nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Remove Publish to JMP Public option from file menu

MikeD_Anderson

What inspired this Wish List Request?

Several requests from customers evaluating (and purchasing) JMP Live. General request from customers regarding accidental publishing (regardless of the current pop-ups). Questions during the JMP Live Mastering session on 07Sep2024.

Please describe the new or improved feature or solution you would like to see.

Remove the option to "Publish Report to JMP Public" from the main menu.
Require users to open the connections manager and manually add JMP Public as a connection option.
Should JMP Public be added as a connection it should never be allowed to be the default. If Public is the only connection option the existing pop-up should be triggered on every publish.

What would the value be to you and/or other users if this new feature is provided?

There is real concern among the users of JMP Live, those evaluating it, and even those who just see it in the menu around accidental publishing of sensitive data to public. Even with demoing the pop-ups on the Public publication workflow, it is viewed as a fairly serious security risk and the pop-ups are viewed as an insufficient safeguard. Forcing the customer to opt-into having JMP Public (e.g., manually adding it) as a publication option is universally put forward as the customer preferred solution to this issue.

Is this an external customer request?

Request in the Mastering session was from IDEXX. The concern has been raised additionally by Thermofisher (evaluating), Wolfspeed (part of why they refuse to evaluate), Corning (also part of why they refuse to evaluate), Takeda, and Kimberly Clark. Historically it was brought up by Regeneron and Lotte.

Is there a competitive software package that has this feature or solution that we should be aware of?

N/A

Will this impact a renewal, expansion, or adoption at a customer, and does this put an account at risk if we do not address this?

For many customers the ease that someone could mistakenly put something into the public domain is a nonstarter. This issue may impact renewal of JMP Live installs (especially in the event of a serious publication incident). At the very least, it will slow adoption and trigger more internal scrutiny of JMP and JMP Live by customer INFOSEC teams.

Status: Acknowledged

Comments

dieterpisot

Hi @MikeD_Anderson

Administrators can enable or disable publishing to JMP Live for specific URLs. On a user’s PC, the administrator can specify the URLs in a jmpStartAdmin.jsl file.

Disable JMP Live URL() specifies the URLs that users cannot publish to. For example:

Disable JMP Live URL( "https://public.jmp.com" ) // disables publishing to the JMP Public URL

Do you think that this good enough for customer?

MikeD_Anderson

Hey, @dieterpisot - I don't that would go over well - Most of my admins (and potential admins) are going to need to deploy that to 300+ users. This would require them (best case) to set up a push and audit task (involving other parts of IT), or (worst case) install the pref file manually. Either way, that will slow down adoption of new versions of JMP when I'm trying to get them to ride the front end of the release cycle instead of being 3 (or more) releases behind. Part of the benefits to the admins for JMP 18 is the reduced administrative overhead. If there were a checkbox or something they could push in My JMP, that would be one thing. This would put them back in old mode. It would probably trigger secondary complaints as well since they lost the ability to prepackage add-ins and preferences with 18.

The solution I preposed was something I thought up, but it came from a number of conversations around this point. They all generally asked "why is JMP engineering a security failure point into the software?" They all felt it should be some form of opt-in instead of some flavor of opt-out.

dieterpisot

Ben_BarrIngh

Just wanted to comment on this to say JMP Public is a great option to have for students and others publishing publicly accessible works (I've used it myself in publications to give access to figures, data and more)- I think it would be beneficial to keep it in where it's visible to students/academics who might not necessarily see the benefit of it at install (i.e. they may not opt-in as they're freshly introduced to the tool) or are simply not aware of it initially. Maybe change the position of where it is so it is separated from the JMP Live option and add a warning to let users know it's being published on the public website?

MikeD_Anderson

@Ben_BarrIngh - or maybe change the menu structure a little based on the version, since they'll be running the academic version?

Jed_Campbell

One slightly burdensome way to mistake-proof this would be to require the user to type verbatim something like "I'm uploading this data to a public server" when someone uses the Publish to JMP Public option. That way, a mistaken click wouldn't result in a catastrophe.