Slashdot Mirror
Windows OSS Only For Administrators?
Torsten writes "We all know it: it is no good idea to run Windows with Adminstrator privileges all the time. But when you use a normal user account, many programs will not work properly. I have recently recognised that even open source software has difficulties with the Windows rights model. Openoffice will continue to ask for registration until an Administrator stops it. Firefox will not install new search plugins for normal users and will not even tell why. FlightGear starts the configuration screen, but only an Administrator can fly.
Have the OpenSource developers problems adapting the windows right model? Or does nobody bother being Administrator?"
It's not just OSS; Microsoft's own stuff doesn't necessarily work properly with restricted rights. The printer spooler on one of my home computers refuses to work, and in order to let my kids print anything, I had to turn off the spooler (which essentially hangs the computer until the printing is done). I have similar problems with peons and non-OSS third-party software, such as HP's software update tool.
Can't you get around some similar problems with programs that don't have installers? I know it's sidestepping the specific problems mentioned in the article, but that was why I used Trillian when I was stuck "working" in the computer lab.
Mod parent troll. Obviously the emails are to inform of updates to the product, not some shady revenue source.
Classical chicken-egg problem.
Since the majority of developers and testers develop/test with Administrators rights, these bugs slip through completely unnoticed.
How to change that? I don't really know.
And anyway there gonna exist many legacy (9x era) apps. These gonna require Administrators rights. Maybe "Run As" is going to help. But it's annoying to use: doesn't really remember credentials, doesn't have "remember admin password for XX minutes", etc.
Maybe if Microsoft implemented comfortable "Run As", things gonna change. Not now.
- Arwen, I'm your father, Agent Smith.
- Well, you're just Smith, but my father is Aerosmith!
On my home machine I am the only user. For day to day things I run as a limited user. But I want to run programs like eMule (only to download legal things, of course). But eMule is constanly writing to its temp folder. So I just installed eMule under the My Documents folder as a limited user instead of Program Files as Administrator. You have to run eMule once as Administrator so it can write something to the registry but after that you run it as limited user.
Windows NT may have proper separation of users, but most people and most software came to Windows through DOS and Windows 9x, which are single-user.
Both the developer and user cultures are shaped by this, and the result is software which can't properly be secured. I'm not surprised. Are you?
Please correct me if I got my facts wrong.
If you spend enough time with NT-derived versions of Windows, you'll find that a lot of software simply assume that it is running under Windows 95/98/ME or require that you do some fiddling with permissions on the filesystem or registry to run properly. This causes me no end of grief as I try to keep our PCs sufficiently protected from stupidity while being functional enough to avoid receiving support calls.
All of the examples given can be duplicated in commercial software. MS Office 2000 won't stop displaying the "please register" nag dialogue box until an admin dismisses it. Regular users can't install plugins in Internet Explorer either, although I guess one could set the plugins directory to Everyone:F, but that's big security hole. One little commercial programme we use here to track fixed assets won't run under a regular user account unless its registry key in HKEY_LOCAL_MACHINE is set to full access to everyone because it keeps running state information there. Nero Burning ROM will not burn dics under a regular account without installing an extra utility that grants disc burning privileges to admin-specified users or groups. Palm Desktop, even in its current iteration, keeps user data in its programme directory, which requires the admin to set the directory's permissions to Everyone:F - again, another gaping hole. The list goes on and on, and it goes to show that a good part of the crappy Windows user experience is caused by the lousy software that runs on it.
In Soviet Russia, Jesus asks: "What Would You Do?"
Windows 9x apps could drop files anywhere they pleased, and they did: the Windows directories, app directories, the root of the drive, you name it. Windows NT/2K/XP solved this issue with the "Documents and Settings" area, and that's supposed to be where apps put their temp files, logs, databases, and other data. But most 2000 and XP systems loosen security to make old apps work. (How could apps write .INI files in the Windows directory otherwise?)
Since old apps don't break, developers are tempted to follow bad examples or old habits. It seems like the only way this would change is if Microsoft shipped XP as secure by default--the default user would not be an admin, and NTFS security was set to prevent writes to Program and Windows dirs. That would cause a massive support headache.
The Windows Installer docs have some guidelines on where things should go for best compatiblity, but of course a lot of people use other installers and those may not try to enforce any rules. This doesn't seem to be an issue that Microsoft is crusading about, but maybe they should.
They don't spam, that's for sure.
I use a unique address for every e-mail address I give out, and the one I gave openoffice has not been one of my spammed entries.
On Arrakis: early worm gets the bird. Magister mundi sum!
There were a few issues with my software that needed me to consider multi-user access under Windows, especially as I was adding new features; when these features finally came to fruition, I modified my software, sticking preferences, application and temporary data either under the user's "Application Data" folder in "Documents and Settings" in Windows, or in a dotted directory under *nix. I thought this was an elegant solution.
So what happened? People yelled at me. Why was I polluting their system, putting files all over the place? Why couldn't I have kept it the way it was?
You just can't win...
Perhaps that's because of a scarcity factor more than the weight change. Or it may be more tied to the general shortage of jovial developers.
This post written under Gentoo-linux with an SCO IP license.
If you had read the documentation, you would know that in order for Openoffice to run as a normal user and save your settings, you have to run the install as "setup.exe -net" -- just like you have to do in Unix.
If you trust the software, just grant the Users group extra permissions & file a bug report for what you had to do. In environments where I trust the users, I am lazy & grant users the same permission for the apparently relevant files and directories as the accounts that can run the software. On some occasions, this includes changing permissions of dlls outside of the installation directory. I use listdlls to do this. In less trusted environments, I will gradually add read+execute access for the users to the programs & dlls users need. If I get sick of trying to fix it, I usually reevaluate the need to install the program or the level of trust to grant the users.
y'know, OS X doesn't seem to have these issues...
In my experience, this is just a program design issue. I'm using linux, and I've never had any problem with it. Allmost every program in linux doesn't need root priveliges anyway. And the ones who do (like XCdroast) provide a special interface for it. Still not satisfied? Use su or sudo to run it temporairly in as root.
However, I had this one problem with firefox search plugins. The reason why most users can't update the searchplugins is because the dir containing the searchplugins is global, and a standard installation doesn't allow uses to write in it. This is rather unacceptable behaviour in Linux. Bugs like that just prove how some developers are unaware of multiple users and priveleges.
In Windows, the situation is rather different. Most users don't need multiple accounts on one desktop. So it's not a big problem (they think), because they are in charge anyway. This way, a lot of programs running on Windows don't bother providing a multi-user interface, but just stick to a global configuration. With this attitude, it's just asking for problems
- Never underestimate the power of human stupidity.
Someone modded me down? I really do feel this way. Windows makes a really nice game platform, same as an XBox or something like that. You could even run a regular OS on an XBox, but if I saw my bank using something like that to keep track of my money, I'd switch my bank.
Seriously. Windows == game machine. Run as administrator on it, all you will risk is your Everquest game money. If you run a real business on a game machine, well, I will LOL.
Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
I'm not trying to through rocks, but trying to highlight a need... Running OpenOffice on a Windows system with multiple users where said users are not administrators is a problem for me and an impediment to the adoption of OpenOffice for many of my clients. Most Windows software I run needs to be installed only once while administrator and then all other nonpriveleged users can run the software. This doesn't appear to be the case with OO. I don't get the per-user install requirement for OO. This problem is most pronounced on Citrix. I found an ugly script that includes multiple reghacks on OOOforum.org that I will soon test, but in general, this issue has got to be an impediment to OO deployment on many Windows networks.
Wasn't Microsoft planning to fix this problem in future versions of Windows by using virtual copies of the registry, so that each program could see its own copy of HKEY_LOCAL_MACHINE and do whatever it wanted to to the key because its copy wouldn't be the "real" master copy?
I agree to a certain extent. Windows is a good workstation/network client.
In our offices people use Windows, Mac, and (one)Linux workstations but everybody must save their files to the company file server, which has RAID drives, and backed up nightly to a remote location.
So if Bob the programmer with admin access FUBARs his workstation then we have to reinstall windows and some apps but the data is safe.
Firefox not installing plugins by default using an unprivileged thing is a GOOD THING. I think the poster of this article needs to step back and look at the security model and why it exists, not only that it exists.
Many of the OSS apps I work with, work fine as long as you play by the rules (which is a huge part of security!). Can we mod an entire story as Troll?
Both the developer and user cultures are shaped by this, and the result is software which can't properly be secured. I'm not surprised. Are you?
Yes. Not for typical Windows apps, you're right, but things like OpenOffice and Firefox derive from unix projects and work fine in a reduced permissions environment on unix builds.
So why do they have trouble in reduced permissions environments for their Windows builds. Perhaps we blame the Windows porters for not being unix geeks, which goes back to your suggestion?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
My Ma and Pa are administrators, that i hate, OO.o installed in my account, didn't have the file associations transported to my mum and dads, wierdness...
When setting up the new Active Directory domain here, I decided that I would rather avoid these problems all together by giving users administrative rights to their own workstations.
You can accomplish this by adding the user's domain account to the local Administrators group on the workstation. You set this on the system itself, not at the domain level. Doing so does not give the end users administrative rights to any other system -- just their workstation. No domain-wide administrative rights what-so-ever.
I felt doing this gave users the flexibility they needed to do their jobs, but was restrictive enough to keep users out of each others' systems, which was a concern of mine.
Do you know how to get KDE to run with a read-only home directory? You won't find the answer in the documentation. Searching the net yields helpful advice to set KDE_HOME_READONLY=true, but it still doesn't work because DCOP wants to write its state file in the home directory (now, who came up with that idea?). Naturally, there is no help anywhere to be found. But, if you happen to be a programmer and have time to comb through hundreds of lines of code, you can figure out that you also need to set three additional variables, which let you run with a read-only home. Well, not exactly; you still need to put those state files somewhere, and as they are not uniquely named, /tmp is not really an option. So I'll put them in ~/.kde. To do this I had to set:
d e/ICEauthorityv er
DCOP_SAVE_DIR=$HOME/.kde
ICEAUTHORITY=$HOME/.k
DCOPAUTHORITY=$HOME/.kde/DCOP_ser
So pull the log from your own eye before taking the speck from Microsoft's eye, for programmers assume excessive permissions on all platforms. And please, would somebody at least mention this in the documentation?
Search plugins, which the story refers to on win32 & which I refer to in my response, are installed to the installation folder. On the box I'm currently on, that is:you have to install as root with the default permissions.
This is a known bug: look at bug #232638: (no linky because they don't allow links from slashdot)
Microsoft has implemented an extremely good version of Run As (Think sudo).
To run a program as another user, shift-right-click on the program and select Run As... from the context menu. You can also use the runas command from cmd.exe.
More info is here:
Run As
Create Shortcut to Run As
There are three parts to security that many geeks (myself included, at first) do not typically comprehend.
Confidentiality - Can I control access to a resource
Integrity - Can I be sure that my resource has remained unharmed
Availability - Can I use my resource
In this case, not being able to install a plugin (as the original poster's and your example) is a loss of availability. If I'm to operate a normal user on my system, but I have to log out and back in as Administrator to install a simple plugin that, say, pulls an RSS feed, you can be certain that I will both view this is a big issue, and probably not use the product.
That said, firefox is an exception in my book, but my solution is to run as Administrator, which is not a good solution either.
In my opinion, this poster raises a *very* valid and important point with respect to all software, not just OSS. If the software I'm trying to use won't let me run Windows securely, (heh, like third-party software is all that's stopping that from happening...) it's an issue.
Linux: The world's best text-adventure game.
On Linux this nag goes away if you simply say you're already registered. Is it different on winboxes?
You don't want users to be able to install software.
Realise that a plugin is software. If you can't install the plugin that pulls the RSS feed then you also can install a bad plugin that strips email addresses out of webpages and sends those users spam.
If your installing and uninstalling software constanly then you ARE and admin (or doing admin work). You only want an admin to be able to install plugins as they affect every user on the machine.
That being said in windows if you wanted to install a plugin then just run firefox as administrator while your installing it.
Hold down + and right click on the icon on the desktop. There will be a new option called "Run As" this means you can run it as administrator to install the plugin then close it and reopen it as a limited user.
Does this mean more work? YES. That's why most users run as administrator
I am running Windows XP Pro and each member of my family has a limited user account. Additionally there is one account named "root" that has admin priviledges.
I have found some software that does not work properly but usually I have found something to replace them.
I have no problem with OpenOffice. I do not remember if I ran the setup while logged in as root or did I just right-click->RunAs it. Anyway, the limited user setup has to be done with a special -net switch. Read the installation docs.
I used to have to install firefox extensions while logged as root, otherwise they would not install. However, I find that with Firefox 1.0 the extensions install just fine with my normal, limited account.
Dr. Divx requires that I'm logged in as root. Why would a software that reads a file, crunches some numbers and writes another file, require admin priviledges? I have filed a bug report about it but I don't think the vendor took it seriously.
I just hope more and more developers realize it is unacceptable to require admin priviledges on this day and age. If you find software that does a bad job with this, find something else to replace it and tell the vendor/developer that you dropped his software because it did not run without admin permissions.
Restricting users to preinstalled software does raise security. But users have traditionally had the ability to install and run software inside their home directories, and this is the default in XP, OS X, and UNIX. I'm not even sure it is possible in XP to keep execute permissions off homedirs.
Realise that a plugin is software. If you can't install the plugin that pulls the RSS feed then you also can install a bad plugin that strips email addresses out of webpages and sends those users spam.
Restricting someone to a limited account does not keep them from running software, just running software that wants to do certain things, like mess with the registry, %system32%, etc. Sending email is not one of those things. A firewall that allowed network acess only to preapproved programs on preapproved ports would be a real solution.
If your installing and uninstalling software constanly then you ARE and admin (or doing admin work). You only want an admin to be able to install plugins as they affect every user on the machine.
So now we're talking about users affecting other users. Sure I should be kept from adding plugins that will make your browser act differently than you are used to. But the browser should let me install plugins from within my homedir that affect only me.
That being said in windows if you wanted to install a plugin then just run firefox as administrator while your installing it.
That is reasonable when I as the admin want to make a plugin available for all users. But the option to install a plugin just for my own use should be available. And these users that we are trying to stop from "installing bad plugins" shouldn't have the administrator login.
Hold down + and right click on the icon on the desktop. There will be a new option called "Run As" this means you can run it as administrator to install the plugin then close it and reopen it as a limited user.
Just a note: limited users in XP have this "Run as" option available without the +.
Does this mean more work? YES. That's why most users run as administrator
The point is, program writers and the Windows secrity model make this much harder than it needs to be, and sometimes impossible.
This post written under Gentoo-linux with an SCO IP license.
My solution is to make the account a member of "Power Users." Or make a special Power User account and "Run As" Firefox as that user.
Maybe what we need are user-level and administrator level plugins?
Some plugins would be a useful thing for all users (such as perhaps a proxy chooser, which in XP I use for our laptop users), but others could be damn annoying if applied to everyone.
A "please enter the root password" (or select admin user/password for XP) for global-level plugins would work nicely... and a ~/.mozilla/firefox/userplugins for the non-global ones...
I have a PDA running the PocketPC OS. It is very nicely integrated into a host Windows system which I have retained. However due to the wonderful Windows Installer, PocketPC software must be installed via Administrator on the host PC. WTF????? There is no admin on the PocketPC OS and I can manually install stuff without problems.
See my journal, I write things there
IF OpenOffice IS open source THEN
... that nobody eliminates 'ask for registration'.
WHY DON'T YOU ELIMINATE
the heavy 'ask for registration'?
It's very RARE, WEIRD, RARE, WEIRD,
Firefox install every kind of plugins, but only for a new search engine you need administrator privileges. And there is no information about that.