Domain: espci.fr
Stories and comments across the archive that link to espci.fr.
Comments · 22
-
Re:How do you get US inside the head?
The loa (acoustic waves laboratory) in Paris is doing such intra skull focusing for years.
List of related papers:
http://www.loa.espci.fr/cgi-bin/papiers?lang=en
especially #37 #46 #49 #64 and #65 -
Re:Do you work using restricted accounts
-
Re:You can't play the 'luser' card!
So why isn't it properly configured out of the box? Other systems are. Why not Windows (pre SP2)?
I don't know. I wouldn't say that SP2's defaults are that great, either. Bad defaults do not make the entire OS bad, however. It does make it unsuitable for use by incompetent individuals.A computer is a commodity, to be used by a variety of users, where only a little part of them are capable of 'brak the shell into little unpriviliged sandboxes'. I know that I'm not.
Marketing says it's a commodity that anyone can use without having to know anything about how it works. I don't believe it, certainly not with current Windows defaults. The jury is still out on other OSes until they have the masses of ignorant users who want functionality and compatibility way over security with manufactures willing to give it to them. This is the free market: customers get what they think they want even when it isn't good for them. If a UNIX had the same defaults that Windows has (root for all), apparently to pacify programmers whose programs need root and users who don't understand what that even means, it would be just as insecure.
No other OS has been able get this kind of market share, and I think Windows's crappy defaults and emphasis on compatibility are an important reason for this. For another OS to take its place, it would either have to do the same thing or somehow make up for it some other way.
A different OS won't magically make it's users competent or be secure whilst maintaining the compatibility, convenience and functionaility that users demand.
About breaking the shell up, I mean to log on as an unprivlieged user and use RunAs or SU to start a little piece of the shell, setup or config program when necessary as admin. It'd also be nice if you use the above to run IE as a seperate normal user, although switching to FireFox would be better. Potentially three pieces of the shell: desktop, admin and IE.No, it is not. There are Windows users with 50% more IQ than you or me, yet they still get pwned.
OK, by stupid I meant not competent to run Windows securely. Saying stupid was inaccurate and excessive.Windows is a tool of necessity. I have to use Windows at work, since it is all that is offered. I bitch and complain a lot abou this and get heard only a little. So I'm stuck with it.
Do you have local admin to your workstation? If not, you aren't at much risk to malware (in my expierence) and if so, make a local user for normal use.
I'm sorry that you have to use something you don't want to, but such is life. -
Re:Actually, Windows can be quite stable...
Non-root users and software can't screw up your system (short of using a root exploit, and that generally requires malicious intent) so as soon as your child is done, (s)he logs out, you log in, and all your stuff is as you left it.
On Windows (NT based) non-admin users and software can't screw up your system (short of kernel exploit), so create seperate (non-admin) accounts for your users. Each will have a seperate profile insulated from all the others. If you have some crappy software that requires admin just to run, make a SU -C file (it's like what setuid does) for it.
Almost no malware can install without admin priviliges (even then only for that one user). Normal users can't infect the system with a virus. Still, you may want to install Firefox anyways, for its other benefits. -
Re:Aren't you glad you need admin privileges ...
I'm glad modern linux distros automatically prompt for the root password when needed.
This is a nice feature; I wish that Windows did the same.As far as I'm concerned (on the windows side), having to open the entire shell (explorer) as admin in order to run a certain program (e.g., control panel) seems like bad design.
You can thank shell integration for this. Everything in the shell (including the control panel) likes to use the same libraries and run in the same process. Control.exe just signals the explorer process to open the control panel and exit. It goes back to the days of Win95 when extra processes cost precious memory; 95 had to run comfortably in FOUR megabytes. Unfortunately, this design choice was never reversed.I would at least like to see the commandline version of runas work as well as su does in linux.
Take a look at SU/SUD. I think it works as good as su does on Linux. Yeah, it's third party, but it works. -
Re:Aren't you glad you need admin privileges ...
Many applications and games require admin privileges to install. Windows Update requires admin privileges. etc etc.
So run only those programs as admin. Windows NT is (and always has been) multi-user. See RunAs, PsExec, SUD, etc. It would be a pretty lame excuse if I said that I had to run as root on Linux all the time because upgrading the kernel requires root access. You'd tell me to use su; do the same thing on Windows.Compare that to the Millions of Windows machines completely infected with spyware right now because Microsoft has no clue how to secure a web browser.
That's funny, I've used IE without getting any malware.
Here's a better reason that so many computers are plugged: ignorant users that are gullible, believe everything they see on the Internet, and press yes or OK on every dialog box just to get them to go away (without reading them or caring about the content). This is just as possible with Firefox or KDE or any other complex system that people use: you can make resistence to stupidity, but stupidity will always win some battles.
Could Microsoft make the resistance higher? I guess. But then they would have to contend with cries of incompatibility and non-ease of use. It's a precarious balance.
You'd like more security, but you aren't a shareholder of Microsoft; I'm sure the company has done much research that says that invasive security makes users mad and reduces salesBut combine users running by default as Admin [...]
Yes, the admin default sucks for security. It is also only a default and so completely avoidable; the fact that users don't avoid it speaks of their ignorance.
If Windows XP automatically logged you on as a non-admin user, most people would be lost; they would have no idea why they can't install their new software. All they see is an ugly dialog box they don't understand and it isn't working. This news would get out, XP would be branded as impossible to use because some dumb columnist couldn't install Quicken 200X, and nobody would buy it. They would still be using 98 or ME with zero local security. Because it's easier than dealing with security hassles. These are the same people who have no idea what the consequences of installing Gator or whatever are, and if you try to tell them about it, they glaze over and continue to do what they always have done. -
Re:My girlfriends are like Linux....
I've been running my Windows computers without a firewall (other than a NAT router), virus scanner, spyware protection, only patching at service packs without any problems. I've never had a worm, virus, trojan or other infection. I've never reinstalled Windows, and no, it doesn't get slow.
How do I do it?
1. I log on as a normal user (not admin). This is the single best defense against crapware. For installation and those whiney apps that require admin access, I use the Windows equivalent of sudo transparently to launch them. I also run IE and OE as a seperate limited user that doesn't have access to anything important (like documents).
2. The NAT router protects me from all incoming worms/unsolicited traffic.
3. I use Mozilla instead of IE.
4. I know what I am doing: I don't run crapware/virus infected stuff.
The first two items are sufficent to protect you from mostly everything. My brother got some crap installed; after cleaning it up, I instituted the first one and he has been clear ever since (more than a year). -
Re:Hmmm...
Overrunning a web browser, including Internet Explorer, won't get you root access unless you are running it in a privledged account such as Administrator. IE is just another user mode program.
There are tools available, such as runas, SUD, and psexec that let you run only specific programs (usually those that need admin access for no reason) as admin. -
Re:runas is crap
For protecting the system from malicious users who know what they are doing, it would in fact be useless.
For protecting yourself against crapware and IE's holes, it is very useful; a malicious program would have to be pretty intelligent to search for scripts with passwords.
Yeah, it's security through obscurity but it has very little chance of failing; most (everything I've seen) Windows crapware just expects to have access already or fails.
Plus, su/sud lets you create a key file that only lets you start one program as one user(without knowing the password); it has similar uses to setuid.
I'd say it's about as secure and useful as giving someone sudo access on UNIX. -
Re:runas is crap
I don't know why it isn't working. This may be a stupid question, but are you sure the SecondaryLogon service is running? Maybe explorer is quitting for some reason; try starting another cmd.
The user is really named Admin.
Did you try SUD/SU? I always use that instead of RunAs anymore.
Also, see psexec. It can do the same thing, and it can also do it on remote computers (assuming you have access). -
Re:IE is NOT a web browser
Hell, when Administrative priv. are required, what does Windows software do? It pops up, "You have to be running as an Administrator to
First, every version of NT (since 3.1) has been multiuser. You could have processes running as different users, side by side at the same time all interacting with the user. The tools provided by MS haven't been so great however. Runas (as previously mentioned) from 2000 is about it. This tool works better; but it's not like it does anything undocumented. ...". It doesn't even ask you for Admin. password to complete its function. You just have to relogin. And thanks to the great "multi user capabilities", you have to log out of your current session first.
The reason that programs tell you that you have to be admin to do this but don't ask you for a password to continue, is becuase even if they had the password they couldn't do anything with it. Every time a user logs on, a security primary token is created that can be used to create processes with the user's priveledges. Even if you know a user's password, those tokens cannot be created in an unprivileged process; a process requires the SeCreateTokenPrivilege to create primary tokens. By default, only the SYSTEM account has that privilege. Change it in the Local Security Settings snap-in, or the User Manager for NT4 and earlier.
Notice that runas and SUD require a privileged service account that runs as SYSTEM. Windows installer can prompt you for a password because it has a service too. -
Re:IE is NOT a web browser
Hell, when Administrative priv. are required, what does Windows software do? It pops up, "You have to be running as an Administrator to
First, every version of NT (since 3.1) has been multiuser. You could have processes running as different users, side by side at the same time all interacting with the user. The tools provided by MS haven't been so great however. Runas (as previously mentioned) from 2000 is about it. This tool works better; but it's not like it does anything undocumented. ...". It doesn't even ask you for Admin. password to complete its function. You just have to relogin. And thanks to the great "multi user capabilities", you have to log out of your current session first.
The reason that programs tell you that you have to be admin to do this but don't ask you for a password to continue, is becuase even if they had the password they couldn't do anything with it. Every time a user logs on, a security primary token is created that can be used to create processes with the user's priveledges. Even if you know a user's password, those tokens cannot be created in an unprivileged process; a process requires the SeCreateTokenPrivilege to create primary tokens. By default, only the SYSTEM account has that privilege. Change it in the Local Security Settings snap-in, or the User Manager for NT4 and earlier.
Notice that runas and SUD require a privileged service account that runs as SYSTEM. Windows installer can prompt you for a password because it has a service too. -
Re:runas is crap
I just tried "runas
/u:Admin explorer". It promted me for a password, and then created a new explorer process running as the user Admin. It worked from xpsp1 and 2ksp3. You could also start a command prompt and run explorer from there.
I don't like runas becuase you can't use it for setuid or make the password a command line parameter. Here is a tool that does that. -
Re:Here we go again...
Download tools from SysInternals.
Autoruns will list everything that gets started. Check that out for unnecessary entries.
Process explorer will show all running processes and exactly where cpu time is spent, down to the thread, with stack information.
Filemon can show all disk activity down to the lowest level; even writes to the file table.
There are many others, try them out.
As for stuff that already comes with Windows:
Look at the Event Viewer; what is causing the crashes? Is it a specific driver that could be replaced/upgraded? Include bus drivers listed under system devices. Ignore driver signing; there are bad signed drivers and good unsigned drivers out there. Generic drivers will be more stable but might be slower.
In XP, run verifier.exe to run some extra checks on drivers (restart requried) to help identify problems. Using the checked build of the kernel can also be quite useful, if you know any kernel debugging. If possible, buy hardware from vendors that write quality drivers. (sounds like Linux; buy hardware for the software support.)
Run spybot/adaware to rid the computer of spyware, and institute protection from future infection by running IE and the shell as a lesser user. Runas, psexec, and SUD can help with this.
Otherwise, try to figure out when and how the computer is slow. Is the hard drive running all the time? Mabye the computer is low on memory and it's time to stop some unnecessary services? Is it CPU usage caused by some rogue process that you can track down with Process Explorer? -
Re:You can't laugh this off, not even with Mozilla
Erm, yes they do, at least under NT 4.0 Workstation and 2000 Professional with default settings.
I don't have a NT4 or 2k workstation near me, but my xp computer doesn't allow members of the users group to create files in the windows directory.True, although it stops a lot of standard software from working, including the drivers for my scanner. Funnily enough, I don't want to have to log in as administrator to use my scanner.
The drivers would run in kernel mode. If you're talking about the user interface, then there are workarounds.
Use the SUD program in the second link to create a shortcut to start only your scanner software as an admin. Something like:
su -u Administrator -p password -c scanner.exe
Or at least run IE specifically as a lesser user. -
Re:You can't laugh this off, not even with Mozilla
Good post. The culture differences between Windows and UNIX are just like you said. I wish MS would crack down on ignorant developers too, but it really isn't their job; the users should be complaining more. Microsoft's own software is usually pretty good about it. Games are the worst.
UNIX has commands like su to run programs that require extra priveledges. Windows has runas, psexec, and sud.When I find something that doesn't behave as a lesser user, I create a simple shortcut that uses sud to start that one program as admin or some user with just enough access. It's not perfect but it works. -
Re:Privilege level
-
Re:Administrator gui logins are bad...
[...]I much prefer the way OS X handles it, in that you never "log in" as administrator, instead you just temporarily give privilege to one process when installing software or changing system settings. In most UNIX systems, you never log into the GUI as root. Because of this design in OS X, it pretty much forces apps to behave properly, and even casual users will usually understand that having to type in their password meens "something important is happening".
Guess what? You can do the same thing in Windows: lookup runas(included) or sud or psexec. -
Re:Not the pointThat's why I browse with a different user account than my actual documents are stored in. It's really quite easy: I click the web browser icon (or whatever program that doesn't need to access my documents) and it transparently uses a su script (you can also use runas.exe that comes with Windows) and voila, my documents are protected from the program since it's running as another user, side by side my other programs.
Out in the Real World, machines are typically used by one person. The only files on that machine, or accessible via the network, that person (and their boss) cares about, are the ones they spend all of their time working on and any virus running as them will have full access to.
One human user does not have to use only one computer account; running different types of programs as different users will do exactly as the grandparent stated.
I do the same thing on Linux too. -
Re:They're users... fix their account type!
Here's what you do about badly written programs that require too many priveleges: Create a runas script to run only those programs as admin. Like sudo in unix. Or the tool SUD from http://www.loa.espci.fr/winnt/sud/sud.htm. A proper su command for WinNT.
Along the same lines, locking down IE and OE with a seperate restricted user is a good idea too. -
Re:Who is uninformedI can get all kinds of stuff to run. Including Office. Usually, MS programs are better behaved than average. Still, you are right in saying that many things require more priviliges than they should need to run. I guess this is a more fundamental difference in the coding ideologies between UNIX and Windows. Many Windows programs implicitly require access to everything, whereas UNIX programs are usually better behaved.
To work around this, I recommend you download "su/sud" by Didier Cassereau. You can get it at http://www.loa.espci.fr/winnt/.
Then create a cheapo cmd script: call it suaa.cmd (for Switch User to Administrator Auto), use SU with an administrator's name and password, running the desired program.su -u Admin -p 123 -c %1
Change the shortcuts of picky programs to "suaa.cmd X" where X is the program name. NOTE: if the command line includes any parameters or spaces, be sure to enclose it in quotes.
exit
Granted, this breaks the machine's security against malicious users, but you can at least avoid running Internet Explorer as an administrator. You can go the other way too: su also works for normal users. -
Re:Radio?Interesting piece, JLSeagull. I hadn't come across anyone who had actually done experiments in this area.
This is some hope, however, in accomplishing this in time-varying scattering/refractive/wave-prop environments (albeit at different ratios of carrier wavelengths to characteristic-length-of-scatterer). The medical ultrasonics people do essentially the same thing to accoustically destroy kidney-stones in-vivo. Matthias Fink, who is quoted towards the tail end of the NS article, is heavily involved in that work (along with his research group), and has published extensively.
(ObSlamDot: My gosh! An actual rational scientific discussion on SlashDot, where actual factual information is exchanged! We can't have that! Quick! Someone post a flame!
;-)