Slashdot Mirror
"Very Severe Hole" In Vista UAC Design
Cuts and bruises writes "Hacker Joanna Rutkowska has flagged a "very severe hole" in the design of Windows Vista's User Account Controls (UAC) feature. The issue is that Vista automatically assumes that all setup programs (application installers) should be run with administrator privileges — and gives the user no option to let them run without elevated privileges. This means that a freeware Tetris installer would be allowed to load kernel drivers. Microsoft's Mark Russinovich acknowledges the risk factor but says it was a 'design choice' to balance security with ease of use."
Why not just let the user copy the application bundle to wherever they have write permissions? That application then executes with the privileges of the user that invokes it. If only there was a platform that offered such a simple an effective solution.
Why bother.
no doubt, thats why Dell is marketing its harware for Vista as great for "booting the OS, w/o running apps or games" (link via this)
Since when did booting an OS become a "feature" of the OS?
Video version of the above commentary here.
Looks like "Ease of Use" is the morbidly obese 10-year-old kid on this see-saw, and "Security" is up in the air with her legs dangling, and all the kids are lookin' up her skirt.
"Was it a millionaire who said 'Imagine No Posessions?'" -- Elvis Costello
You want to run an application, is that okay? You want to copy a file, is that okay? You want to change your desktop background, is that okay? You want to copy text from IE7, is that okay? You want to turn your machine into a child porn and warez server, is that okay? You want to delete an old text file, is that okay? You want to paste text into a form field in IE7, is that okay?
One of these things is not like the others,
One of these things just doesn't belong,
Can you tell which thing is not like the others
By the time I finish my song?
Done with slashdot, done with nerds, getting a life.
Wasn't it the failure of the UAC that allowed the demons from hell to infiltrate Earth?
I guess MS didn't learn anything from id.
Beauty is in the eye of the beerholder.
seems like you are coming to a sad realization cancel or allow?
The war with islam is a war on the beast
The war on terror is a war for peace
I see *someone* never used Windows 95!
Watch for Penguins, they eat Apples and throw rocks at Windows.
Your post is even funnier if you read it out loud in the Simpson's "Comic Book Guy" voice.
Did you try your 8mm player?
I think a full bootup a victory on Windows ME would be even more excuse for celebration.
This sig isn't original enough, it's time to come up with something witty...
Sounds like Clippy has been re-incarnated.
*shudder*
liqbase
Sorry, did I miss something? I was too busy clicking "Allow" 7 times to notice which one was bad. None of them were bad, were they?
Vista: This is from AMD. Do you trust AMD? .....
Me: yes, they pay me. I trust them. (click)
Wait, you TRUST your employer? What is this board coming to?
He did warn us that if we struck him down he would become more powerful than ever.
Maybe we should have listened.
"You are coming to a sad realization. Cancel or Allow?"
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
Mac: "Hi, I'm a Mac."
Security: "Mac is attempting a salutation; allow or deny?"
PC: "Allow."
Mac: What's up PC?"
Security: "Mac is asking a question; allow or deny?"
PC: "Allow--yeah, um, it's this new security feature built into Vista. It's a little annoying, but it makes security rock-solid."
Mac: "Oh yeah? Well, that's cool--hey, want to play a game of Tetris?"
Security: "..."
PC: "Tetris? Well I'm a bit rusty, but--hey Security, how come you didn't say anything?"
Security: "Pfft--It's Tetris, I mean, I don't give a shit..."
PC: "Well, OK, I just thought it was kinda odd that you didn't ask. So Mac, refresh my memory, how do you play this game ag--"
Mac: "F**K YOU BUDDY!"
Mac takes out Vista Security guard with Uzi.
PC: "Whoa! What is this Mac, I thought we were down?"
Mac: "DOWN ON THE FLOOR MOTHER F**CKER!"
Mac shoots PC with Uzi; PC blue-screens.
Mac takes picture of blue-screened PC, saves it to cool photo album he created with iLife! [TM]
Classic windows security. You can either do anything, or you can't even change the background picture.
Only three things are certain; death, taxes, and apocryphal quotations - Ben Franklin.
Wish I had mod points.
You have just clicked yes. Did you really want to click yes?
The Tao of math: The numbers you can count are not the real numbers.
I don't know why everybody harshes on ME. Sure, you have to beat it into coma before it behaves, but after that, it's almost as good as windows '98!
Linux, you magnificent bastard, I read the fucking manual!
'Microsoft's Mark Russinovich'
Boy is THAT ever true!
Because on Linux/Mac, sudo allows one preemptive security check to enable a process to do multiple admin tasks, where UAC prompts on each action. This is analogous to house training a dog. Sudo gets the dog to ask to be let out where he takes care of business. UAC gets the dog to ask: Can I piss on the carpet, then can I do a dump on the rug, then ...
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Whose gonna do it? You? You, Slashdotter? Windows has a greater responsibility than you could possibly fathom.
You weep for Tux, and you curse the DRM. You have that luxury. You have the luxury of not knowing what Windows knows.
That Tux's death, while tragic, probably saved lives. And Window's existence, while grotesque and incomprehensible to you, saves lives.
You don't want the truth because deep down in places you don't talk about on Slashdot, you want Windows on that firewall, you need Windows on that firewall.
Windows use words like honor, code, loyalty. Windows uses these words as the backbone of a codebase spent defending something.
You use them as a punchline. Windows has neither the time nor the inclination to explain itself to a Slashdotter who rises and sleeps under the blanket of the very freedom that Windows provides, and then questions the manner in which Windows provides it.
Windows would rather you just said thank you, and bought copies for your entire extended family. Otherwise, Windows suggests you pick up a browser, and send a POST.
Either way, Windows doesn't give a damn what you think you are entitled to.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Great, it's Darth Clippious.
Are you sure you want to cancel the operation?
[ OK ] [Cancel]
PopeRatzo: "DirectX10? It's going to take more than DirectX10 for me to accept my computer as a spy in my home."
Microsoft: "Well, what if we give you a nicer looking start menu too?"