If (and only if) the system has multiple user accounts set up, and you have fast account switching turned on, the menu should be added to your panel automatically, immediately to the left of the Big Red Button. This will be the method of switching accounts while staying logged in.

Implementation: ...

Login screen

The login screen should have “Shut Down” and “Restart” buttons at the bottom.

attachment:welcome.jpg

If Ubuntu is configured to shut down automatically, the “Shut Down” button label should instead be “Shut Down Now”. The button should pulse subtly (about 5 seconds per cycle), and the icon inside the button should slowly rotate clockwise to indicate how close it is to shutting down. If any input device is touched (or storage device is attached) during the countdown, it should reset, and this should be shown by the Shut Down icon rewinding (in 0.5 seconds) back to its original position. When time runs out, the button should visibly appear clicked for 1 second. After the button is clicked (whether manually or automatically), all controls on the screen should become insensitive, then the computer should shut down.

When “Restart” is clicked, all controls on the screen should become insensitive, then the computer should restart.

Implementation: As part of HardyGdm development.

Future work: “Restart into Windows” and/or “Restart into Mac OS X” buttons alongside the “Restart” button, depending on what other OSes are installed.

Power Saving settings

The Power Management Preferences window should be simplified into a “Power Saving” settings window. (Outside of a power station, nobody wants to “manage” power.)

The window should have two tabs: “When Using Mains” and “When Using Battery”. The two tabs should have the same four sliders:

attachment:mains.jpg attachment:battery.jpg

• “The display should sleep when the computer is idle for:”
  • tick marks for “5 minutes”, “1 hour”, “2 hours”, “3 hours”, and “Never”
• “The computer should sleep when inactive for:”
  • tick marks for “5 minutes”, “1 hour”, “2 hours”, “3 hours”, and “Never”
• “When asleep, go into zero-power mode (“hibernate”):”
  • tick marks for “Immediately”, “1 hour”, “3 hours”, “6 hours”, and “Never”
  • “Critically low battery will always trigger zero-power mode.”
• “When no-one is using the computer, shut down after:”
  • tick marks for “Immediately” if there is only one user account or “1 minute” otherwise, “1 hour”, “3 hours”, “6 hours”, and “Never”

The “Closing the lid puts the computer to sleep” checkbox should be present only if the computer is a laptop (or other device with a lid).

Impossible combinations should be prevented by graceful syncing of the sliders. For example, if the computer-sleep slider is set to 1 hour and you start dragging the display-sleep slider out to 2 hours, the computer-sleep slider should follow you out to 2 hours. Keep dragging the display-sleep slider and move it back to 30 minutes, and the computer-sleep slider should follow you back until it reaches its previous value.

There should not be a setting for display brightness or dimming, because the desired brightness level will be highly dependent on the ambient light wherever the battery is being used; therefore, brightness should be configured manually instead (e.g. with the Brightness Applet). Nor should there be a separate setting for dimming the display when idle; instead, dimming should function as a two-minute warning that either the display or the entire computer is about to go to sleep.

Implementation: ...

Future work: Merge the “When Using Mains” and “When Using Battery” tabs, by using a two-column table of option menus instead of sliders. For maximum environmental points, merge screensaver settings into this window, perhaps as a new first tab.

Sleep

When the computer is about to go to sleep, it should set itself to wake up either at the “Go into zero-power mode” timeout, or when it estimates that the battery will have 15 minutes of full power left, whichever is earlier. When it wakes up in either of these two circumstances, it should wait until the hard disk is in a safe state to write to (if this is detectable), then hibernate.

Implementation: ...

Big Red Button

The Big Red Button should be off by default, because if retained it would work identically to the “Quit” menu item. One access point for Quit in the GUI, and one access point on the actual hardware (the power button), is more than enough.

Index to the previous options

Log Out: Activated by choosing “Quit”.

Lock Screen: Activated by the “Lock Screen” menu item.

Switch User: Activated by the account menu in the panel.

Suspend and Hibernate: Merged into “Sleep”. Activated by closing a laptop’s lid. Can happen after a period of inactivity (on any type of computer), if configured in the Startup & Shutdown settings.

Restart: Activated by choosing “Quit” then “Restart”, as before.

Shut Down: Activated by choosing “Quit” then “Shut Down Now” (the same number of clicks as before), or just by choosing “Quit” and leaving the computer undisturbed for a period configured in the Power Saving settings.

Migration

... [need to adapt existing Power Management settings to the new settings]

Implementation: ...

Test/demo plan

Other ideas that were considered

• Split the Quit dialog into multiple ones, like Gnome upstream.
• Plan for future of session management? (it shouldn't matter what you do, your session is still safe)
  • We keep trying to work around the problem of poor session management. Could we at least start a fix to this?
• Make Fusa a compulsory panel applet if you have user-switching available, and impossible if you don't.
• Make GDM the giant Lock Screen dialog.

  • This would require an obvious indication in facebrowser that the person is still logged in (and default to them for easy returning to their session).

  • Maybe rename "Log In" to "Continue" in that case.

  • Would require GDM to be accessible if any account on the computer requires it.

  • Would still require you to return to your session to deal with save-changes alerts, etc.
• Most PCs have a wakeup timer in Bios. We could use this to merge suspend and hibernate: hibernate if suspended for X minutes/hours. (Perhaps a slider on power management prefs: Immediately - 1 hour - 2 -hours ... - Never. "[i] The computer may hibernate sooner if the battery is nearly exhausted.")
• If the shutdown process is slow enough, we could make restarting a command available during the shutdown process.
  • Or we could make restarting something that happens if you hold down a key during the shutdown.
• Two/three options:
  • "Suspend" suspends, and then hibernates after delay/flat battery.
  • "Shut Down" hibernates.
  • "Restart Into Windows" if Windows is installed.
• .. Not practical, says mjg.
• Merge "Switch User" into "Lock Screen"?
• Merge "Switch User" into "Log Out"?
• Hibernate just the user session, and shut down the rest?
• Kill the logout and shutdown sounds! (or make it an accessibility option)
  • No use case except for blind wanting a clue as to when shutdown is occurring
• "Pause" and "Stop"?
• "Restart" appears in the big dialog only if:
  • you chose "Restart Later" earlier
  • you have other OSes installed.

Unresolved issues

• Should GDM itself have sleep settings? If so, what should they be, how should they be set, and how should they be affected by the power source being used?

Comments/questions

Regarding the assumption that "Putting a non-laptop machine to sleep is rare enough that we can make it something that happens after a configurable timeout (or from a terminal command), rather than a command in the Quit interface":

I don't think that is true. I know desktop users who fits this profile:

• 1) They tend to have many windows open doing many different things. 2) Because of that, they often hibernate their system when they leave it for a long time, in order to keep their session for next time. 3) Using a terminal to hibernate would be far too technical for them. 4) A timeout is not the solution for them, because they don't want their computer to hibernate automatically.

Another of the above asssumptions is that "Having a simple Quit interface, and more complex power management preferences, is better than the reverse". In the power management preferences, next to the other sleep settings, could be added a checkbox, defaulting to off, which when turned on would cause an extra entry to appear in the System menu, near Quit and Lock Screen, which the user can choose to manually initiate hibernating the system -- thus providing a simpler quit interface (menu entry instead of terminal command), on the cost of one extra checkbox in the preferences.

This would of course also help the laptop users (such as myself) who don't want the system to sleep when they close the lid, but want to be able to hibernate when they choose to.

Mpt, what do you think about this idea? I know in general it's terrible to have a preference only controlling the visibility of some UI element, but in this case would it not be a better solution than leaving people with no way to initiate a hibernation? --JonasJørgensen

• If these people leave their computer “for a long time”, and do want it to hibernate, why is it they “don't want their computer to hibernate automatically”? In other words, why do they care so much about exactly when the computer goes to sleep, that they want to do it manually rather than just locking the screen and letting the computer sleep by itself after 30 minutes or whenever? -- MatthewPaulThomas

CategorySpec