Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Vista's Troublesome UAC is Developer's Fault?

Cliff posted more than 7 years ago | from the sh'yeah-right dept.

Security 228

MythMoth wonders: "We've heard all about the pain and discomfort of working with Windows' User Account Control (UAC) switched on, but now Ian Griffiths is explaining that the developers are the problem — they brought it on themselves. In earlier articles we have heard that Microsoft think that everyone should do it like this — Ian does acknowledge that things are better in the Unix world, but is he right? Is the onus now on the developers to help fix a problem that they did not cause?" Rather than ask the user for permission on every operation, what other ways could Microsoft have improved Vista's security?

Sorry! There are no comments related to the filter you selected.

gnaa (0, Offtopic)

SpaceballsTheUserNam (941138) | more than 7 years ago | (#19063385)

hey, wtf

duh (-1, Troll)

mastershake_phd (1050150) | more than 7 years ago | (#19063393)

Its someone at microsofts fault. Maybe they should have some regular people beta test it instead of just the techies that manage to get the beta programs.

I saw a different problem (3, Informative)

280Z28 (896335) | more than 7 years ago | (#19063405)

I noticed a different and (possibly) serious issue:
  • First few times: What is this annoying thing?
  • Next few times: Well I guess it's better than not knowing
  • After that (without reading) click ok...
So does that mean it's not working, wasting my time, AND training me to ignore security warnings? Honestly I don't have a better solution except for the rhetorical question "why can't people who exploit users just /themselves......"

Re:I saw a different problem (5, Informative)

Osty (16825) | more than 7 years ago | (#19063455)

So does that mean it's not working, wasting my time, AND training me to ignore security warnings? Honestly I don't have a better solution except for the rhetorical question "why can't people who exploit users just /themselves......"

Which goes to exactly what Ian was saying -- If you're really seeing UAC that often, you're doing something wrong (or you're using software from developers who did something wrong). As developers get their act together and stop requiring admin privileges for trivial things (hint: using %userprofile% and HKCU rather than %programfiles% and HKLM will solve 90% of your admin-privilege requirements when developing), UAC prompts should appear less and less often, and then only when you really expect them (you're doing system configuration stuff) or when there's a real issue that you should deny. Unfortunately, that world is probably 3+ years away as developers get with the program and rev their software, and in the meantime UAC will just become one more annoying dialog you have to click through to do anything.

With that said, I saw the UAC dialog exactly once today, and that was only because I had to upgrade my video drivers. I'm a professional software developer. I spend my time with Visual Studio and SQL Server, and I rarely have to deal with UAC prompts.

Re:I saw a different problem (2, Interesting)

280Z28 (896335) | more than 7 years ago | (#19063531)

It will be interesting to see if developers actually pay attention. Just think about how many poor programming practices you see today*. Books have been out for 10 years about good coding... UAC is but 1 year old. I hope we're not in for the long haul, and yet I know we are...


* Today I ran across a stack class that used for its push function... an overloaded operator new...

Re:I saw a different problem (1)

EvanED (569694) | more than 7 years ago | (#19063569)

Today I ran across a stack class that used for its push function... an overloaded operator new...

I am a reasonably big C++ fan who will staunchly defend the presence of operator overloading in a language, but I cannot comprehend the thought processes that must take place for someone to think that this is a good idea.

Re:I saw a different problem (3, Insightful)

pallmall1 (882819) | more than 7 years ago | (#19063575)

I spend my time with Visual Studio...
So have you followed Microsoft's advice to "run Visual Studio 2005 elevated"?

Who is a developer supposed to listen to -- Microsoft or Ian Griffiths? It seems to me that Griffiths has a lot of nerve blaming developers for following Microsoft's recommendations.

Re:I saw a different problem (1)

Osty (16825) | more than 7 years ago | (#19063633)

So have you followed Microsoft's advice to "run Visual Studio 2005 elevated"?

Honestly, because I use VS as a glorified text editor (builds are for command lines), there's really no need. Even if I did, though, I wouldn't see the UAC prompt all that often -- open Visual Studio once, keep it open for several days.

Re:I saw a different problem (1)

aussie_a (778472) | more than 7 years ago | (#19064555)

Wow so in order to avoid annoying prompts, you have to keep your program open? That sounds, annoying!

Re:I saw a different problem (2, Interesting)

Aladrin (926209) | more than 7 years ago | (#19064663)

Actually, I tend to leave my programming environment open for weeks, regardless of operating system. It's not 'annoying' if you would do it anyhow. It's quite a bit less annoying that way because you can just sit down and work, without the 30 second wait for everything to load back up.

So it's a matter of perspective. I will agree that if I had to keep most other programs open to avoid the UAC, it'd be annoying.

(I don't have Vista yet... I'm waiting for that first killer game that makes it a necessity. May it be long in coming.)

Re:I saw a different problem (5, Informative)

AaronBrethorst (860210) | more than 7 years ago | (#19063933)

VS2005 does not require you to run with admin privileges. There are some scenarios that require this, but they're generally the exception rather than the rule. If you want to do something like create a new IIS website on your local machine from within VS you'll need to launch VS elevated, but this is because IIS requires administrative privileges to accomplish this task. For VS 2005, there wasn't much we could do about that. Let me know if you want more information about the topic. I was the developer division's go-to guy for UAC for a year.

Mod Parent up please (1)

popeyethesailor (325796) | more than 7 years ago | (#19064275)

I cant imagine why parent is marked Troll. It's a ontopic reply, with informative commentary, directly from the source.

Re:Mod Parent up please (1)

nschubach (922175) | more than 7 years ago | (#19065329)

I cant imagine why parent is marked Troll.
Maybe it's his signature? Does he really need to tell everyone he works for Microsoft? Can't you just provide good information and not bring the company you work for in to try to up your "cred"? I mean, most of us work for some IT firm or company that many have probably heard about, but when you resort to using the name of some other entity to further your goals, it seems a bit self-indulging.

That and many of us don't particularly care for Microsoft and their business methods. So modding him down is a way to "stick it to the man", if you will.

I'm not saying either of those are the reason, but I can see how they could be. Mods can use their points in any way they see fit.

Re:I saw a different problem (1)

pla (258480) | more than 7 years ago | (#19065251)

VS2005 does not require you to run with admin privileges.

If attaching to a process to debug it doesn't require admin privileges, Vista has a lot more wrong with it than the annoying UAC giving false positives...



There are some scenarios that require this, but they're generally the exception rather than the rule.

Debugging most certainly does not count as an exception to the norm. If you need to work with someone else's code, walking through it a few times with a debugger will teach you more in one day than weeks of reading the code (not to say you shouldn't read the code as well). And if you can write a bugless non-toy app, consider me in awe of your coding prowess.

Re:I saw a different problem (2, Insightful)

cerberusss (660701) | more than 7 years ago | (#19065445)

If attaching to a process to debug it doesn't require admin privileges, Vista has a lot more wrong with it than the annoying UAC giving false positives...
I only code on Linux, however, I don't think you need admin priv to debug a process that runs with your own user's privileges??

Re:I saw a different problem (1)

Todd Knarr (15451) | more than 7 years ago | (#19063963)

Except that using HKCU has another problem: many programs register stuff they need in the registry. On a single-user system HKCU isn't a problem. But when another user tries to use that installed program, BAM, none of the required registry entries are in their HKCU tree. Which means developers have to develop another set of practices as well: either writing programs that can self-register themselves and set up all the neccesary registry entries on their own independently of the installer (at which point the need for an installer goes away), or the installer has to set up the system-wide stuff in HKLM (which requires privileges for the installer) and then the program reads first HKLM and then HKCU for entries but only writes changes back to HKCU. Unix already has a well-developed set of practices for this, but Windows developers are going to have to learn from scratch.

Frankly I disagree with part of the quoted comment in this entry. These problems are the developers' fault. But not developers in general, only Windows developers. They've lived in their own world, ignoring everything that everybody else had learned or was learning about multi-user systems and writing programs for them, and now it's coming back to bite them. Microsoft didn't help by catering to them for so long, but ultimately it's the developers who decided not to learn from everybody else's experience and went along with the recommendations of a company with no experience in a multi-user system.

Re:I saw a different problem (2, Interesting)

badfish99 (826052) | more than 7 years ago | (#19064131)

Surely the reason that Window developers haven't learned from the rest of the universe is Microsoft's fault. Microsoft have done everything thay can to make Windows development an entirely self-contained and proprietory process: you use Microsoft's IDE, write your code in Microsoft's unique language or (if you use C++) using Microsoft's unique proprietory API. You never learn, because you never have to think; you just go along with what Microsoft tell you to do, without ever having to understand it. Microsoft told people to run as administrator, and made it the default, so that's what they did.

Re:I saw a different problem (5, Insightful)

fwarren (579763) | more than 7 years ago | (#19064609)

Take a look at what we call "good programming practices" in the Windows world. Look at the windows programming bibles. Look at how many programs written by Microsoft that are not designed to be administrative programs break on Vista.

That's not fair, to expect Office 97 to run fine on Vista. Well actually it is. If you had followed all of Microsoft's best practices, and work the platform as designed....you end up right where we are at today.

Were Microsoft programs ever written to be run as a low privileged user working only with the users folder in "Documents and Settings" and only writing to HKCU. With the installer designed to be run once as an Administrator to write files to "Program Files" and HKLM?

Yes, you could always run a low privileged account and change permissions on certain registry keys. But face it, these are a hack. Until recently, Microsoft never wrote software that way. They never seriously advocated it either. If they did, professional software such as Quickbooks 2001 or 2005 would run just fine on Vista.

Hell, the whole registry thing was a bad idea. In the Linux world, when you move to a new box, you can copy an rc file or folder from /etc and your rc file from your home directory and the program is configured to run properly on the new machine. Bash_rc for example. Most well behaved programs make few if any changes to other programs rc files. Very few of those even need any files from /etc, usually just one file or folder from your user directory is enough.

Most of the time in Windows you can not even copy out the relevant section from HKLM and HKCU because of the shoddy programing practices as taught and evangelized by Microsoft. So many entries in the registry are spread out over so many places, the program won't run if you copy just one section from the registry. A good example is Outlook Express. You cant just copy out "Outlook Express" keys from HKCU and the data files and expect it to run.

If I had to point my finger at developers for bad practices. I will be pointing my finger towards Redmond Washington.

Re:I saw a different problem (0)

Anonymous Coward | more than 7 years ago | (#19064855)

Most of the time in Windows you can not even copy out the relevant section from HKLM and HKCU because of the shoddy programing practices as taught and evangelized by Microsoft. So many entries in the registry are spread out over so many places, the program won't run if you copy just one section from the registry. A good example is Outlook Express. You cant just copy out "Outlook Express" keys from HKCU and the data files and expect it to run.
Uh, actually I've done that lots of times.

In fact you don't need any registry keys, just copy the OE data files from the old "Identity" directory to the new one (open/close OE on the target system if it doesn't already exist).

And TBH I don't know where you're getting MS pushing bad practices. All the docs I've seen on MSDN and the application certification guidelines for XP and Vista tell you to do things properly.

Re:I saw a different problem (4, Insightful)

nschubach (922175) | more than 7 years ago | (#19065401)

That's why I've always said and stick by my thought that programs should only have access to the directory in which they run. All settings and program specific files should be contained within said directory and children and not be given permission by default to access anything in or preceding their parent scope. This should be enforced by the OS, save for one aspect which is easily controlled. Save or open common dialogs grant "sudo" access to whatever file the user selects outside that scope. Operating system maintenance programs would be the only other "special" programs and installing them should prompt the user with very stern dialogs with a system stability warning.

Re:I saw a different problem (1)

flukus (1094975) | more than 7 years ago | (#19064139)

It's not just the developers. My ex boss was adamant that all configuration files should be stored in program files and no ammount of argument could convince him otherwise (he was a network admin so he should have known). Needless to say this screwed up on any remotely secure setup.

I wonder if they've fixed the app for LUCs and vista yet!

Re:I saw a different problem (1, Interesting)

Anonymous Coward | more than 7 years ago | (#19064709)

I had disabled UAC in my vista box and had to reinstall recently, so UAC was turned back on and thought about leaving it for a while, but every time I wanted to delete a file I'd get the expected and usual "are you sure you want to delete?", then the UAC file operation yes/no and one other window, I don't need to click three things to delete a file. So I turned it back off. What you're saying makes perfect sense, but there should be some way to tell that the user clicked on and requested deletion of a file rather than a program.

Re:I saw a different problem (1)

elevator (117768) | more than 7 years ago | (#19065425)

The only time you will see an UAC prompt when dealing with files, is if you are dealing with somebody OTHER's files and you need to elevate to grant yourself permissions on that file.

Just as with the common Unix you cannot, and never could with the Windows NT line, delete files you don't have the proper permissions to, and just as with Unix, permissions are not granted by name but per (S)ID.

Hence, when you reinstall your box, you will get another SID for your username, so the files you want to delete are not owned by you and you do not have the permissions to delete them, so you cannot delete them without elevating and setting the proper permissions.

The simple solution is to just become owner of your own files.. but then again, you might be just sprouting off some eight month old rumor :)

Waiting PASSIVELY is not a good solution. (5, Insightful)

DrYak (748999) | more than 7 years ago | (#19064929)

Waiting passively for the programmers to change their bad habits isn't the best strategy that could have be taken by microsoft.

As you state those problems stems from bad programming habits. Developers that have taken the habit of writing critical data just like in the old DOS days : wherever it pleases them, ignoring the fact that some place are supposed to be reserved for admins only.
It has worked up to WinXP because either there wasn't any protection (older DOS based Windowses) or all users did run as admins by default (newer NT based Windowses). Now that VISTA finally tries to correct this and approach something that looks like Unix' habits - using admin-level privileges for doing ... admin work on the machine as intended. They found thousands of bad-behaving softwares that can work under this envrionment.

BUT THEY'VE TAKEN THE WRONG ROUTE AROUND THE PROBLEM !!!

With such problems you have three solutions :

- IGNORE THEM. Let the bad-behaving software just crash or display error message. That would attract attention to the fact that those software are broken. BUT ! Most users will believe that errors appear because Vista is buggy. The new version will get a bad reputation (as if the rest wasn't enough) and no users would like to switch. Microsoft would loose valuable market shares.
-> So that's why microsoft doesn't do it.
This behavious only works on Unices because most of the other software function correctly and users guess that the problems comes from the badly-behaving software and they try to download a corrected newer version or a better alternative.

- ASK USER'S PERMISSION. Do some 'sudo'-style privilege escalation for every single action that would require admin rights. And hope that developer will notice and produce more Vista-compatible softwares.
-> This is what microsoft has done, BUT THIS IS FUNDAMENTALLY WRONG.
Because concerning users :
- It floods them with a mass of annoying blocking popups asking for privileges. The users ends-up first answering OK to everything (and the Unix style protection is completly lost) and then they disable the whole UAC to stop the flow of popups. So it is as if it wasn't introduced in vista in the first place.
And concerning developers :
- As pointed by other /. developpers will be slow to change. They don't write code "perfect by the book", code that "somewhat works" is enough for most of them. Read sites like this [thedailywtf.com] if you don't believe.
- Changing may be difficult for them, because it would require re-doing the whole program architecture. Or it could pose problem to migration between the older bad-behaving version and the newer vista-compatible version, and there's a huge users pool that the developpers want to avoid pissing because of a non-trivial migration.
- And finally, they aren't compelled to change this, because users are running with UAC disabled anyway.

The last solution would be :
- VIRTUALIZE IT. Put all old-world (pre-Vista) software in a sandbox, a chroot jail, or whatever it is called in Windows. Whenever some pre-Vista software tries to access stuff it shouldn't in a normal user context, just do it - but on a dummy local copy to both avoid damaging the system and avoid annoying the user. That's the route that Apple has went were pre-OSX apps are ran inside some kind of emulator. But that is easier for them because of the radical shift in architecture : older software rely on a such different API, that it had to be emulated anyway, throwing a sandbox in the mix was only an added bonus.
Microsoft could do it as easily, because, fundamentally, Vista is XP with a shiny interface and some DRM thrown in. It would have annoyed users : They used to ran perfectly well behaving software writen for NT-Kernel under XP and suddenly, under Vista which uses mostly the same internal structure they have to run the same software inside a sandbox.
Microsoft SHOULD have spent a lot of time planning well the transition in order to avoid such problems. Instead they focussed on too much side problems (WinFS fiasco...) and ended up losing time developping non-useful new features (Nice eye candy interface)

They only hope now, is that their famous "next-big-thing(tm)" from microsoft lab, that is supposed to be microkernel and capability-based, will one day go out of the MS-lab (and not go the "eternally-postponed to next release" vaporware route of WinFS). Being radically different, some level of API emulation (or complete virtual machine emulation) will be required, and maybe they would finally be able to throw in the sandboxing they need so much to break the habbit of bad software.

Re:I saw a different problem (-1, Troll)

Anonymous Coward | more than 7 years ago | (#19064561)

GNAA announces switch to Windows Vista
GNAA announces switch to Windows Vista

fellacious (GNAP) Intercourse, PA - Windows Vista appears to finally be taking off, at least within one Fortune 100 company. The GNAA had for the past 13 years been using Red Hat Linux and it's successor, Fedora Core, but growing discontent with the free software operating system forced CTO Jmax to declare on Wednesday that the company was to be switching its entire infrastructure to the new version of Windows, effective immediately. "I'm not going to theatrically claim that I wasn't expecting to have to do this," Jmax said. "This has been coming for quite some time." The GNAA's troubles with Red Hat's Linux system included chronic governance problems, a persistent failure to maintain key repositories, a complex and undocumented submission process which has kept the GNAA's free trolling utilities off the Red Hat-based desktops of thousands of would-be trolls, inability to keep RPM up to date, and a failure to address the problem of Firefox not crashing a entire computer when the user loads Last Measure. "The deal-breaker, though, was when a key Last Measure server remained down for four hours while our entire Intercourse development team tried desperately to bring it up despite not having statically-linked package manager binaries." What had happened was Dikky, visiting from Norway, wanted to play the child pornography mod of Doom 3 on that server- which had to drag several libraries with it. "In addition," said Jmax, "several key software applications used in the GNAA's corporate workflow are proprietary software- which means that they had to be run in an Ubuntu compatibility environment anyway." However, being as those unnamed applications were written in C#.NET, "We expect that our transition to Windows Vista will come off without a hitch."

About Jmax:

The CTO of the GNAA, Jmax also has a seat on Microsoft's board of directors. His resume can be accessed at http://goatse.fr/ [goatse.fr] .

About Windows Vista:

The fastest-growing desktop operating system on the market, Windows Vista combines the legendary security of Windows 98 with the legendary ease of use of those computer interfaces you see in the movies into one ultra-fast, ultra-stable computing platform.

About Red Hat:

A failure of a computer company, Red Hat burns through investor money while giving its products away for free. It is currently under investigation from the SEC for misuse of invested funds, and being sued by the GNAA for breach of contract for sucking more than specified in the GNAA's contract with Red Hat.

About the Linux community:

Trolled.



About GNAA:
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the first organization which gathers GAY NIGGERS from all over America and abroad for one common goal - being GAY NIGGERS.

Are you GAY [klerck.org] ?
Are you a NIGGER [mugshots.org] ?
Are you a GAY NIGGER [gay-sex-access.com] ?

If you answered "Yes" to all of the above questions, then GNAA (GAY NIGGER ASSOCIATION OF AMERICA) might be exactly what you've been looking for!
Join GNAA (GAY NIGGER ASSOCIATION OF AMERICA) today, and enjoy all the benefits of being a full-time GNAA member.
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the fastest-growing GAY NIGGER community with THOUSANDS of members all over United States of America and the World! You, too, can be a part of GNAA if you join today!

Why not? It's quick and easy - only 3 simple steps!
  • First, you have to obtain a copy of GAYNIGGERS FROM OUTER SPACE THE MOVIE [imdb.com] and watch it. You can download the movie [idge.net] (~130mb) using BitTorrent.
  • Second, you need to succeed in posting a GNAA First Post [wikipedia.org] on slashdot.org [slashdot.org] , a popular "news for trolls" website.
  • Third, you need to join the official GNAA irc channel #GNAA on irc.gnaa.us, and apply for membership.
Talk to one of the ops or any of the other members in the channel to sign up today! Upon submitting your application, you will be required to submit links to your successful First Post, and you will be tested on your knowledge of GAYNIGGERS FROM OUTER SPACE.

If you are having trouble locating #GNAA, the official GAY NIGGER ASSOCIATION OF AMERICA irc channel, you might be on a wrong irc network. The correct network is NiggerNET, and you can connect to irc.gnaa.us as our official server. Follow this link [irc] if you are using an irc client such as mIRC.

If you have mod points and would like to support GNAA, please moderate this post up.

.________________________________________________.
| ______________________________________._a,____ | Press contact:
| _______a_._______a_______aj#0s_____aWY!400.___ | Gary Niger
| __ad#7!!*P____a.d#0a____#!-_#0i___.#!__W#0#___ | gary_niger@gnaa.us [mailto]
| _j#'_.00#,___4#dP_"#,__j#,__0#Wi___*00P!_"#L,_ | GNAA Corporate Headquarters
| _"#ga#9!01___"#01__40,_"4Lj#!_4#g_________"01_ | 143 Rolloffle Avenue
| ________"#,___*@`__-N#____`___-!^_____________ | Tarzana, California 91356
| _________#1__________?________________________ |
| _________j1___________________________________ | All other inquiries:
| ____a,___jk_GAY_NIGGER_ASSOCIATION_OF_AMERICA_ | Enid Al-Punjabi
| ____!4yaa#l___________________________________ | enid_al_punjabi@gnaa.us [mailto]
| ______-"!^____________________________________ | GNAA World Headquarters
` _______________________________________________' 160-0023 Japan Tokyo-to Shinjuku-ku Nishi-Shinjuku 3-20-2

Copyright (c) 2003-2007 Gay Nigger Association of America [www.gnaa.us]

Re:I saw a different problem (1)

DrXym (126579) | more than 7 years ago | (#19065097)

So does that mean it's not working, wasting my time, AND training me to ignore security warnings?

Yes. As a Vista user I recommend just disabling the stupid thing.

No chicken and the Egg problem here. (3, Insightful)

Goalie_Ca (584234) | more than 7 years ago | (#19063421)

How many unix developers run as root? Probably because it works in the first place! Seriously though.. windows is beyond simple refactoring and I believe that vista is the evidence. The unix model is simple and effective but best yet scales reasonably well. Daemons run as root? No.. nor do they run a joe or bob. Even as sudo, you can still limit what commands you can run. SELinux takes things to a whole other level.

Re:No chicken and the Egg problem here. (1)

simm1701 (835424) | more than 7 years ago | (#19063869)

Most daemons do run as root though - at first.

You the have trust in the competancy of the developers that it will allocate the resources it needs then suid to a lower priveleged user.

Admittedly thats 2 parts - one the OS being designed to let you do that.

Two, having decent developers with well tested products - I know you wont have an issue running apache as root and letting it suid - but how about some unknown piece of software you have never heard of? Will you just run it as root without thinking? Probably not.

Re:No chicken and the Egg problem here. (1, Interesting)

Anonymous Coward | more than 7 years ago | (#19064901)

Unix daemons only run as root in order to bind to privileged network ports and the like then they usually suid() to their own account. So it's rare for a user to run server software under the UID of their own *nix account. The majority of windows software was just never really written for multi user systems and 2006 was a little late for them to be adding their Microsoft patented sudo.

Another advantage of open source code is that if it's being done wrong, someone will notice and educate the developer. I don't even know what the Windows equivalent of suid() is?

I see no spin (0, Redundant)

VirusEqualsVeryYes (981719) | more than 7 years ago | (#19063423)

Is the onus now on the developers to help fix a problem that they did not cause?
I could have sworn I saw spin in that question for a second. I must have been mistaken.

I kinda like the concept (5, Insightful)

Frogbert (589961) | more than 7 years ago | (#19063443)

I kind of like the concept of UAC. I mean the messages are so annoying that hopefully developers will start to avoid getting them pop up.

Hopefully this will cause applications to stay the hell out of the Windows directory, the registry and wherever else they seem to think would be a good place to sprinkle data randomly. I pine for the days of being able to uninstall a program fully from my system by deleting its folder. Or being able to simply copy a configuration file from one computer to the next and having all my settings preserved.

Perhaps I'm forgetting how bad that system was in the DOS days, and I'd welcome people reminding me, but it is looking pretty good at the moment.

Re:I kinda like the concept (2, Informative)

Osty (16825) | more than 7 years ago | (#19063467)

Hopefully this will cause applications to stay the hell out of the Windows directory, the registry and wherever else they seem to think would be a good place to sprinkle data randomly. I pine for the days of being able to uninstall a program fully from my system by deleting its folder. Or being able to simply copy a configuration file from one computer to the next and having all my settings preserved.

Just for the record, you don't have to stay out of the registry if you want to avoid admin privileges. You do need to stay out of the HKLM (HKEY_LOCAL_MACHINE) hive, but HKCU (HKEY_CURRENT_USER) can and should be used for user-specific stuff without requiring extra admin privileges.

Re:I kinda like the concept (3, Informative)

Jeff DeMaagd (2015) | more than 7 years ago | (#19063507)

I pine for the days of being able to uninstall a program fully from my system by deleting its folder. Or being able to simply copy a configuration file from one computer to the next and having all my settings preserved.

I really hate to say this, but this is very similar to how Mac OS X works most of the time. Most programs are installed by dragging the icon into the Apps folder, and most programs are uninstalled by deleting them.

Configuration files are a little more complicated, but transferring all the user settings is very easy too, there is a transfer agent that allows you to copy your apps, files and settings to another computer. I know Windows has a transfer agent, I just used it today, and unfortunately, the Windows transfer agent isn't nearly as good. A lot of the preference settings do transfer if you just copy the Library folder in your home directory, system settings are in /Library. But Migration assistant handles almost all of that, IIRC, the only thing that doesn't transfer are a few software license keys.

Re:I kinda like the concept (1)

Falladir (1026636) | more than 7 years ago | (#19063545)

There are a few programs that work that way in windows. In the FLOSS domain, there's Gobolinux, which does exactly what you request: it puts all the files for a given program in one folder, so that you can remove it by deleting that folder.

Re:I kinda like the concept (1)

dunkelfalke (91624) | more than 7 years ago | (#19063591)

back then the folder was called directory though.

A bit of ridicule (3, Interesting)

earnest murderer (888716) | more than 7 years ago | (#19063639)

Indeed, and I would take it one step further. I'd append to each UAC a description of why it's bad practice. Something like....

Application X is trying to do X. This is behavior typical of malware or virus activity, but can be a product of poor developmet practices.

It isn't going to win any friends, but will certainly bring their ego's into play. Of course if MS really had some balls they'd just make developers live within their install directory. Nothing gets in or out without a open/save dialog, provided by the system of course.

But I also think it's awesome that MS basically absorbed the audio stack. But only because I hate Creative even more than MS. It took 15 years, but incompetent and destructive finally caught up with them.

I suppose, like the US, Microsoft will do the right thing. Once all of the other options have been exhausted.

Re:A bit of ridicule (0)

Anonymous Coward | more than 7 years ago | (#19064081)

So when you actually want to format a drive, you get abused for it.

nice.

Re:I kinda like the concept (0, Offtopic)

AlbertinaJane (978419) | more than 7 years ago | (#19063751)

You should try some of the Linux-based operating systems. Yesterday I installed new Ubuntu. Prior doing that I backed up my root partition (I have /home - something like Documents and Settings - on different partition). I merely copied files to my USB disk. Took like 10 minutes for 8 gigs of data. Then I installed Ubuntu 7.04, hated the fonts, convinced that they're different than in 6.06 (or the rendering is different), I restored my backup back to 6.06. Just copied the files. 10 minutes. In unix world, you usualy just copy the files! No stupid registry things. (Ok, let's forget for a second that there is gconf :( ) Using Debian then and now Ubuntu I have much less fuss than I it with Windows. Ok, I am quite familiar with Debian, so Ubuntu is a breeze, but 7.04 is realy realy realy user friendly! It downloads the codeces and stuff automaticaly, all you have to do is say 'yes, buntu, do it for me!'. Neat! :) The only thing I'm missing from Windows world are games. Yes, there is Quake and UT and likes, but I miss Need for Speed and Age of Empires.... They run under Cedega, but they're unplayable (P4@1.7+768MB+Radeon9600 - those work under WindowsXP quite well). Seriousley, try Ubuntu (or any other distro, but I feel that you'll have least fuss with Ubuntu), and see how thigns are done there. Then, maybe, you'll see why UAC concept is not that good, esp. the way Microsoft implemented it.

Re:I kinda like the concept (0, Troll)

physicsnick (1031656) | more than 7 years ago | (#19064041)

I pine for the days of being able to uninstall a program fully from my system by deleting its folder. Or being able to simply copy a configuration file from one computer to the next and having all my settings preserved.
You do realize you just described Linux, right?

I kind of like the concept of UAC.
So do we. That's why it was invented twenty five years ago. Save yourself the headache, order your free CDs here [ubuntu.com] .

Re:I kinda like the concept (3, Informative)

gazbo (517111) | more than 7 years ago | (#19064225)

Try typing the following commands and reading the output:

ls /usr/lib
ls /etc
You're about to learn about whole new parts of Linux!

Re:I kinda like the concept (2, Insightful)

RotHorseKid (239899) | more than 7 years ago | (#19064283)

You do realize you just described Linux, right?

Now you're kidding. Please explain how do I remove Apache by removing a single directory? Or even something simpler, say, vi?

Re:I kinda like the concept (1)

gbjbaanb (229885) | more than 7 years ago | (#19064293)

I think it goes:

remove: /var/www/ /var/log/httpd/ /etc/httpd/ /usr/httpd /usr/local/sbin/httpd/

then find out where the per-domain configuration has ended up being stored and delete those.

Of course the above only applies to certain Linux distros, others will put their apache (which may or may not even be called httpd) in different directories.

Re:I kinda like the concept (1)

Eideewt (603267) | more than 7 years ago | (#19064581)

su -c 'rm -rf /', of course.

Note: don't.

Re:I kinda like the concept (1)

TheRaven64 (641858) | more than 7 years ago | (#19065441)

It's not Linux, but on this *NIX box I would uninstall vim by doing 'rm /opt/vim7' as root. Anything I install outside a packaging system goes in /opt/{packagename}. It then creates the standard *NIX hierarchy inside there. Of course, it means passing a lot more options to configure (it needs to know where libraries are in /opt, for example), but it does make the system a lot easier to maintain. I would love to see this become the standard install mechanism, since it means installing is just a matter of un-tarring the binary in /opt and removing is just a matter of running rm. Unfortunately, everyone seems more interested in building complex systems for simple tasks.

Re:I kinda like the concept (0, Flamebait)

toadlife (301863) | more than 7 years ago | (#19064533)

I just love it when users of distros like n00buntu try to pretend that they know anything about operating systems.

Gentle Reminder... (2, Informative)

HaeMaker (221642) | more than 7 years ago | (#19064091)

@ECHO OFF
PROMPT $p$g
C:
CD \NWCLIENT
SET NWLANGUAGE=ENGLISH
loadhigh LSL
loadhigh NE2000
loadhigh IPXODI
VLM
CD \

Re:Gentle Reminder... (1)

Nimey (114278) | more than 7 years ago | (#19065383)

Ah, the good old days. :-)

Re:I kinda like the concept (1)

alphamugwump (918799) | more than 7 years ago | (#19064149)

I pine for the days of being able to uninstall a program fully from my system by deleting its folder. Or being able to simply copy a configuration file from one computer to the next and having all my settings preserved.

Modern systems are just too complicated for that. If you've got multiple users, the configuration is going to be scattered around. If it runs as a daemon or has shell hooks, it has to go somewhere too. If your program has any dependencies, it's going to have to install a shared library (DLL) in some system folder. Oh, sure, you could do like a Mac and put your shared libraries in the same folder as your program. But that defeats the whole purpose of having shared libraries in the first place.

Add to that the necessity of security updates, compatability, and so on, and you end up with a full-featured package manager. Which is also simple (sort of), but I wish they would provide an easier way of getting at the debian configuration database.

Re:I kinda like the concept (1)

Ed Avis (5917) | more than 7 years ago | (#19065093)

If the shared library is only used by that program and no others, then it should go in that program's directory.

On the other hand, if it's a DLL that is used by several applications, then this one app has no real business installing it in the Windows directory and especially not overwriting an existing copy of the same library (even with a newer version). There should be a separate package for the library which manages the library's files, and which can be marked as a dependency by any application that wants this library.

Re:I kinda like the concept (2, Informative)

Tom (822) | more than 7 years ago | (#19064173)

I pine for the days of being able to uninstall a program fully from my system by deleting its folder.
http://www.apple.com/macosx/ [apple.com]

Granted, some crap comes with a windos-like "installer", but on OSX you actually "install" most programs by drag&drop to the applications folder, and you uninstall them by drag&drop from applications to trash.

Re:I kinda like the concept (1)

gbjbaanb (229885) | more than 7 years ago | (#19064321)

Unfortunately, if you put files in the Program Files folder, then you need admin privileges.

So, you need to put the 'static' program apps and so in /ProgramFiles and then put your per-user data in either the HKCU registry or in the user's own /Application Data folder.

If they were the 2/3 places you could find an app's files then I think that'd be fine.

Shortcuts and save games (1)

sd.fhasldff (833645) | more than 7 years ago | (#19064543)

I pine for the days of being able to uninstall a program fully from my system by deleting its folder. Or being able to simply copy a configuration file from one computer to the next and having all my settings preserved.

Do you REALLY want your save games to be deleted when you "uninstall" an app?

This extends to all data created by applications, e.g. documents created by your word processor of choice. Clearly, this is bad practice. (User) data and configuration SHOULD reside elsewhere. And that's not even delving into the security issues this would present. You don't necessarily want to share your settings or data with other users of the same computer.

Another thing: Unless you use Windows Explorer (or command line) to navigate to and run a program, you can't uninstall a program FULLY by deleting its folder. At minimum, you would need to delete the shortcut to the program from somewhere else - unless you want Windows to be constantly scanning e.g. the Program Files folder for changes... but something tells me, you wouldn't appreciate that ;-)

In total, we have three separate "components" to even a relatively simple application: user configuration, user data and the app itself. In most cases, the app should be accessible to all users of the machine, whereas neither user configuration or data should - in most instances, anyway (I would love for Picassa to be identical, including settings and data, for all users on the "family" computer). Ideally, these components would be be located in predefined locations (can anyone say "My Files"? No, not "My Documents", "My Files"), easily locatable by the user. Yes, that means burying them in the registration database (die!) or under "C:\Documents and Settings\[User Name]\Application Data\[Program Name]\" (or the equally horrendous Vista version of it).*

A properly behaving uninstall program should delete the application (completely, not leave a friggin' empty folder or random "I was here" file) and PROMPT for deletion of configuration - and possibly data.

*Note that many of the problems associated with multiple users on a single WINDOWS system would be at least mitigated by introducing a "home" folder. This would have been an obvious feature to implement in Vista, but no such luck.

The ONLY correct answer in this whole conversation (-1, Flamebait)

Anonymous Coward | more than 7 years ago | (#19063447)

is... (fanfare) not make Vista in the first place! Oh well, too late.

Admin-level privileges (5, Interesting)

Xiroth (917768) | more than 7 years ago | (#19063451)

Hmm, I'd say he's got a good point - there's simply not a culture of privilege awareness in Windows developers.

Perhaps Microsoft should set up an audit unit and start giving software a 'UAC-compatible' tick if a piece of software has minimised how much UAC approval is required if its turned on, allowing the publisher to put it on their box so that the customers can tell. Who knows, perhaps one day the UAC system might actually be viable.

Re:Admin-level privileges (2, Funny)

TENTH SHOW JAM (599239) | more than 7 years ago | (#19063511)

Hmm, a software company approves another software company's software.

Nope. Can't see it happening.

Re:Admin-level privileges (0, Offtopic)

Threni (635302) | more than 7 years ago | (#19063755)

> 10 ? "All hardware is crap, all software is crap, all users are crap."
> 20 GOTO 10

Shocking. You should try and avoid gotos unless you can't.

while (true)
    ? "All hardware is crap, all software is crap, all users are crap."
wend

or

do while (true)
    ? "All hardware is crap, all software is crap, all users are crap."
loop

or

for (;;)
  printf ("All hardware is crap, all software is crap, all users are crap.\n");

It's hard to pick any faults in your sentiments, however.

Making a statement (1)

fwarren (579763) | more than 7 years ago | (#19064643)

Hey, he was BASICly making a statement.

Re:Admin-level privileges (2, Insightful)

Osty (16825) | more than 7 years ago | (#19063543)

Perhaps Microsoft should set up an audit unit and start giving software a 'UAC-compatible' tick if a piece of software has minimised how much UAC approval is required if its turned on, allowing the publisher to put it on their box so that the customers can tell. Who knows, perhaps one day the UAC system might actually be viable.

In theory, that already exists [msdn.com] . In order to use the "Certified for Windows Vista" logo on your software, you have to play nicely with UAC.

Re:Admin-level privileges (2, Interesting)

280Z28 (896335) | more than 7 years ago | (#19063559)

Hmm, I'd say he's got a good point - there's simply not a culture of privilege awareness in Windows developers.

Perhaps Microsoft should set up an audit unit and start giving software a 'UAC-compatible' tick if a piece of software has minimised how much UAC approval is required if its turned on, allowing the publisher to put it on their box so that the customers can tell. Who knows, perhaps one day the UAC system might actually be viable.
That is actually THE first requirement listed in the Certified for Windows Vista Logo Technical Requirements [microsoft.com]

Re:Admin-level privileges (1)

Jeff DeMaagd (2015) | more than 7 years ago | (#19063729)

Software requiring admin privileges is a problem. I think it's irritating that user-type software requires admin settings to work. That makes idiot-proofing a computer a lot harder.

I think it is a carry-over of the 16 bit Windows compatibility though, from the 9x series to NT series Windows. For 9X, there were no security considerations like this, and for NT series, compatibility seemed to require admin rights, and developers didn't change their programming practices because they didn't have to.

Re:Admin-level privileges (1)

Dachannien (617929) | more than 7 years ago | (#19063883)

Perhaps a better way to address at least part of the problem would be to have a special compiler option in Visual Studio that's turned on by default in debug configs. The option would cause a dialog box to be displayed anytime a folder or registry subtree is accessed in a way that a non-admin user would be denied access.

Yeah, it wouldn't help anyone who's not developing in Visual Studio, and it wouldn't help anyone at this point who neglected to patch their copy of VS. But at least it would provide helpful guidance to some people for working with a system that has changed significantly (and, quite honestly, for the better) from previous versions of Windows.

Re:Admin-level privileges (2, Insightful)

ocbwilg (259828) | more than 7 years ago | (#19064889)

Perhaps Microsoft should set up an audit unit and start giving software a 'UAC-compatible' tick if a piece of software has minimised how much UAC approval is required if its turned on, allowing the publisher to put it on their box so that the customers can tell. Who knows, perhaps one day the UAC system might actually be viable.

That's great and all, but they already do something similar. Ever see a shrink-wrapped box at the store with the "Designed for Windows" logo on it? Part of the logo testing is that the app is supposed to work with limited user rights. The problem is, the overwhelming majority of Windows software isn't sold in a shrink-wrapped box, so most software vendors don't bother with logo certification.

Hmm, I'd say he's got a good point - there's simply not a culture of privilege awareness in Windows developers.

Absolutely. It is nearly 100% the developers fault. Though I suppose some share of blame goes to IT departments for not making it clear to their software vendors that applications shouldn't require admin rights to run.

The security model is all wrong.. (5, Interesting)

QuantumG (50515) | more than 7 years ago | (#19063607)

on Windows, on Unix and on OS X.

The problem on Windows is that it is a single user operating system with delusions of being a multi-user operating system.

The problem on Unix is that it is a time sharing operating system which people inexplicably use as a workstation operating system.

The problem on OS X is that there are no serious threats, so no-one has any idea if their security model does anything because it never gets tested.

And the problem with all three of them is that they assume that the program will always do what the user wants and therefore the program should inherit permissions from the user. On Windows that was never true. On Unix it was only true back when all users were developers and had enough time to read the source code to all the programs they ran and thus felt they could trust them. On OS X it was actually true because, again, no-one writes malware for OS X.

The security model should be, quite simply: the program has a manifest that declares what permissions it needs with a fine granularity. The permissions should be placed into a hierarchy. For example: writes to disk -> writes to user files -> writes to user files of type X. The user should be able to inspect these permissions to determine if they are acceptable. If they are not, then the user should be free to uncheck "required" permissions.. the program should still run but those functions of the program which invoke a required permission should cause a prompt. The prompt should give the option to deny the request, or fake the request so it appears to the program that it completed successfully.

And yes, developers should use this mode.. and they would, because it is actually useful instead of just being a pain.

Re:The security model is all wrong.. (0)

Anonymous Coward | more than 7 years ago | (#19063889)

SELinux is one effort to correct that problem.

Won't work (4, Insightful)

iangoldby (552781) | more than 7 years ago | (#19064035)

That won't work for the same reason that the current Windows security model doesn't work.

It's too much trouble.

I believe this is one of the main reasons why UNIX applications generally do not play fast and loose with permissions. The security model is very simple. A process is owned by the account most suitable for the role it will perform. There's no need for complicated LPSECURITY_ATTRIBUTES structures. (And yes, I do think that even those are too complicated for most purposes, so you can guess what I think of the more esoteric aspects of Windows security tokens.)

Be honest, if you program for Win32, how many times have you just passed NULL as the first parameter of CreateEvent()?

If you want to make people do the Right Thing, make the Right Thing easier to do than the Wrong Thing.

Re:Won't work (3, Interesting)

iang (144697) | more than 7 years ago | (#19064341)

Actually, passing NULL as the first parameter of CreateEvent is almost always the right thing to do.

Of course the vast majority of developers don't actually know that - they just pass NULL out of laziness. But it turns out that if you spend the time it takes to learn the intricacies of the Win32 security model, you'll still end up passing NULL once you understand what's happening.

You just get to feel smug about it.

Re:The security model is all wrong.. (1)

Tom (822) | more than 7 years ago | (#19064151)

And the problem with all three of them is that they assume that the program will always do what the user wants and therefore the program should inherit permissions from the user.
Bingo!

Where is my "run this program but don't give it access to any of my data" option? That is something I want and that users will understand. Explicitly granting permission to syscall 0x6f03a4b loopback technobabble nonsense does not and never will fly with users who feel more intimidated than protected. Granting "permission to accept your personal data" is more like it. So run everything in a sandbox unless I explicitly allow it to read my files. Once. Because we all know that if I've given root/user/whatever to a program once, there are a billion tricks a piece of malware can and will use to make sure it keeps that access level.

Re:The security model is all wrong.. (0)

Anonymous Coward | more than 7 years ago | (#19064983)

Want to sandbox something? Run it under a VM!

It's not the developers problem to account for every eventuality. At the other end of the scale, user software should NEVER require superuser privileges to install.

Over complicated security models fail, this is why unix (outside large corporates) still commonly uses basic file permissions instead of ACL's. Learn the lesson.

Re:The security model is all wrong.. (0)

Anonymous Coward | more than 7 years ago | (#19064633)

The problem on Unix is that it is a time sharing operating system which people inexplicably use as a workstation operating system.
Hey, some of us actually use Unix as a multiuser operating system. At least 11 other people, by my last who.

Re:The security model is all wrong.. (1)

tulcod (1056476) | more than 7 years ago | (#19064819)

Now, let's start off by complaining that you've said that there's no malware for OS X twice, but the same is true for linux.
selinux can perfectly help sandboxing your applications. There is no point is some kind of sophisticated interface for it on windows, as that would mean you'd mean to choose before running an application, which most people don't care about, thus just enable everything.
the system is wrong at the core. i'm typing this message from a school PC. there's no illusion on it (too poor? i guess so...), so they've "taken" all my rights, practically. That just means you have no access to the control panel. I type in dvorak, and i can only switch the keyboard layout using dvassist. that is just some small program i'v put on my usb stick and run as user with nearly any rights. dvassist changes the layout, deletes qwerty layouts (i don't really like that part, but meh), and even after rebooting, the pc is still set to dvorak (though there's a feature in dvassist to switch back, happily).
to make things clear: some small program anyone can download from sourceforge works around the security model and writes directly into the windows registry. now, is that a good thing?

windows' security system is wrong at the core, not the interface

Re:The security model is all wrong.. (1)

Verte (1053342) | more than 7 years ago | (#19064821)

You're missing the multi user point. The great thing about having more than one user is you can have a program run as it's own user, without write access to anything [but its home directory], and without read access to anything personal or private. If permissions were as complicated as you say, installers would set them, and people wouldn't look and correct them.

But then how do programs write to the home directory of the calling user? I'd like to see standardised save-as boxes and such that handle passing that sort of permission, and any other attempt at writing outside the permissions of that program should be interrupted and a query sent to the user. And then, to simplify things, it would be nice to pass EROS style capabilities to programs permanently, so they don't need to explicitly request access to other things they may need.

Though, once you start restricting things like that, you need a whole new model for IPC and such... and I don't think we're ready for that yet.

A simpler solution exists. (1)

master_p (608214) | more than 7 years ago | (#19065017)

There is a simpler solution: virtualize the O/S for users. Let users play their own version of the O/S, but without a problem for the other users.

Microsoft should have done that right from the start, because their O/S was single user from the beginning.

Another idea is that of protection rings, similar to 80x86 architecture: let each system resource belong in a ring, and allow access to resources only from privileged rings; access less privileged rings only through secure predefined gates. The nice thing with this is that, since it is implemented in software, there is no restriction to the number of rings available.

With this approach, applications that receive data from the network could run at a higher ring from the rest of the applications, and thus they could never touch user data (let alone kernel data).

Re:The security model is all wrong.. (2, Informative)

DrXym (126579) | more than 7 years ago | (#19065177)

The security model should be, quite simply: the program has a manifest that declares what permissions it needs with a fine granularity.

That would be called SELinux and is turned on in Fedora Core.

Writing policy files either as a user, admin or even developer is hellishly difficult. FC has been messing with SELinux policies for years before getting it right. It almost requires an interactive mode where the policy can be "trained" by running the app a multiple times to see what registry / folder / files it needs access to and then ensuring that the policy enforces it.

They're half-right (2, Insightful)

Durandal64 (658649) | more than 7 years ago | (#19063609)

Is there an onus on developers to actually write code that's aware of privileges? Absolutely. Windows developers have gotten a free ride with respect to access rights for a long time, but that party's over. But can Microsoft just throw up their hands and say "Okay guys, it's on you now"? Absolutely not. The reason developers have gotten away with this for so long is that Microsoft's own conventions and practices encouraged this. Users were set up with root-equivalent permissions by default, and there was no authentication mechanism in place (and there still isn't).

Microsoft should've deprecated UAC heuristics and put a time limit on them. They should've given developers a year (or so) to update their applications to be aware of privileges, and then simply remove the UAC heuristic features that "guess" whether an application needs privileges. So if you run an installer built for Windows XP, it doesn't get the right privileges without you explicitly launching it with admin rights.

Re:They're half-right (1)

physicsnick (1031656) | more than 7 years ago | (#19064065)

They should've given developers a year (or so) to update their applications to be aware of privileges
They did. Vista was in beta-testing for a long time.

Re:They're half-right (5, Interesting)

chaboud (231590) | more than 7 years ago | (#19064355)

Note: I'm normally a Microsoft defender here, but I've spent too much of the last eight months dealing with Vista breaking-changes. Onto the rant...

This is such utter nonsense. UAC first came in, IIRC, in Beta 2 (May), but there were far too many problems with Vista over the beta/RC cycle to be workable. UAC was too annoying to leave turned on while trying to figure out the real bugs. UAC is still awful over remote desktop on a slower connection, as it blanks the screen. This cycle was nothing like the 2k or XP cycles with regards to beta and RC stability and direction.

One of our long-released apps went through this:

Beta 1:
Some draw issues, crashes on exit.

Beta 2:
Some draw issues, just fine.

RC1:
Some different draw issues, crashes a helper process on startup, then a second crash, completely, app dead.

RC2:
Some completely different draw issues (others gone), otherwise fine.

Release:
Same draw issues as RC2, crashes a helper process on startup, annoying help pop-up for any plug-in expecting old-school help to be available.

This was a released app for which the shipping bits did not change, at all, over the Vista cycle.

Now, it gets worse with UAC, because there are things that get more restrictive when the user gets sick of UAC and turns it off. The most obvious example is the "can't write to the TEMP folder" defect (by design? The designer is defective.). This kept several installers from working properly. If the user shuts UAC off, apps can no longer write to the TEMP directory and run their expanded installer app (winzip installer approach). This means that getting tired of UAC and pulling the plug on this behavior still interferes in the use of the system. In this case, it will hand the user a cryptic error message and no direction.

They went down this road with things like broken file-sharing and remote-desktop access with no-password accounts in XP, and it continues throughout Vista. Users of Microsoft products are regular victims of hidden behaviors, where seemingly simple changes can have much-delayed distant results.

Microsoft once cared a great deal about backwards compatibility. Now they seem to expect all software vendors to re-code, re-compile, re-test, and re-deploy for an OS change, and that OS was a moving target for the year preceding its release.

We're handling it, but what happens to the software that was orphaned by companies that died (or moved to a different platform)?

Re:They're half-right (1)

ocbwilg (259828) | more than 7 years ago | (#19064931)

Microsoft once cared a great deal about backwards compatibility. Now they seem to expect all software vendors to re-code, re-compile, re-test, and re-deploy for an OS change,

Yes, that's true. This was also the time when Microsoft didn't give a rat's ass about security. Unfortunately they kept getting raked over the coals for having glaring security holes, so they are focusing more on creating an environment that is/can be/should be more secure, and as a result developers who've been able to code however they want to for years actually have to buck up and learn about coding to the new standards.

As someone who has had to admin large Windows installations (both client and server) by far our most difficult task was keeping users from running with full admin rights on their desktop. Why should that be the case? Sure, with Windows 95/98/Me there was just a single access level - admin. But since the days of NT4 (and presumably 3.5 before that, though I never used it) there have been user accounts available with varying levels of permissions going from a standard, limited user to full admin rights. Why is it that 12+ years later we're still fighting with applications that "require" admin privileges to run for no other reason than poor coding practices?

If I'm not mistaken, since the days of Windows 95/NT your application actually had to function correctly as a limited user in order to get the "Certified for Windows" logo. Of course, that probably only applies to the 5% of commercial applications that are sold in a box, while the rest never go through a logo compliance test at all. I can't tell you how much time I've spent on the phone with software vendors (usually for niche apps in the healthcare space) trying to a) convince them that it's important that their app run without full admin rights, and b) find out what restricted system areas their applications write to so that I can modify permissions in order to get their app to work without giving away full rights. It's ridiculous. Even if IT could have a policy whereby we won't approve any application for use in our environment that won't run as a restricted user, we would inevitably be overruled when that new killer app from the leader in the marketspace dazzles our CEO with grand new functionality. What's worse, the app vendors can get away with it because NOBODY is coding to LUA standards.

and that OS was a moving target for the year preceding its release.

Uh...yeah. That's why it's called a 'beta' or a 'release candidate'. That means that the code isn't set in stone, it may have serious flaws, and it is subject to change on a daily basis. If you can't or don't want to write code for a 'moving target' then wait until gold code is available. Sure, your competitors who can write code for a 'moving target' will undoubtedly have a market lead over you, but that's the breaks.

The truth is, it sounds like you guys did a good job of staying on top of issues that your application might have had with Vista. And since the problems that showed up in the gold code were the same as had showed up in previous versions of the code, you no doubt already knew how to fix them. And since the code went gold and was available to you (via MSDN) in November of 2006, even though Vista wasn't released to retail until February of 2007, I would submit that you had plenty of time to work out the issues and that your complaining is just for the sake of having something to complain about.

Re:They're half-right (1)

pedestrian crossing (802349) | more than 7 years ago | (#19065161)

Even if IT could have a policy whereby we won't approve any application for use in our environment that won't run as a restricted user, we would inevitably be overruled when that new killer app from the leader in the marketspace dazzles our CEO with grand new functionality.

Sadly, this is so true. Also, when the vendor out-and-out lies about these issues to make the sale. Lesson learned - if it isn't in the contract, anything the vendor told you means jack.

...find out what restricted system areas their applications write to so that I can modify permissions in order to get their app to work without giving away full rights.

Regmon and Filemon are your friends here. It's still a pain in the ass, but it is possible. Most of the time you just need to modify ACLs on a few select reg keys, but sometimes it's something totally asinine, like needing write permissions to system32...

Re:They're half-right (1)

MikShapi (681808) | more than 7 years ago | (#19065103)

>> Microsoft should've deprecated UAC heuristics and put a time limit on them.
They did.

NT domains running environments where users are not trusted and do not have permissions to modify the system have been around for over a decade. That was also roughly when the windows equivalent of /usr and /home appeared.
Microsoft software has been properly using these for all this time, setting proper example.
Vista was in beta forever. Any software vendor that was caught by surprise by the instatement of UAC should take his head out of his ass and figure out what kept him in his cozy cave for the last couple of years.

UAC is good - if you understand it! (5, Interesting)

hexed_2050 (841538) | more than 7 years ago | (#19063711)

Once people start to understand UAC and how it works, people will begin to harness it and accept it rather than shun away from it.

UAC allows administrators to be logged in 24/7 without having 20+ privileges until the actually need that power. 99% of the time UAC will strip the administrator privileges away from the administrator and grant them with 6 SeXXX privileges to work with. It does this by using two different tokens instead of one. The first is a normal user token, and the second is the real administrator token. When you see that screen where UAC asks for elevation, that's when Vista will grant you the administrator token. Don't believe me? Type "whoami /priv" in a normal shell under the administrator logon. Now open up a shell using "Run as administrator" and type "whoami /priv".

Vista isn't the shining example of everything secure, but it sure is lightyears ahead of XP and a real good step in the correct direction. Windows users will whine and gripe about it, but they will eventually have to go through the same stuff the *nix crowd did along time ago when people were logged in with root 24/7.

If you require Vista to elevate you with certain apps, then create a .manifest file and place it in the same directory as the .exe. The manifest file is just an xml file that tells Vista that the .exe will require administrator privileges to run (queue UAC.) Google "vista manifest" or check this out for more information: http://channel9.msdn.com/Showpost.aspx?postid=2112 71 [msdn.com]

Enjoy..

h

lah (0)

Anonymous Coward | more than 7 years ago | (#19063759)

UAC reminds me of car insurance... its like limited liability or whatever...
You get pulled over for speeding, get asked if you have Insurance(click yes), you give your card and you're ok, ticket aside.
But when you rear end a new M3 BMW... that shit changes... REAL Quick...

And Ive seen graff scrawled clearer than that goddamn word in the "Please type this word in the image" picture... fuckin dammit!

uhmmm... (1)

SuperDre (982372) | more than 7 years ago | (#19063847)

A lot of people say that unix version is better, but is it? how many consumers actually work with unix.. none.. How many virusses/malware are there for unix.. very little... The fact is that people who work with unix mostly know what they are doing.. UAC isn't bad, but needs some adjustments, but hee, it's the first version, so there's bound to be adjustments.. A lot of people here forget that UAC is for normal people who don't know jack about computers, and not really intended for people who know what they are doing (at least think they know)..

I like UAC, personally (4, Interesting)

Anonymous Coward | more than 7 years ago | (#19063945)

I've spent the last eight years of my life packaging and deploying apps for Corporate environments.

In none of those environments were the users Administrators (or even Power Users). I have written a few scripts and applications to work around some issues, but in general, it is a case of setting the appropriate permissions in HKLM and \Program Files\. It takes some work, but I have only ever had one seriously intractable application.

For the past 4 years I (and my family) have run primarily as users on our home PCs. Its a bit of a pain in XP, and I wrote my own Privilege escalation tool to make some things easier, but again, it is now pretty smooth. Even games work as users, with the appropriate settings. Vista (on my new laptop) is far easier, and no less frustrating than Kubuntu, which is always asking me to sudo an elevated operation.

UAC is a good thing - it's smart, and as developers get with the program, will add protection (not frustration) for users.

Another non-issue (4, Interesting)

alphamugwump (918799) | more than 7 years ago | (#19063979)

Rather than ask the user for permission on every operation, what other ways could Microsoft have improved Vista's security?

What's wrong with asking the user for permission on every operation? That's what my linux box does. It's called "su", and it makes me type in my password to make system changes. In fact, that's what every real operating system has ever done. Welcome to the real world.

A major reason for the "insecurity" of windows, IMHO, is the culture of its users. You get people who still remember 95 and 98, (and DOS) and who like to run everything as root. They don't want to be bothered with those nag boxes. But nag boxes are what it takes to secure a system. Security requires some effort on the part of the user, too. Funny how things work like that, isn't it?

See, in the beginning, a single user OS was perfectly OK. Even if you hooked your DOS machine up to the internet, it was probably a terminal, not as a computer in its own right. And really, they had so little RAM that a full-on operating system like linux would be massive overkill. A cell phone is a multimedia powerhouse compared to those machines.

But the microcomputers got bigger. They got a networking stack. People started using them like real systems instead of big, featureful, programmable calculators. They went mainstream, too. But the mindset of the users and developers was (and still is) somewhere way back in the 80s. The developers have gotten better; they add in UNIX features with every windows release. But the users, for the most part, just want to buy a box from Dell and have it work out of the box, like an appliance. Which is a fine thing to want, but those same users are also the kind of people who will install the purple monkey, become phishing victims, run binaries they got off P2P, and so on. And unless Microsoft locks people out of their own computers, there's not a damn thing they can do about that.

So while it was acceptable to bash Microsoft back in the day (no firewall, single-user mode, instability, etc), most of these problems have been fixed. Oh, sure, Windows is no OpenBSD. It's kind of kludgy, compared to linux, or OSX, or your *NIX-like system of choice. But at this point, if your system gets hacked, its probably your own dumb fault. Anymore, if you whine about windows without mentioning specifics, you just end up looking stupid, not 1337 and educated.

No, I am not a Windows fanboy. I don't dual boot, either, although I do use VMWare when I absolutely must. But it still pisses me off to see such obvious bullshit. Some of it is Apple propaganda, but a lot of it is propagated by windows users themselves. Which is understandable, I suppose, but not particularly productive.

Re:Another non-issue (1)

slittle (4150) | more than 7 years ago | (#19064297)

What's wrong with asking the user for permission on every operation?
Because they're morons, don't/can't/won't understand and/or simply don't care, they just want it to work, now, no matter what the consequences. When it stops working they'll call the 10 year old kid next door or get a new computer.

OTOH,

See, in the beginning, a single user OS was perfectly OK.
That's the problem: most Windows systems are still single (physical) user machines; they don't have (half-)clued in admins to manage them on the user's behalf, and they don't have other users to infect. Having escalated privileges on a computer with only one real user doesn't really gain an attacker very much. You can still spam, worm, phish and generally annoy the rest of the internet without elevated privileges. But Microsoft still gets blamed for it. So in reality, asking the user every 5 seconds for confirmation has less to do with privilege escalation and more to do with trying to make the user think about what they're doing.

Re:Another non-issue (0)

Anonymous Coward | more than 7 years ago | (#19065223)

> if your system gets hacked, its probably your own dumb fault.

WTF?

Windows relies on RPC whereas I'd never dream of running a portmapper on any of my linux boxes (no need for NIS or NFS). You can't blame users for the hodge-podge of 3rd party technologies that Microsoft has implemented and 'improved' (made proprietary), especially when they're required in order to run the OS. MS just released patches for critical RPC vulns this week, was this the 'dumb fault' of end users?

Remember when Windows received security certification - so long as it wasn't connected to a network. It should be obvious that there are serious design problems with Windows and all the band aids are starting to make it unusable. Confusing granny with security popups isn't enhancing security when it's the underlying architecture that's flawed.

UAC is generally a good thing. (2, Insightful)

Kaenneth (82978) | more than 7 years ago | (#19064019)

UAC is pretty much essential to meet the mutual goals of:

a) run old software designed for prior windows versions.

and

b) be secure.

You might want to allow, for example, an online game to delete files IF those files belong to the game, and only to the game, like obselete maps, sound files, etc. But you don't want someone to exploit a bug in the game online to hose your system; like the bug I found in Counterstrike (old version, long fixed) where putting "%D%D%D%D%D%D%D" as your playername would crash it out (classic printf issue).

You could possibly run an app in a VM 'sandbox', but that idea breaks down as soon as you try to cut-n-paste from one app to another, or two apps want to write files in the same directory... what should it do then, prompt for Cancel/Allow for each breach of the sandbox? or have the user define complex sets of which applications are allowed to talk to each other? I did that for a Linux setup, I made seperate accounts for each service, one for the Fax receiving, one for Apache, one for each instance of the DVR simulator, one for DistCC, one for web browsing... and configured them for exactly, and only what access each needed; the Fax could put files into a directory to be served by Apache, but could not touch the templates and other pages, and nothing Apache did could touch the Fax archive and configuration, each simulated DVR had its own IP address, and couldn't see the others except via network packets. It was terribly complex, and done as a learning experiance. because everything worked perfectly when run as one user, or if p[ermissions were opened up, but it took months of spare time to get all the permissions exactly right as seperate users.

  Unless you can be absolutly sure that EVERY action a program may take is approved, it needs to be controlled. As apps get fixed up, and Vista gets service packs or whatever to improve support for specific apps, the issue will fade, but never be completely gone, because sometimes, it'll save the users ass.

Why is Microsoft asking questions on Slahsdot? (1)

jkrise (535370) | more than 7 years ago | (#19064039)

Rather than ask the user for permission on every operation, what other ways could Microsoft have improved Vista's security?

Excuse me, how would such a knowledge help anyone but Microsoft developers? No one but those developers have access to source code, certainly not Slashdot readers.

The fundamental problem with Windows Security architecture is that the Operating System thinks it is better, wiser and more powerful than the user. In Unix, the user is the boss.

If admin users can examine every single running process themselves, and there are no obscure registry settings, binary blobs, TPM, DRM and other 'heuristic' aka guesswork techniques to deal with.. the system can be made secure. The reason is simple: If there is a malicious code that is poisoning the system, the root user can examine it and simply delete it.

The only exception to this rule would be rootkits... and by rugged designs like SE Linux, removal of LKMs, etc. the possibilities for such rootkits can be minimised largely.

And finally, if there exists a simple mechanism for restoring an entire filesystem with file level backups (on separately dsignated partitions for instance), ease of restoration is guaranteed in case of security breach. Windows Vista's System State image rollback is simply more complexity without any added benefits from the simple tar command.

If Vista must be really secure, the registry has to be removed, the device drivers must be open source, the entire OS kernel must be available free for inspection and rectification, the DRM, TPM and PVP kludges must be knocked out... in short Windows should be a mere operating system. I bet that every single OS developer at Microsoft realises the above truth... they're just trying to create a situation where the market tries to follow their Defective by Design philosophy.

Re:Why is Microsoft asking questions on Slahsdot? (1)

physicsnick (1031656) | more than 7 years ago | (#19064107)

Excuse me, how would such a knowledge help anyone but Microsoft developers? No one but those developers have access to source code, certainly not Slashdot readers.

Should we not help Microsoft developers, just because this is Slashdot?

Some people are interested in the problem and in how to fix it. Believe it or not, some people actually like Windows.

I'm certainly not one of those people; I've been using Ubuntu for two years. I'm just saying, they exist, hence the question. Besides, even if we're not Windows users, most of us would like to see Windows more secure; everyone would benefit from having less botnets around.

Re:Why is Microsoft asking questions on Slahsdot? (1)

jkrise (535370) | more than 7 years ago | (#19064179)

Should we not help Microsoft developers, just because this is Slashdot?

Please read my post in full. Every single Microsoft developer knows, or definitely ought to know... that UAC is a piece of junk. The insecurity with Windows is inherent.... the OS, or Microsft or Bill Gates.. ow whoever made that design decision... think that they own YOUR computer. It is impossible to secure the operating system as long as this fundamental issue is resolved.

Since this is a design decision taken at the very highest levels in Microsoft, it is futile to debate the issue on Slashdot.

Re:Why is Microsoft asking questions on Slahsdot? (3, Insightful)

iang (144697) | more than 7 years ago | (#19064595)

I don't think Microsoft are asking. I wrote the blog entry the question refers to, and I don't work for Microsoft, nor was I acting on their behalf. (And I don't imagine I've made myself any friends in Microsoft with that blog entry.) I know the guy who submitted the question to Ask /. (MythMoth) - he doesn't work for Microsoft either. In fact as far as I know he mainly runs Ubuntu these days, and he's been a Java developer for years.

My motivation is pretty simple: I think it sucks that lots of apps have problems if you run as a non-admin user. As an application developer myself, I know that if applications are broken in this way, there is basically nothing Windows can do to fix that. (The same would be true of Linux - it would be trivial to write an application that refuses to run properly unless it's running as root. It wouldn't be Linux's job to fix that apps problems would it?) Yes, the fact that the culture grew up this way is Microsoft's fault. But I want the culture to get better. So my goal was to encourage developers write apps that work properly for non-admin users.

On another note, you've said something that doesn't seem to apply to any version of Windows I'm familiar with:

"The fundamental problem with Windows Security architecture is that the Operating System thinks it is better, wiser and more powerful than the user. In Unix, the user is the boss.

The user is boss in Windows. If you're the admin of a Windows box, it'll let you do anything, including shooting yourself repeatedly in the foot if you so choose. To give an example that's relevant to the point at hand: an admin can choose to turn off UAC. (A bad choice, IMO, but Windows certainly won't stop you making that choice.) That's just one tiny example of course - one amongst thousands. The admin is in complete control of his or her machine.

(Of course, if the admin doesn't know what he or she is doing, then this 'control' will be purely hypothetical. Being an admin merely makes it possible to control everything, but to achieve that in practice does require you to know how to achieve what you're trying to achieve. And Windows does put up the odd road block to discourage you from doing certain particularly egregious forms of damage to your machine, so if you're not an expert user, you might mistakenly conclude that you're not in control. But the bottom line is: if you're the admin, you can circumvent any of these because you are, ultimately, in complete control of your machine.)

Can you point to a single concrete example of where Windows "thinks it is better, wiser and more powerful than the user"? I've been using Windows for almost as long as I've been using Linux. (12 years and 15 years respectively.) I can't think what you might be referring to - could you be specific please?

One could make a case that Windows should behave as you're suggesting it does. (I personally don't think it should, but I can see there's an argument.) After all, the vast majority of home users are entirely unqualified to "examine every single running process themselves". But for better or worse, if someone walks into a shop and buys a PC they are the de facto administrator of that box, whatever OS it might be running, and regardless of how well qualified they might be for that task. You could argue that if Windows was as authoritarian as you are suggesting that we might have fewer zombie Windows boxes out there, because end users wouldn't be empowered to hand over control of their machines to botnets. (It's pretty well documented that enterprise that don't let end users run as admin just don't have the security problems Windows is famed for.)

I wouldn't actually want it to work that way though. While I don't run as root most of the time, it's important to me to be able to control my box. Which is exactly how it is. So I'm surprised by what you've written.

Re:Why is Microsoft asking questions on Slahsdot? (1)

jkrise (535370) | more than 7 years ago | (#19064747)

I don't think Microsoft are asking. I wrote the blog entry the question refers to, and I don't work for Microsoft, nor was I acting on their behalf. (And I don't imagine I've made myself any friends in Microsoft with that blog entry.) I know the guy who submitted the question to Ask /. (MythMoth) - he doesn't work for Microsoft either. In fact as far as I know he mainly runs Ubuntu these days, and he's been a Java developer for years.

Thanks for taking the time to post a rejoinder. My query wasn't on your identity, but on the utility of getting an answer to your question. How does it help anyone if UAC is a developer's fault, the marketing guy's vision fault, or a Segmentation Fault ;-)?? The only people with power to engineer the OS are the developers, and they are driven by their marketing bosses. Hence the title of my post.

But I want the culture to get better. So my goal was to encourage developers write apps that work properly for non-admin users.
Culture is something that gets built-ip over time... in this case, a couple decades. I dont think it can be changed by an Ask-Slashdot query. If Microsoft decide to jettison legacy support, and start afresh the Unix way, the entire IT culture - developer to end user - would see a sea-change, but I'm not holding my breath, after seeing Vista and UAC.

"The fundamental problem with Windows Security architecture is that the Operating System thinks it is better, wiser and more powerful than the user. In Unix, the user is the boss.
The user is boss in Windows. If you're the admin of a Windows box, it'll let you do anything, including shooting yourself repeatedly in the foot if you so choose.


I believe in Vista, even the Admin user is restricted... the Operating System is the boss. One can't install an unsigned driver, even if it is the intended action, with Vista. I believe there are numerous other examples where this is true.

Can you point to a single concrete example of where Windows "thinks it is better, wiser and more powerful than the user"? I've been using Windows for almost as long as I've been using Linux. (12 years and 15 years respectively.) I can't think what you might be referring to - could you be specific please?

Why, I thought it would be obvious to anyone who's used Unix-like systems for a year, let alone 15. If I install ANY FLAVOUR of Linux in a 4GB partition, and I copy that entire partition to a spare partition using the simple 'tar' command... I can rest assured that if the OS crashed, it's a simple matter of running a 'tar' command to get it back working - WITH ALL APPLICATIONS, SETTINGS etc. INTACT. Try doing that with Windows.... ANY version.

I wouldn't actually want it to work that way though. While I don't run as root most of the time, it's important to me to be able to control my box. Which is exactly how it is. So I'm surprised by what you've written.

You have misunderstood me. The first thing a Unix user does, is to create an account and a home directory, and work with that. But THE POSSIBILITY of logging as 'root' and seeing everything that's going on still exists. In such an environment, it is not practical to hide malicious programs so easily, as with Windows. And therein lies the reason why the Unix philosophy of empowering the user, wins easily over the Windows philosophy of asking for a million passwords and prompts... lulling him into a false sense of security.

Re:Why is Microsoft asking questions on Slahsdot? (1)

NekoXP (67564) | more than 7 years ago | (#19064857)

Why, I thought it would be obvious to anyone who's used Unix-like systems for a year, let alone 15. If I install ANY FLAVOUR of Linux in a 4GB partition, and I copy that entire partition to a spare partition using the simple 'tar' command... I can rest assured that if the OS crashed, it's a simple matter of running a 'tar' command to get it back working - WITH ALL APPLICATIONS, SETTINGS etc. INTACT. Try doing that with Windows.... ANY version.


Wow, that's not even slightly close to a good example of what you said.

How is Windows thinking it's "wiser and smarter" than the user by not allowing you to tarball your OS and restore it that way?

You do realise, too, that tarballing your OS isn't going to give you a true backup if you are using ANY filesystem that uses ACLs, custom metadata or whatever.

I dare say there is no archiver on the planet that will properly take and restore an XFS or UFS2 partition in Linux, BSD or so on, and take all the data with it, and whatever that tool is if it does actually exist, it's certainly NOT fucking 'tar'.

As a sidenote, with the right options and a bit of ingenunity and a small script, you can use something like WinRAR to perform a tarball backup of your system - it will gladly pull in all the NTFS extra data like security descriptors and multiple data streams from the filesystem and store it in the archive. You simply then need to set the permissions correctly when you restore, for files which are ostensibly completely hidden from the user and WinRAR's file dialog - important, nasty files which if they were present for the rest of the system to touch, would explode your system in an instant (or at least the next boot)

Windows Vista comes with some tools in the admin kit, which will make something akin to a squashfs filesystem image of a system and keep all permissions on it. As part of the installer process of Vista, you can actually take files from this compressed filesystem 'image' one-by-one, you can add files in, and you can restore a system to your exact specifications - even to the point that you can set up a system from scratch, install all your apps, make an archive of the 'differences' and restore it from a clean Vista DVD you burn yourself. It's a far better method than slipstreaming and is quite close to what you want.

Either way, Linux is not special or better because you can tarball your system and copy it back, ostensibly because if you are using anything more than ext2 and a mainline kernel with absolutely no configuration whatsoever, only shadow passwords and basic PAM, your little tarball trick doesn't work.

Historical problem (3, Interesting)

Lonewolf666 (259450) | more than 7 years ago | (#19064049)

From the blog linked in TFA:

The culture is different on these other operating systems. On UNIX, you'd be considered nuts if you ran as root all the time. And if you wrote a program that demanded to be run as root for no good reason, your application would be shunned, and rightly so.
and:

If you are a developer who has turned off UAC in frustration, remember that UAC is only this way because of all those software developers who insist on running as admin. It's not Windows you should be looking to blame.

I think that this is, in turn, a consequence of earlier Microsoft operating systems (Windows 3.x to ME) that did not have security features worth mentioning. Unix had a clear differentiation between user and admin (root) rights since decades. Windows did not, and essentially everyone was administrator.

As a result, lots of applications got written that implicitly required admin rights, accidentially or because it was the path of least resistance for the developer. As a result of that, people got used to work as administrators all the time on the newer systems (Win NT and later) too. As a result of that, there was less pressure to clean up the applications.

Now Microsoft is trying to break that vicious circle with UAC, but it seems they are not very successful... as it is once more the path of least resistance to turn it off ;-)

UAC is cosmetics (4, Insightful)

Opportunist (166417) | more than 7 years ago | (#19064333)

UAC cannot and will not mean secure computing. It's been pointed out before, that "may X do Y" dialoge comes up so friggin' often that users either turn it off or click "yes" on everything.

And that does not only apply to "clueless" users. Of course, someone who has no idea what the computer does and just why an application like explorer.exe has no business beyond the local net, will click yes on the "when in doubt, click yes or it won't work" presumption. The problem is that many Windows-Services are started in ways that make it impossible to determine whether a given program is supposed to do this or that, because there are many started using wrapper programs.

Many services are started using an application to start services. And you ONLY see that application, not (necessarily) the drivers it aktually loads. Some of them need to get access to very core deep functionality. And, unfortunately, can be abused to start trojans.

Generally, the problem lies in the untidy separation between system and user. As has been pointed out before, too, one of the problems is that developers didn't care too much about access rights so far, because you could readily assume that the user had administrator privileges, so key hives like HKLM were overused, even when unnecessary.

Another problem is that UAC is an "all or nothing" privilege mechanism, at least when it comes to installers. You either unlock the whole system or nothing. And this is even for a user with some knowledge no trivial matter to decide. You download a game from some demo page and it requests elevated privileges. Is it because it needs to set a key in HKLM, which is maybe unneeded but not critical, or is it because it comes bundled with some spyware that wants to root itself deeply in your system?

Basically, to me it seems that UAC is MSs way to shift the blame for infections away from them, and (mostly) towards the user. You allowed it to happen, we warned you, you clicked yes.

wow I forgot slashdot is all microsoft bashers (1)

majortom1981 (949402) | more than 7 years ago | (#19065163)

IF developers would program their programs right we wouldnt have this problem. If they made something like a game install without having to be an admin then we wouldnt be having these problems. By this I mean. Why does a game have to install registry files? Why cant they be stored in say an encrypted file in the games directory. Even if microsoft changed to unix we would still have these problems because its the developers who refuse to change. Developers should start doing things the right way and start making thier programs not have to be installed into system critical areas.

It IS the developer's fault (1)

MikShapi (681808) | more than 7 years ago | (#19065191)

Microsoft did not invent sudo. They are the absolute last of the pack to implement it.

It's been optional to use forever. Restricted environments (where users still need to work, save files, etc) have been running in NT domains configured to disallow system modification forever and a decade. Vista's been in beta forever, and you need to have been on the friggin moon to not have known well in advance UAC is coming.

If your software writes outside your profile without a very good reason to do so, either update it, or smack the vendor on the head, because it is absolutely his fault. Just because it was ok to do something a certain way in the past doesn't make it ok to do it that way today. UAC/sudo is a simple Darwinian evolutionary step, a trait that gives advantage in a specific environment (The Internet a-la 2007) and is thus selected for, appearing in the next generation of the microsoft OS.

Blaming microsoft for it is lame (Unless you're blaming them for not having done it when Windows 2000 came out, that's ok.). They didn't do any foul play this time. Some developers having issues coping with the "new" reality? Market forces will take care of them soon enough, nothing to get concerned about.

News flash (1)

hey! (33014) | more than 7 years ago | (#19065229)

developers are lazy and sloppy.

It's not just Windows developers running as admin. It's C programmers using sprintf. It's java programmers catching all throwables. It's web programmers taking some string of unknown origins and handing it to a SQL interpreter connected as an account that has DML privs.

What makes a difference is consumers. Unix users don't accept programs that run as root. MacOS users get somewhat better UIs because they demand it. Windows users use Windows because they feel they have to, and so anything goes.

1. UAC is not SUDO. 2. What they did wrong. (3, Interesting)

argent (18001) | more than 7 years ago | (#19065241)

1. UAC is not SUDO

UAC is completely unrelated to sudo. It's an extension of the proxy privileged service scheme they've been using all along. It's not a bad model... it's much like what SafeTcl slave interpreters use... but it shouldn't be confused with "su", "setuid", or "sudo" in UNIX.

2. What they did wrong

Security is like sex, once you're penetrated you're ****ed. UAC, reduced privilege mode to run IE in, all the extra dialogs and warnings and security centers of the last ten years, they're all attempts to reduce the damage or pass the blame for the penetration on to the user. The solution is not to add more layers of annoying mitigation after IE, Outlook, and other applications that use the HTML control are inevitably penetrated. The solution is to redesign the HTML control so that it doesn't provide a security penetration API (the way ActiveX works in IE, that's what it comes down to) in the first place.

Instead, they present Silverlight, based on .NET, complete with its own security penetration API. :p

I do blame developers (1)

stubear (130454) | more than 7 years ago | (#19065409)

Windows NT has been out for well over 10 years now and has ALWAYS been a multi-user OS. Windows NT4 was the first really user-friendly version of NT and was the version I started using and never looked back. Developers NEVER coded apps with this in mind, they were too busy hacking together apps to run on Windows 95 and if they worked on NT great. I'm not talking about little utilities or games here either. Photoshop, Office, 3DS Studio MAX, you name it, none of them took into account the security features of NT or the fact that one can run NT in a non-Administrator mode. UAC is not the best answer from a security standpoitn but it is a way for Microsoft to prod developers to think about users when they develop apps for Vista. Windows 95 and its progeny are long since dead (some users just haven't figured that out yet - you know who you are *Windows 98 users - cough*) and the NT based OSes are the future of Windows. Developers now need to work with what they have and stop being lazy.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?