Slashdot Mirror
Windows 7 To Dial Down UAC
Barence writes "Engineers working on Windows 7 have admitted Vista's User Account Control was too intrusive, and are promising to tone it down in the forthcoming Windows 7. 'We've heard loud and clear that you are frustrated,' says Microsoft engineer Ben Fathi. 'You find the prompts too frequent, annoying, and confusing. We still want to provide you control over what changes can happen to your system, but we want to provide you a better overall experience.' According to Fathi, when Vista first launched, 775,312 unique applications were producing prompts — so some may be annoyed that it won't be scrapped entirely, but at least Microsoft is listening. The comments echo those of Steve Ballmer, who admitted at a conference in London that 'the biggest trade-off we made was sacrificing security for compatibility. I'm not sure the end-users really appreciated that trade-off.'"
Does it really have to prompt me every single time? After prompting me to run the same program 5 times, couldn't it just ask me if I want to white list that program until the executable changes?
t
Actually, their plan was to make it annoying in order to force developers to fix their apps so they don't require so much administrator access.
It's hard to fault them for their motivation, even if the execution perhaps left something to be desired.
Yes, Linux does it right. The problem for Microsoft, however, is this: most programs written to run on Linux are written such that they can run without root-level privileges. Most programs written before the advent of Vista assumed that Administrator privileges were available by default.
That assumption is no longer true. Since the number of programs is so enormous (the 775k mentioned in the summary), it's easier to deal with the privilege-escalation by putting in something like UAC than it is to fix every faulty application. Hopefully, developers have now learned to assume least privileges, so new programs won't require elevated privileges.
I don't think anyone will agree that UAC was the best way to handle the situation, but it sure was the easy way out. As an earlier poster said, better sandboxing could handle the issue better, but it's obvious that the investment (money and potential schedule problems) wasn't worth it from MS's point of view.
Help find a cure for cancer. Join the [H]orde
If you're trying to get permissions correct to eliminate these type of prompts in a corporate environment (or make an app work in a locked down pre-Vista environment) I can't recommend LUA Buglight highly enough. Basically it provides a way to record exactly what rights an application is requesting as you run it. I've used it mostly to get temperamental programs running as locked down users under Citrix but it should work fine to help reduce the amount of UAC messages under Vista.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Exactly! It is like trying to troubleshoot based on those worthless XP error boxes. You hit details and what do you get? The same rundll32 and NTdll no matter what application crashes. I swear those stupid hex codes they used in the old days were more useful! At least with those you could look up the hex code and get a rough idea which subsystem is screwing up. Now I keep dependency walker,diskmon and filemon just to try to figure out a bug.
ACs don't waste your time replying, your posts are never seen by me.
You can't really be vague about a file. If I want to gain access to a system file, I pretty much have to do it by name. Also, Windows is blocking it for some reason. Why does that reason have to be hidden?
"Oh, I see you have peon user rights, but you need power user rights to gain access to c:\winnt\notepad.exe"
"______ program needs access to a restricted part of the registry to be able to read/write data.
Cancel/Allow?
(Click here to more details on the requested operation) >>
someapp.exe is trying to request access to HKLM\Software\Microsoft\Windows\CurrentVersion\ProductKey"
And while we are on it... you should at least be able to specify conditional allowance. (Cancel | Allow This | Allow All)
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
No, they specifically broke runas in a command prompt window in vista in favor of the right click -> run as administrator (bing UAC) route.
It was a totally stupid idea. Even going with a runas which then triggered UAC to gain the required privileges would have been a better plan that no runas command.
Bryn
Or words to that effect