Slashdot Mirror
A Fresh Look at Vista's User Account Control
Art Grimm writes to mention a post at Ed Bott's Microsoft Report on ZDNet. There, he talks about Vista's User Account Control, and the issues he sees with the setup as it exists now. From the article: "The UAC prompts I depicted in the first post are those that appear when you install a program, when you run a program that requires access to sensitive locations, or when you configure a Windows setting that affects all users. But as many beta testers have discovered, UAC prompts can also show up when you perform seemingly innocent file operations on drives formatted using NTFS. In this post, I explain why these prompts appear and why some so-called Windows experts miss the obvious reason (and the obvious fix)."
Could they possibly make that "article" any more annoying? They'd have been better-served to turn it into a flash-animated slide show. I'm not going to click all the way through that thing.
Either put it all on one or two pages (interspersed with ads if you must), or put it into a slide show if the article is written as a slide show.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
The whole point of Administrator is that you know what you do and you can Admin a machine securely. I know Joe Sixpack doesn't know how to, but doing this will put Admins all over the world in the place of "Limited User". In the end our Dear Joe Sixpack will just click and click until the task is done anyway. He will be frustrated and will get spyware anyway.
What we need is the equivalent of a Car Mechanic for administration. You call your mechanic and he'll do the maintenance for a fee. Frankly, it's the only way for home users.
Oh, and those that say that you can't run in Limited User on XP (as in the fine article is stated) are completely ignorant. I'm running Limited right now, and I have no problem. Granted, I have to set the ACLs on both directories and registry settings, but it's never been very hard. The only program I've never been able to run as non-admin is a game called "Children Of The Nile", and I still don't know how to run it as a Limited User. The user that needed it got the "Run As" option checked in the shortcut. Sure she has Admin access that way, but she's my sister and knows that she shouldn't run Admin.
No, all problems are just the cause of the legacy of poor security in the past. Nagging dialogboxes won't help.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
(more)
blarg.
With more and more people using Firefox, all those popups had to go somewhere...
The difference between stupidity and genius is that genius has its limits.
I wish they would work a bit on account control on WinXP, it is a total disaster. I WANT to use my computer as a limited user, but when I need to do something in Administrator, I shouldn't be bothered to switch users. Why oh why can't they just make it so that is asks for the admin password like with every other goddamned OS!?!
Vista is nice and all that, but how about fixing XP first!!!!
Some say he is made with ascii, others that he is eyeballed daily by millions. All we know is, he is known as the Sig
I saw screenshots of 5365 (and tried it) and now whenever you do one of the several operations that triggers the authentication prompt, it goes into some "Secure Desktop" mode. I say that is:
1. Way too confusing for users seeing that you can't go to anything in the background while the dialog is there, and anyway
2. It's a really stupid gksu rip.
Come on, there needs to be better ways to get security across than raping people just to change their cursor theme. (it doesn't do that but I bet it will in the RTM considering all of those "free mouse cursor ads")
I didnt quiet like the dialoge boxes because all of those are jarred on the right and bottom borders, as if someone has tore them off..... oh! wait...
fuvoo: watch something
"I explain why these prompts appear and why some so-called Windows experts miss the obvious reason (and the obvious fix)."
Well, good thing MS targets this OS exclusively to Windows experts. What utter fools we've all been for assuming this would effect our non-expert friends and families!
I just... Next >>
Love reading... Next >>
Things... Next >>
Like these... Next >>
Seriously, don't bother visiting the site, or you'll destroy your mouse by the zillion clicks needed. I'm not exaggerating. I haven't had the patience to click through it all, but I wouldn't be surprised if it spanned through 20+ pages.
Next >>
Unfortunately, most of the time, the program doesn't even tell you why it had the error. I know that 3D Studio MAX 8 may or may not work if you run it under a LUA.
Now, I won't fault anyone in particular for this (it's both Microsoft's fault and the programmer's fault), but it's nice that something like this is finally coming.
"Beware of he who would deny you access to information, for in his heart he dreams himself your master."
In this post, I explain why these prompts appear (it's Windows) and why some so-called Windows experts miss the obvious reason (and the obvious fix (Linux) ).
anyone else see the irony in an article talking about annoying click-throughs needing so many bloodly clicks to read?
fucking teriffic...
3 series of articles, half a dozen pages each, just to tell me why I have to slow down my workflow when deliting or renaming files.
If you don't know what AltaVista is (was), get off my lawn.
The 70's called. They want their security model back.
Yawn.
This is the crux from the end of the article;
"How do you work around this annoyance? You have three choices:
* You can take ownership of the files on the external drive. That gives your account Full Control permissions at all times and prevents other users on the same computer from changing the files unless they do so as an administrator.
* Or you can change the permissions assigned to the Users group so that members of that group have Write or Full Control permissions. That solution allows everyone with a user account on the computer to manage files without having to OK a consent dialog box."
* Or you can play a Sony music CD with a rootkit."
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
If you made your user "superuser" on a Linux box, the did a kernel upgrade and decided this was stupid so just allowed you to sudo certain commands then you'd have a devil of a time accessing all those files that you created while you were the super user.
Or put more simply
XP didn't have sudo so you were always admin, Vista has sudo, enabled via annoying popups rather than a config file.
An Eye for an Eye will make the whole world blind - Gandhi
The new Windows 'protection' scheme will browbeat the user until they disable the security system (in some way or another).
That way, when the inevitable virus and spyware hits the system, Microsoft can wash their hands and say that it's all the user's fault for making use of their computer bearable.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Thank goodness for antipagination
A fresh look at Vista's User Account Control, Part 2
Posted by Ed Bott @ 6:59 pm
In the first post in this series, I provided a close-up look at a major new security feature in Windows Vista. User Account Control (UAC), which will be enabled by default in all versions of Windows Vista, monitors a user's actions and prompts for an administrator's credentials before allowing any action that has a potential impact on system security.
The UAC prompts I depicted in the first post are those that appear when you install a program, when you run a program that requires access to sensitive locations, or when you configure a Windows setting that affects all users. But as many beta testers have discovered, UAC prompts can also show up when you perform seemingly innocent file operations on drives formatted using NTFS.
In this post, I explain why these prompts appear and why some so-called Windows experts miss the obvious reason (and the obvious fix).
File operations trigger a UAC prompt anytime you try to do something with a file or folder where your current set of user rights doesn't grant that access. For example:
If you try to create a new file in a system folder, you see this dialog box.
[pic]
f you try to delete a file, or create a new subfolder, or move a file, or do anything that directly affects the file system in a drive or folder whose contents are restricted to administrators, you see this dialog box:
[pic]
Similarly, if you try to rename a file or folder in a location where you don't have explicit rights to do so, you see this dialog box:
[pic]
In all three cases, your clue that UAC is involved is the Windows shield on the Continue button. When you click that button, the regular desktop fades to gray, the Secure Desktop appears, and you see the following consent dialog box:
[pic]
So, why does this happen? These dialog boxes appear when Windows Vista security meets NTFS permissions, which are stored in Access Control Entries (ACEs) applied to file system objects and displayed in Access Control Lists (ACLs). UAC is new; NTFS ACLs are old. But most Windows users, even some with years of experience, don't understand how ACLs work. And changes in the Windows Vista security model mean that a lot of people will be very frustrated until they understand how to work with those permissions.
Here's the problem, stated as simply as possible:
When you use Windows XP, you are almost certainly using an account that belongs to the Administrators group. (The challenges of running as a Limited user in XP are well documented.) As an administrator, you can do just about anything with just about any file. The exceptions are rare - you're locked out of the folder that contains System Restore files, for instance - but for the most part, if you can see it, you can change it.
That all changes in Windows Vista. When UAC is enabled, all users run as standard users. That's true even if you're logged on using an account in the Administrators group. Your working environment, including Windows Explorer, has the rights of a standard user account, and you can only run applications with administrative privileges if you provide explicit consent. In technical terms, your parent process token is that of a standard interactive user.
If you try to delete a file, or create a new subfolder, or move a file, or do anything that directly affects the file system in a drive or folder whose contents are restricted to administrators, you see this dialog box:
[pic]
Windows sees that the Users group has Read permissions only on that folder, and it has no way of knowing that you created the folder on another computer and that you should be listed as the Creator-Owner of all those files. It applies permissions based on the standard user process token and tells you if you want to change anything you'll need to supply your Administrator credentials.
How do you work around this annoyance? You hav
Microsoft is trying to make users have good hygiene -- that is, don't run as a super-user unless you need to. Well-meaning and well intended -- and a good idea. Ultimately, however, Aunt Sally is not going to deal with it for long, and you, the unofficial family Helpdesk tech, are not going to like all of the calls you get from apoplectic relatives dismayed that they suddenly can't open this that or the other because they do not understand the paradigm.
What will happen is what always happens: when there is a "problem" someone "fixes" it. In this case, the "problem" is the security model. I suspect that there will be a 3rd party "fix" that blasts through all the well-meaning security and basically restores the user-as-root scenario that Windows has operated in since forever.
Damn, that's annoying.. having to click next a zillion times to "read" (mostly pictures) the "article".. And the remarkable revelation? You'll be getting popups because of restrictive file permissions! Well, gee, I would certainly never have figured out THAT was the reason for popups that say "you lack the required permissions"....
SCO employee? Check out the bounty
When I first clicked on the article, I couldn't even figure out immediately where the rest of it was. It was like 90% crap, a tiny bit of text, and a tiny more link that disappeared amidst all of the crap.
Running as a Limited User is not impossible.
It just requires spending a LOT of time and effort to LEARN how to do so
and that pre-supposes that the person understands the risk of running as Administrator.
So, someone has to already be aware of the threat
Then that person has to choose to try to avoid that threat
Then, then that person has to spend time becoming further educated
Then, then, then that person has to spend time fixing the ACL's and such.
Or just choose to run as Administrator and all those problems go away (and you get new problems, but all your apps run).
Seriously. How many pages was this article for how much text?
So, in the end he recomends giving Users full control or write access as means to get around the annoyance. Hell, why dont we just chmod -R 777 /* and end all the "annoyances" of my Linux box too while we're at it?
Can't he just suggest that application designers get a clue and write apps that don't write uneccesarily to sensitive areas of the system? Hopefully annoyed end users will "motivate" lax companies when this happens instead of working around the issue.
--
Hm, I fail to see the point in having written such an article. It helps me solve nothing I couldn't really have solved myself, it explicitly states that the average user can't do this because they don't know how -- rather insulting them than helping them.
But what's even more funny is that, in the end of the article the author says that in his final instalment he will write a few suggestions HOW MICROSOFT COULD SOLVE THIS PROBLEM. Ok, that's something we really need, a smart-ass teaching MS developers how to do something... I mean, why waste valuable internet space. I hope the author realizes that nobody at MS will even consider his solutions.
I think this is a blatant attempt to just get paid by the page, even if the page contains nothing more than an image, I mean, come on, and a blatant attempt at free advertising on slasdhot. I fail to see why this even makes good news. But, that's just my two cents.
Well, you can turn UAC off? How about that for a security measure... A joke would be cheaper to develop than vista. sigh...
Granted, I have to set the ACLs on both directories and registry settings, but it's never been very hard.
Your Momma.
As in, ask Your Momma to do that.
You see, my mother uses a Mac and is able to install updates herself and keep things running just fine, all without knowing what an ACL is much less how to set it.
Saying the average user needs the equivilent of a car mechanic to deal with computers is just sweeeping the issue under the rug and letting Microsoft off the hook for a half-assed solution to the problem. And also ignoring there are a hell of a lot more people that can fix thier own car problems than computer issues.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I'm glad windows is finally gonna know how to say "I need credentials, please provide an administrator password" when you want to do something that requires said permissions.
OSX's been doing this for 6+ years. It's annoying to always be hit with a "permission denied" error when trying to do things as a limited user, then realizing that I've gotta log out and back in as an admin.
all I can say is FINALLY.
...spike
Ewwwwww, coconut...
I'm not saying UNIX is "better," since the primary issue here is social, not technical. If UNIX were in Windows' shoes, then third-party applications and slickly packaged malware would be popping up dialogs reading, "This application requires root priviliges to install. Please enter the root password: _____" So UNIX's user model doesn't really solve the base problem. However, I've been using Windows (mostly for gaming) for a while now, and I run with administrative privs all the time, because running as a limited user (in the UNIX sense) just doesn't work. Or, perhaps more precisely, it doesn't Just Work.
So what's the deal?
Schwab
Editor, A1-AAA AmeriCaptions
Good thing we'll never have to worry about these issues, since Vista seems to be delayed at least once a month.
How else are they going to get you to upgrade?
Look, our new OS doesn't suck as much as the one of ours that you are currently using. For only $100's more you can "upgrade" and probably have to buy new hardware to run it on as well.
When I have a kid, I want to put him in one of those strollers for twins and then run around the mall looking frantic.
Every time that box pops up, just think to yourself:
"Good thing spyware can't click this button."
Windows has more viruses because linux has more virus coders.
Hey that is worth the click. Trick or treat goatse.
everyone's still bummed out about the delays announced in the past few weeks. It's almost like someone is pulling the strings thusly:
PR machine: "Yeah, we know you feel real let down by the delay but OOH, LOOK! Something SHINY! Right.. over.. THERE!"
Teaming masses: "Ooh, we love shiny things. Vista is going to be so great again!"
There is simply too much glass..
I'm curious how this handles applications that constantly modify system settings inappropriately. Does it prompt you every time, or just once? Does it remember the setting? Ex: Most games still save their save files into C:\Program Files. When I save my game, am I booted from my DirectX environment back to the desktop to answer the prompt? If so, does it happen every time I save? Or can it work like a firewall and say "let me do this every time."
I just measured things on my 1280x1024 screen. Excluding browser menus, toolbars, scrollbars etc, the window is 1265x856 pixels. The content occupies a 414x331 portion of the screen. This means that 87.3% of the area is junk.
The UAC's involved in this now, too? All hell's gonna break loose.
ya know, i have been running vista 5365 and the first thing I did was to turn off UAP... It's still horribly implemented and the screen black out is kind of annoying too.. i know why they did it, because of the supposed spoof that could be displayed where users click ok thinking its the cancel button, but it would have been better if the screen simply faded to gray rather than look like a resolution change to the input screen... also, its still waaay too frequent. when you have to enter your password for deleting shortcuts thats silly... furthermore, i personally think that it should be more like web browser password memory. while you have one particular section open, you put your password in once and it works until you close that particular section, such as the device manager section or copying files to a location or something like that. It needs to have better AI. The good news is they'll have plenty of time now that Vista has been delayed to fix that :D. Vista can be better than XP. Given that its been 5+ years since XPs release thats not too much to ask for, but I wish it could have been better. Aero is not as nice as aqua but if microsoft releases the API for aero and makes application developers able to integrate their gui better into aero, that will go a long way. Right now, many applications stick out a bit with the transparent windows and nothing else that blends into that theme. IE7 and media player look better in Vista because they were designed for it. Hopefully this won't be like the Office API where that looked nicer than the API that other developers were given to develop with. (i dont know too much about that but anyway better application integration with aero would be a big plus) We'll see how it turns out...
Here are the simple solutions all the windows experts are missing:
Set yourself up as the owner of all files on the drive.
Set full permissions to all files to the "user" group.
Oh gosh gee. I don't know how we could have been so stupid. Please forgive us for doubting the security, power, and flexibility of Microsoft operating systems.
Dear Microsoft "experts": You just permanently lost the user privilege security argument, and you probably don't even know why.
[YES] [NO] [CANCEL]
You selected YES - please enter administrator password:
This issue is a bit more complicated than you think.
You can use the free program AutoIt
; Example AutoIt script to run a program as admin
RunAsSet("Administrator", "", "adminpassword")
Run("C:\Program Files\example\foo.exe")
RunAsSet()
The script can be compiled into a stand-alone executable so that you don't need your password sitting in a plain text file on your hard drive
I got this from somewhere:
Start an elevated command prompt window, and from that window run secpol.msc.
Find all the policies that start with "User Account Control" (there are only, like, six of them) and set them to either no prompt or disabled.
That's all there is to it. You'll never need to "run elevated" and you'll never be bothered by those pop-ups again
Thank you, whoever posted this fix.
wake up and hold your nose
Try doing something like, oh... creating a symlink from the command line. (Yes: Vista has real symlinks).
Turns out, at least in the beta that I'm using, that you can't do this. Even if you belong to the Administrators group. In order to accomplish the task, you have to actually *log in as the Administrator account*. Completely retarded.
I can't think of them off the top of my head, but there are other instances where being in the Administrators group didn't offer the same level of permissions as *being* Administrator.
It will further de-sensitize people to clicking "okay" whenever a fucking popup pops up. You want the warning boxes to be so rare that the user actually stops and thinks.
Secondly, get a Mac. It doesn't take a dedicated mechanic to keep a Mac happy. And Macs use the old *nix security model. There's no reason to claim that a computer needs a mechanic.
From that review, it seems that running as a regular user will be easier under Ubuntu today than under Windows whenever it is released. There's no excuse for that.
But, if you disable the run elevated functions, wont the popup be replaced with a dialog that says "This program needs administrator priveleges to run. Unfortunatly, you disallowed elevating you, dumbass. please log on using an account capable of running this."
Windows has more viruses because linux has more virus coders.
Just go to the UAC blog. They tell you how to really turn it off:
6 6.aspx
http://blogs.msdn.com/uac/archive/2006/01/22/5160
<a href="linkURL">linkDescription</a>
Man, you really need that seminar!
Most games still save their save files into C:\Program Files.
Games certified to run on Windows Vista don't. Instead, they'd use SHGetFolderPath() to look up the current user's My Documents folder and end up saving to e.g. C:\Documents and Settings\Pinocchio Poppins\My Documents\GTA Hot Coffee\ or something like that.
Actually, Windows has always had SUDO. A limited user can right-click the icon and select "run as." It will then prompt them for credentials. It really isn't that different from how other OS's work. You can also do it from the command-line.
To modify Windows to operate the way other OSs do (prompt you the password at the right time) is trivial. They could just modify the user interface to prompt when you run the app. I modified the shortcuts in my "Administrative tools" folder to do this.
Microsoft's boneheaded mistakes are that:
1) They didn't do this by default.
2) The UI takes at least 3+ to do what requires 0 clicks in Linux.
- Windows: Right-click, run as, other user, type user name, tab, type password, enter.
- Linux: Click, type password, hit enter.
3) They don't support, or encourage 3rd-parties to support, non-administrative users.
4) They don't clearly separate administrative actions from normal ones.
Ex: "System restore" and "Windows Update" are under Accessories along with "Calculator".
As I understand the article, EVERYONE in Vista is a normal user. Administrators have the ability though to take administrator actions on a case by case basis after supplying credentials.
To me, this sounds exactly like "sudo" under unix/linux or the "Authenticate: blahblah requires that you type your password" under Mac OS X. This model is more secure and works great, but there are some legacy transition issues.
For you unix people, the problem the article describes is, "what if you mount an old drive, the drive has restrictive permissions, and the file owner UIDs don't match the new system?" (your user account doesn't have permission to do anything on the drive)
NTFS has file permissions, but they rarely came up in practice because everyone in Windows was doing everything as the Unix equivalent of root. In Unix, the obvious fix is to do a sudo chown -R newuser /mnt/olddrive (or an ultraghetto sudo chmod -R o+rwx /mnt/olddrive) . The user/permission concept is totally foreign to your average windows user though, and hence the problem.
"That's one doomed space-marine!"
Anybody who needs instructions on how to disable something using gpedit has no business running a beta operating system that was intended for a serious testing audience.
Come to think of it, having a meaningful conversation about an un-finished product is also quite silly. Ok, so in the light of this, I offer this comparison / excersize.
Test 1.) In Windows Vista, make a shortcut to a program you know needs admin to run. Time this part Click the icon, then click the resulting dialog as quickly as you normally would to grant it permission.
Test 2.) In Linux (for argument, lets say Ubuntu) pop open a term. Think in your head the name of an app or process / shell script that needs root or super user to run. Time this part type sudo then the name of the program or command.
Did clicking the box take longer than typing SUDO? meh. what a shame were wasting so much of slashdot's disk space on a coversation over a few milliseconds.
Windows has more viruses because linux has more virus coders.
I like the options "Continue" / "Skip" / "Cancel". Very obvious for a normal user what the difference between Skip & Cancel is ;-)
What's worse is that there is no way to distiguish between authentic "User Account Control" dialog and a fake one that is poped up by a malicious application trying to collect admin credentials.
Unless Vista allows customizing generic "UAC" dialog (with an image or a text) or easily authenticate it in some other way, UAC being ON appears to pose a greater risk to a system security then when it is OFF.
3.243F6A8885A308D313
What dialog boxes need is a quiz at the end instead of an OK button.
Instead of:
Format C:
This will erase all data on this disk!
OK?
It would be:
Format C:
This will erase all data on this disk!
Erasing means:
1. My data will be copied to Microsoft for safety in case I miss it later.
2. My data will be scanned for dangerous viruses.
3. My data will be GONE and I will NEVER SEE it again.
Enter the correct answer: ___
And of course, the questions would be randomly selected from a list, so the user cannot memorize "3" as the correct answer.
ha ha, u made the funnay ha ha!
how refreshing to hear a joke about microsoft, don't see that often here.
ha ha, thanks for sharing.
I really cannot think of a scarier idea than Microsoft working with the Union Aerospace Corporation.
# cat
Damn, my RAM is full of llamas.
Jawtheshark sed:
"Oh, and those that say that you can't run in Limited User on XP (as in the fine article is stated) are completely ignorant. I'm running Limited right now, and I have no problem. Granted, I have to set the ACLs on both directories and registry settings, but it's never been very hard. The only program I've never been able to run as non-admin is a game called "Children Of The Nile", and I still don't know how to run it as a Limited User. The user that needed it got the "Run As" option checked in the shortcut. Sure she has Admin access that way, but she's my sister and knows that she shouldn't run Admin."
Jeezus that's as difficult as editing config files to get your mouse or sound to work on Linux. If you really think Joe Six pack is going to edit their access control lists to enable their limited user account on XP you are really dreaming. Even if Joe Sixpack figures out how to use access control lists they are going to be damn annoyed to go to all that work and STILL not have all their programs work, I know I'd be annoyed...
At the risk of sounding like an utter Mac fan boy, OS X gets it exactly right, it creates a user level account and no root account by default and then has a slick gui that (sudos or sus???) and asks for a password ONCE when you install software that modifies system files. Cleanly implemented and secure what's not to like? That's the way a secure simple desktop OUGHT to work.
Ubuntu Linux is set up in a similar fashion though I had to modify xorg conf files to get my mouse working and NEVER got sound working despite RTFM, ubutu forums, blah, blah. Linux/BSD makes a great server but isn't ready for the desktop and NEITHER is Windows.
Tired of all the isms, don't exploit people as an employer, or a government, mmmmK?
privilege escalation attacks.
What's the likely outcome when $USER hits a web site that says "download this and type in your administrator password to get DANCING WEATHER REPORTS!"?
runas /user:administrator cmd
This will give you a root shell. Just spawn whatever applic that need admin rights there. Only thing that can't run that way on winxp is the file manager(explorer), which is already running as the current user's desktop manager. One can spawn IE and use it as file manager though.
I usually have cygwin installed and use Bash root shell instead. cmd sucks cock.
You are one to talk. Giving the "BUILTIN\users" security principal full controll is all that's neccessary. Taking ownership of the files would be at best redundant, and at worst, completely useless.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
If it's so obvious, why can't they just make it a built-in part of the operating system anyway? I'm sure that there's got to be some sort of secure way of doing so. I know that if I were Microsoft, I'd want to provide all the "obvious fixes" as part of the default install, no stupid tweaking involved.
Creative misinterpretation is your friend.
"My wifes computer was spyware ridden machine until she met me. I'm the mechanic."
So what you're saying is that PCs are so frustrating to use that women will actually marry losers just to keep Windows working properly?
Wow.
Here's where you saw that:
http://www.osronline.com/article.cfm?article=461
This feature, file system and registry virtualization, is something I'm very glad to see in Vista. It will act as a stop-gap until programs are written properly so they don't require admin level access just to run them.
It's called sarcasm, jackass. My point is that it is most certainly not simple.
Because it is data not intended to be viewed or manipulated by the user directly.
Define "manipulated directly". Most people do not hex-edit Microsoft Word documents, yet they're still documents.
While a save file may "document" my progress in a game, it isn't a document in any common sense of the word.
Which "common sense of the word" are you talking about? Unless you state otherwise, I'll use the computer science related definitions in American Heritage Dictionary:
And the same dictionary defines an "application" as "A computer program with a user interface." Going by the strictest application of this definition, even a spreadsheet isn't a "document" in the common sense of the word, as each cell may contain a declarative program written in the spreadsheet app's formula language and executable in the spreadsheet app's built-in interpreter.It isn't like I am using Windows for much more than playing games.
Perhaps an argument by analogy might help: Where should a Linux game's saved states go?
ObTopic: Unless this dilemma between Application Data and My Documents is solved, Windows game developers will just not bother changing the saving code that currently writes to Program Files, Windows games will continue to require administrator privileges, and Windows games will continue to pop up the sudo style dialog boxes described by The Article.
My Documents is intended for documents that the user will manipulate directly. That includes renaming and moving to subfolders. If you do either one of those things to saved games, the game will have problems.
A lot of games for Windows and Mac OS that I've played use either the operating system's common open and save-as dialog boxes, or an appropriately themed workalike, for loading and saving games. If you move or rename a saved game, nothing will happen except that you have to navigate through the file system to find it. Quicksave is just Ctrl+S in a word processor, and quickload is just revert.
I thought maybe if I printed it, and previewed as a pdf, I'd have a reasonably easy version to read. I was wrong. It created a pdf of the current page (10% content/90% banner, ads & other garbage), then my browser froze with a stupid 'Processing page:2' dialog box.
I stopped viewing zdnet a long time ago, now I remember why.
I find everything about MS V**** offensive.
This looks like early stages of fooling around with new security models. Interesting, but extremely irritating in implementation. To their credit, they seem to have finally accepted a decent security approach, but somehow I doubt they will try to force this on people or get it working managebly by 2007.
For every expert, there is an equal and opposite expert. - Arthur C. Clarke
So, in essence, he's saying you can get around Vista's UAC nag screens by making yourself have Full Control permissions on everything.
"Duh."
Not that I recommend doing such a thing.
What'll be more interesting is seeing how OEMs preconfigure Vista PCs. Joe Sixpacks most assuredly don't want to know of or care about Administrator credentials. They just want Deer Hunter 5 to install. Now. If it works on their old XP computer without raising dialogs, but raised dialogs on their new Vista PC, they'll return it as defective and/or flood the phone lines of third world country call centers.
Up, Up, Down, Down, Left, Right, Left, Right, B, A, START
NTFS and win xp pro are great. why?
... t-hehehe).
:))
first i can surf the web as a limited user and
click any damn like i want. if i get infested with
spyware, virus etc. i just delte the user account
and make a new one. problem gone!
(mind you if i get hit by a buffer overun
or such NTFS file permissions aren't going to
safe me, but that's a problem for all OSes).
second i can install a "trial" version of
any program, in my case 3ivx codec. they work for
30 days. BUT if i access the codecs as limited user
only, after 30 days, it pops-up a "yadda yadda" 30 days
expire, BUT WILL STILL WORK, because since i'm
accessing the codec as limited user, the codec (or install
routine whatnot) CANT delete or block me from accessing
the codec. (of course once im stupid enough to use
the codec after 30 as admin it'll be gone
third: bragging rights.
please MS: for VISTA, if i'm admin i'm FREAKING admin, k?!
(looks over to suse box)
Basically, as I see it, Vista UAC is sudo done the wrong way. Nobody will tolerate dozens of popups asking for permissions, and sometimes you can't even know what they ask for (e.g. when doing something with lots of files they might popup for every file asking permission for some file operation). If a spyware/trojan/etc. want to do something and you get a file-operation-permission-asking popup, people will probably just automatically click on allow-and-go-the-f*-away button. Well, if they don't disable the whole UAC from the beginning.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
Is it just me, or does reading this feel like playing nethack, only less rewarding? -- more --
This is not the greatest sig in the world. This is just a tribute.
Your mommy has a Mac.... That's fine... but how Mircosoft has handled security, there is no way to go to the "Mac Way". My Mommy has a WinXP machine and she doesn't need any intervention either. Go figure... (Of course, that's partially because of the OpenBSD firewall and the obligation of useing Firefox)
Your rug you are sweeping the issue under is the OpenBSD firewall and Firefox. My "Mommy" has just an OS X box directly connected to the internet, with no further need of external security devices to confuse her (and support people she might need to talk to for her ISP). Because there are no open ports I do not need to worry about external intrusion, only spyware/viruses coming via the web or email - your solution really doesn't address that any better than mine does as vulnerabilites can exist in any browser (though of course it's a better choice than IE).
Fundamentally though the Mac security model lets any exploit through the web embed itself to a lesser degree than on a Windows system, such that a software update would likley be able to remove it and thus require no intervention on my part.
"There is more worth loving than we have strength to love." - Brian Jay Stanley