Slashdot Mirror

← Back to Stories (view on slashdot.org)

Longhorn to use UNIX-like User Permissions

Posted by Zonk on from the making-their-own-osx dept.

destuxor writes "After years of Windows users abusing administrative accounts out of necessity, Microsoft promises that Longhorn will make better use of user permissions in what sounds exactly like what UNIX/Linux users have been doing for years. Hopefully this will fix the long list of applcations that cannot be run by a Least-Privilege User Account (LUA) while giving a much-needed security boost. Too bad "MS-root" can't watch over your grandmother when she opens emails."

5 of 697 comments (clear)

  1. Finally... by TripMaster+Monkey · · Score: 5, Interesting
    From the article:


    Application developers who log on to their development machines as administrators when they write code create programs that assume that level of privilege but have trouble when run by a user with reduced permissions, according to Brown's work, which estimated that 90 percent of Windows software can't be installed without administrator access to Windows, and that 70 percent won't run properly unless the user is an administrator.


    It's about damned time this issue gets addressed. Every day at work I have to fight with this M$ limitation. Chief among the offenders are:

    - Kodak Share software
    - Autocad
    - Any serial port emulation program
    - PowerDVD

    Most users must be elevated to Power User status on their machines to allow them to do anything nowadays, while there are plenty of programs (like the ones listed above) that will malfunction or simply refuse to work with anything less than full Admin rights. Sometimes, I have no choice but to give a user full Admin rights...I grind my teeth as I do so, knowing full well I'll be called to disinfect the machine of countless spyware programs within weeks, if not days.
    --
    ____

    ~ |rip/\/\aster /\/\onkey

    1. Re:Finally... by Anonymous+Luddite · · Score: 5, Interesting

      >> Sometimes, I have no choice but to give a user full Admin rights...I grind my teeth as I do so, knowing full well I'll be called to disinfect the machine of countless spyware programs within weeks, if not days.

      That's where I live buddy.

      We have a room full of people of varying ability who all have unlimited access because [censored p.o.s. software package] doesn't run otherwise. These guys surf a lot, clicking "yes" on every friggen dialogue box they see... literally can't go a full week without some exploit being loaded.

      zero user buy-in for security - When someone shows up to remove the exploit-of-the-week for them, they get is static about "touching my machine". It pains me to be in the same room sometimes...

      --
      http://request-header.info
    2. Re:Finally... by Rycross · · Score: 5, Interesting

      We run all of our users as users at work. Some of the programs which don't work can be made to work by fiddling with file permissions and the security policies. For programs that just won't work without admin priveledges, we provide an admin account which has been modified so that you cannot log into it (by having a script that logs you out as soon as you log in). The users use the "Run as..." option, and run their programs using this administrator account. Thus they can't do everything as administrator, but programs that require the permissions can be run.

    3. Re:Finally... by Spy+der+Mann · · Score: 5, Interesting

      Chief among the offenders are:

      - Kodak Share software
      - Autocad
      - Any serial port emulation program
      - PowerDVD

      Shouldn't Microsoft Logo certification do something about this? I mean, isn't there a clause saying "Thou shalt let users run thy program withoust being administratorths" or something?

  2. A step in the right direction but.. by thundercatslair · · Score: 5, Interesting

    This might not change much, windows users are generally lazy. I see most people will just log in as an administrator and stay that way forever. The article didn't mention how easy it would be to switch to an administrator either like unix's su. No matter what microsoft does security will always be a huge problem, users don't want to change they like it easy.