Slashdot Mirror
Windows 7 To Dial Down UAC
Barence writes "Engineers working on Windows 7 have admitted Vista's User Account Control was too intrusive, and are promising to tone it down in the forthcoming Windows 7. 'We've heard loud and clear that you are frustrated,' says Microsoft engineer Ben Fathi. 'You find the prompts too frequent, annoying, and confusing. We still want to provide you control over what changes can happen to your system, but we want to provide you a better overall experience.' According to Fathi, when Vista first launched, 775,312 unique applications were producing prompts — so some may be annoyed that it won't be scrapped entirely, but at least Microsoft is listening. The comments echo those of Steve Ballmer, who admitted at a conference in London that 'the biggest trade-off we made was sacrificing security for compatibility. I'm not sure the end-users really appreciated that trade-off.'"
Of course most users are going to just click "OK", but how can the more tech-savvy users(you know, the ones who actually read the boxes) actually know what they're approving when the dialog boxes say such laughingly vague shit like "File operation - continue or cancel?"!
No, don't write secure software, staple on a bunch of dialog boxes to shift the onus onto the user.
Trolling is a art,
It's Security vs. Pain In Your Ass for No Reason that is the problem. If I click Windows Update, why should I then immediately need to allow it? I just clicked on it!
In most Linux distros, if you do something that requires admin access, it asks you for the admin password and holds onto privileges for a little while. That way, if I rearrange a bunch of icons I don't get 100 different prompts. This is simply common sense. It amazes me that the Microsoft developers didn't get fed up with the prompts and do the obvious thing.
If you're not installing Vista for enhanced security, why exactly are you installing it?
... how getting computer users to blindly click through continuous, repetitive, and annoying dialog boxes kept computers more secure in the first place. It would seem under any reasonable analysis to do the opposite.
If someone says he and his monkey have nothing to hide, they almost certainly do.
It would be a much better idea to force every programmer to run under a non-Administrator account (and no Administrators or even Power Users group membership either!) Anyone who complains is obviously writing bad code, since there is absolutely no friggin' reason that a regular application should require administrative privileges. Whatever you set during setup is IT! And, for God's sake, learn to open registry keys in read-only mode!
It's funny that Microsoft is trying to clean up the mess they've been producing for more than a decade (I'm being nice here), just to find themselves locked in just like the rest of us.
"It's too bad that stupidity isn't painful." - Anton LaVey
This problem of imbecilic prompts is directly related to the entire inane history of DOS and then Windows, where all the lessons of multi-user systems learnt decades before were wilfully and sanctimoniously ignored by the resident Microsoft "geniuses". Thus application "developers" were allowed to, and soon came to depend on, access to what in nearly every other OS in existence are "root only" subsystems. Even in editions of Windows which were supposedly multi-user capable, the prevalent lazy practice of majority of "developers" was to depend on system-wide registry keys, administrative privilege level processes and what not to accomplish most mundane of tasks.
And so now the chickens are home to roost, with literally hundreds of thousands of apps written to kindergarten competence levels. And Microsoft is in a bind: secure the OS and either break these stupidly written apps altogether, inundate the user with prompts every time one of them tries something stupid, or give up.
They are scared to death of the implications of the first choice, tried the second, and now seem to be heading toward that last one.
Seriously, why doesn't Microsoft spend its considerable resources helping fix UAC for Vista?
At this point, why would they when they could just charge people to upgrade? So many people stuck with XP that fixing UAC in Vista wouldn't do anything for them.
Or are they admitting defeat and preparing for the next battle (a.k.a. Windows 7)???
Not in words, but in actions. I have a feeling that in the future this version of Windows is going to be referred to in much the same way as we refer to Windows Me now.
The answer would have been simple (the implementation not so simple). You make a Legacy Windows emulator that runs inside Vista. This worked well for Apple's OS X. Though I am sure implementing this for Windows would have involved a lot more bloat than Classic did.
I see the glass as full with a FoS of 2.
The biggest security problem in Windows is that the design of the HTML control and ActiveX in conjunction with the "security zone" model is inherently insecure. It provides a huge surface are to remote code execution exploits that simply does not exist in any other web browser... or any other software on any other platform that uses HTML and HTTP. The problem is that it's an explicit and deliberate mechanism for an object that should never be trusted... that is to say, a remote website... to request full local application permissions and run unsandboxed code.
Until this model is changed and only explicitly installed applications can run outside the browser's sandbox, Windows is going to remain the poster boy for "insecure systems".
Being able to prevent an already compromised application from performing system administration tasks is laudable, but it's not really all that important to the user. Everything on their computer that they care about isn't owned by the administrator, it's owned by their regular user account. And there's plenty of places owned by the end user that malware can hide to keep being restarted after the computer is rebooted. UAC is a partial sandbox, at best.
Being able to restrict what the web browser can do after it;s been compromised is laudable, but since the browser has to be able to save files for the user, it can still inject an exploit into the users account. So the reduced privilege mode on Vista (and the much touted sandboxes on OS X) are leaky protection at best.
And leaky sandboxes, and partial sandboxes, are more useful in providing a false sense of security to the user than actually keeping malware out.
Getting rid of the "security zones" model and replacing it with hard impermeable sandboxes will cause some disruption. Programs like Windows Update will have to be rewritten to use plugins. ActiveX games will have to be rewritten as flash or modified to run in a full sandbox using something like .NET or a JVM. But this WOULD be a matter of trading off convenience for security. UAC is trading off convenience for the illusion of security. That's not the same thing at all.
I question the insight of the previous comment. Emulation wouldn't help an increase in security. If you emulate the previous lax security, then you haven't increased security. If you haven't emulated the old behavior well enough, its still bugging you with the UAC.
The really interesting thing about this is in the article where the reporter says that they've toned it down a bit , but the Microsoft spokesman only talks about programs changing to fit Vista's security model. Makes sense. Windows programs try doing all sorts of things they really shouldn't sometimes ( especially of the crapware variety).
Well.. maybe. Or Maybe not. But Definitely not sort of.
I wonder why it wasn't like OS X in the first place. On OS X, I only see the prompt if I try to install software, install a system update, or click a lock in System Preferences to enable editing of certain preferences. Once in a while I also see it if I'm doing something with a folder I don't have access rights to by default, which is rare.
UAC was, by Microsoft admission, designed to be as annoying as possible. This was a HUGE mistake, because that is precisely how, aside from security holes inherent to Windows' architecture, that spyware got to be so ubiquitous. I have clients who by their own admission will click "yes" to every damn dialog just to get them out of the way and get back to work. One of them said they'll keep having us come back to clean up their computers rather than change their behavior. I know I should be glad for the repeat revenue, but it's damn annoying when I know it could have been designed a lot better.
Why couldn't UAC either:
1. Elevate the user's privileges globally for a period of time, like sudo on *nix, or the analogous mechanism in Apple's OS X desktop environment?
2. Elevate the privileges of that process for a period of time?
3. Just inform the user "You must log in as Administrator to perform that task." and then disable UAC while logged in as Administrator (hey, that would be just like *nix! No nagging "are you sure" B.S. when root!)
4. Ditch backwards compatibility, relegating it (backwards compatibility) to a VirtualPC-sandboxed WinXP environment?
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
On a modern linux installation, the number of times you need to log in as root to do ordinary stuff is ZERO. All of those desktop things that you used to have to do as root is now being done by setuid programs or other such carefully designed gateways.
My wife uses my linux laptop all the time and does all kinds of useful things on it and she does not know the root password.
This kind of moderating is a special pet peeve of mine.
UAC is first and foremost a masterful artifice disguised as security. It's a blame shifting mechanism. OS compromise? It's your fault.
Someone within that organization that dreamed up a system that doesn't provide privilege separation in order to *perfectly* shift the blame to the user.
Another part of that organization sold it as sudo-like and some of the moderators probably believe it is. This kind of belief is the unshakable variety, like Intelligent Design.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
The entire point of UAC was to force Administrator to be a standard user, that way bad developers couldn't hide their violation of documented security guidelines by just telling their users to run as Administrator. The only solution was to lock down Administrator so that it is just as constrained as a standard user and require the user to permit actions which extend beyond those of a standard user.
UAC is more about forcing the developers to acknowledge and follow the documented guidelines than it is to constrain the users. UAC is temporary. Once a critical mass of applications follow the guidelines Microsoft can cut it, default everyone to a standard user and allow Administrator to be Administrator again, although probably hidden from the user until they intentionally elevate.
Also: whenever you try and run a poorly-written program.
The program is more a problem with all previous versions of Windows than with Vista. Previous versions lax security allowed developers to do stuff that should only have been allowed to happen under UAC. Because Microsoft allowed the lax security to continue on for so long, there are heaps of programs that assume access to things they shouldn't have, and don't really need.
As other's have pointed out, sudo is a similar mechanism under Linux. The difference is that Linux developers, used to a long-standing robust security model, try to avoid wherever possible occasions which require sudo access. Vista's UAC was a necessary step. It's needed to start retraining developers to write properly. But it's still annoying as hell for the users, and it doesn't really provide any near-term benefits to them. The benefits will be long-term, when developers have wised up and legacy programs have been phased out or re-written. Then UAC will only popup when absolutely necessary, there won't be the click-it-away immediate response, and Windows will be all the more secure for it.
At the moment, MS customers are reaping the consequences of MS' decision to put off the inevitable as long as possible. If they'd bitten the bullet earlier, the poor development techniques would be much less entrenched.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face