Slashdot Mirror
Windows 7 To Dial Down UAC
Barence writes "Engineers working on Windows 7 have admitted Vista's User Account Control was too intrusive, and are promising to tone it down in the forthcoming Windows 7. 'We've heard loud and clear that you are frustrated,' says Microsoft engineer Ben Fathi. 'You find the prompts too frequent, annoying, and confusing. We still want to provide you control over what changes can happen to your system, but we want to provide you a better overall experience.' According to Fathi, when Vista first launched, 775,312 unique applications were producing prompts — so some may be annoyed that it won't be scrapped entirely, but at least Microsoft is listening. The comments echo those of Steve Ballmer, who admitted at a conference in London that 'the biggest trade-off we made was sacrificing security for compatibility. I'm not sure the end-users really appreciated that trade-off.'"
Of course most users are going to just click "OK", but how can the more tech-savvy users(you know, the ones who actually read the boxes) actually know what they're approving when the dialog boxes say such laughingly vague shit like "File operation - continue or cancel?"!
If you started this, or you trust this process, please click OK.
*DISABLE IT*. http://www.mydigitallife.info/2006/12/19/turn-off-or-disable-user-account-control-uac-in-windows-vista/
(Now, does that now make my Vista SP1 more 'Windows 7ish'?)
Other methods here: http://www.google.com/search?hl=en&safe=off&q=How+to+disable+Vista+UAC
No, don't write secure software, staple on a bunch of dialog boxes to shift the onus onto the user.
Trolling is a art,
Seriously, why doesn't Microsoft spend its considerable resources helping fix UAC for Vista? Do it as part of SP2... Since answering UAC is modal (systemwide), it's not like any user-level apps "depend" on it behaving in a specific way/at specific times, so changing its behavior should have no negative effect on those apps...
Or are they admitting defeat and preparing for the next battle (a.k.a. Windows 7)???
Windows 3.1x calc: 3.11 - 3.10 = 0.00
I couldn't be happier not having experienced the headaches mentioned in this article.
We figured out a long time ago that it's easier to elect seven judges than to elect 132 legislators.
In most Linux distros, if you do something that requires admin access, it asks you for the admin password and holds onto privileges for a little while. That way, if I rearrange a bunch of icons I don't get 100 different prompts. This is simply common sense. It amazes me that the Microsoft developers didn't get fed up with the prompts and do the obvious thing.
... how getting computer users to blindly click through continuous, repetitive, and annoying dialog boxes kept computers more secure in the first place. It would seem under any reasonable analysis to do the opposite.
If someone says he and his monkey have nothing to hide, they almost certainly do.
It would be a much better idea to force every programmer to run under a non-Administrator account (and no Administrators or even Power Users group membership either!) Anyone who complains is obviously writing bad code, since there is absolutely no friggin' reason that a regular application should require administrative privileges. Whatever you set during setup is IT! And, for God's sake, learn to open registry keys in read-only mode!
It's funny that Microsoft is trying to clean up the mess they've been producing for more than a decade (I'm being nice here), just to find themselves locked in just like the rest of us.
"It's too bad that stupidity isn't painful." - Anton LaVey
This problem of imbecilic prompts is directly related to the entire inane history of DOS and then Windows, where all the lessons of multi-user systems learnt decades before were wilfully and sanctimoniously ignored by the resident Microsoft "geniuses". Thus application "developers" were allowed to, and soon came to depend on, access to what in nearly every other OS in existence are "root only" subsystems. Even in editions of Windows which were supposedly multi-user capable, the prevalent lazy practice of majority of "developers" was to depend on system-wide registry keys, administrative privilege level processes and what not to accomplish most mundane of tasks.
And so now the chickens are home to roost, with literally hundreds of thousands of apps written to kindergarten competence levels. And Microsoft is in a bind: secure the OS and either break these stupidly written apps altogether, inundate the user with prompts every time one of them tries something stupid, or give up.
They are scared to death of the implications of the first choice, tried the second, and now seem to be heading toward that last one.
I know you could disable the UAC, but it wasn't as simple as typing 'su' and entering your root password.
If I'm root I want to be able to do ANYTHING with no questions asked. Kill the filesystem with one commandline? Sure. Kill my databases? Sure. Change settings of anything? Sure.
Yet the Administrator accounts in Windows get just as many annoying prompts (if not more) than the standard users. I should be able to configure rights below me easily to allow my standard user to not get bothered by prompts that they can just click through.
br I see it as a huge issue because is faux security with the UAC mostly. It creates warnings basically, but doesn't prevent action (mostly again).
Tibbon
tibbon.com
If you're not installing Vista for enhanced security, why exactly are you installing it?
Because I'm buying or building a new computer other than a subnotebook. Between June 2008 and December 2096, Windows XP is not available on computers other than subnotebooks, and I want to use applications that work better under Windows Vista than under Ubuntu with Wine.
Those who would give up Essential Security to purchase a little Temporary Liberty deserve Microsoft products.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
After the system, software is setup and running, I hardly run into any UAC prompt, except for one of the bank applications that for unknown requires admin privilege.
If Vista didn't push for that, we will need admin privileges to run Windows, forever, because of the bad design of applications!
There are, definitely, room for improvements, for example, combining the ActiveX Install prompt with UAC, reducing two to one. Combing the warning of running the Internet downloaded .exe and UAC, and allows a Explorer.exe to have the admin token for a while once granted, for those file manipulation operations.
All in all, I love UAC! It's more convenient than typing "sudo ..." for every commands i need to run at root's right.
If Microsoft only allowed products to show any kind of Windows logo if they complied with the security rules, this wouldn't be a problem. Microsoft loosened up on the logo program because developers weren't willing to bother.
This happened to Apple when they went to the PowerPC, and were dumped by many major software vendors. Apple wasn't in a position to order developers around, and they hadn't realized that. It took years to recover from that.
The answer would have been simple (the implementation not so simple). You make a Legacy Windows emulator that runs inside Vista. This worked well for Apple's OS X. Though I am sure implementing this for Windows would have involved a lot more bloat than Classic did.
I see the glass as full with a FoS of 2.
The biggest security problem in Windows is that the design of the HTML control and ActiveX in conjunction with the "security zone" model is inherently insecure. It provides a huge surface are to remote code execution exploits that simply does not exist in any other web browser... or any other software on any other platform that uses HTML and HTTP. The problem is that it's an explicit and deliberate mechanism for an object that should never be trusted... that is to say, a remote website... to request full local application permissions and run unsandboxed code.
Until this model is changed and only explicitly installed applications can run outside the browser's sandbox, Windows is going to remain the poster boy for "insecure systems".
Being able to prevent an already compromised application from performing system administration tasks is laudable, but it's not really all that important to the user. Everything on their computer that they care about isn't owned by the administrator, it's owned by their regular user account. And there's plenty of places owned by the end user that malware can hide to keep being restarted after the computer is rebooted. UAC is a partial sandbox, at best.
Being able to restrict what the web browser can do after it;s been compromised is laudable, but since the browser has to be able to save files for the user, it can still inject an exploit into the users account. So the reduced privilege mode on Vista (and the much touted sandboxes on OS X) are leaky protection at best.
And leaky sandboxes, and partial sandboxes, are more useful in providing a false sense of security to the user than actually keeping malware out.
Getting rid of the "security zones" model and replacing it with hard impermeable sandboxes will cause some disruption. Programs like Windows Update will have to be rewritten to use plugins. ActiveX games will have to be rewritten as flash or modified to run in a full sandbox using something like .NET or a JVM. But this WOULD be a matter of trading off convenience for security. UAC is trading off convenience for the illusion of security. That's not the same thing at all.
I've recently upgraded at work from XP to Vista 64 and I really like it. I hate it when I go back to XP now - where's my search?!!! Start button, app title, , it's just ruddy marvellous.
As a developer too UAC makes it much more realistic to develop and test under LUA scenarios.
I don't really get many UAC prompts. What's all this talk about rearranging menu shortcuts? Why the heck would you do that when you can just type the app name and press ENTER using LiveSearch.
I guess I'll be modded down for admitting to liking Vista but am I really alone?
I question the insight of the previous comment. Emulation wouldn't help an increase in security. If you emulate the previous lax security, then you haven't increased security. If you haven't emulated the old behavior well enough, its still bugging you with the UAC.
The really interesting thing about this is in the article where the reporter says that they've toned it down a bit , but the Microsoft spokesman only talks about programs changing to fit Vista's security model. Makes sense. Windows programs try doing all sorts of things they really shouldn't sometimes ( especially of the crapware variety).
Well.. maybe. Or Maybe not. But Definitely not sort of.
I wonder why it wasn't like OS X in the first place. On OS X, I only see the prompt if I try to install software, install a system update, or click a lock in System Preferences to enable editing of certain preferences. Once in a while I also see it if I'm doing something with a folder I don't have access rights to by default, which is rare.
UAC was, by Microsoft admission, designed to be as annoying as possible. This was a HUGE mistake, because that is precisely how, aside from security holes inherent to Windows' architecture, that spyware got to be so ubiquitous. I have clients who by their own admission will click "yes" to every damn dialog just to get them out of the way and get back to work. One of them said they'll keep having us come back to clean up their computers rather than change their behavior. I know I should be glad for the repeat revenue, but it's damn annoying when I know it could have been designed a lot better.
Why couldn't UAC either:
1. Elevate the user's privileges globally for a period of time, like sudo on *nix, or the analogous mechanism in Apple's OS X desktop environment?
2. Elevate the privileges of that process for a period of time?
3. Just inform the user "You must log in as Administrator to perform that task." and then disable UAC while logged in as Administrator (hey, that would be just like *nix! No nagging "are you sure" B.S. when root!)
4. Ditch backwards compatibility, relegating it (backwards compatibility) to a VirtualPC-sandboxed WinXP environment?
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
On a modern linux installation, the number of times you need to log in as root to do ordinary stuff is ZERO. All of those desktop things that you used to have to do as root is now being done by setuid programs or other such carefully designed gateways.
My wife uses my linux laptop all the time and does all kinds of useful things on it and she does not know the root password.
I can see you're a little slow, and don't actually know anything about how computers work.
A program gets an "event" as it's called, something like MouseClick or something. These events can be generated by MORE than than just the mouse... it allows automated GUI testing programs, letting a click on a transparent "top" window be filtered down to a lower one, and so on. Basically, Windows CAN'T know that you're "THE ONE HOLDING THE FUCKING MOUSE" from just that.
What UAC does is it takes control away from ALL programs, and only allows local input devices to generate events, so it CAN be sure that it's you that clicked that button.
It's ok... lots of people yell when they don't know what they're talking about ;)
My blog. Good stuff (when I remember to update it). Read it.
(Administrator...) and the other right-click options to choose XP, 2K, etc would have helped. One would think ms would have created vista from scratch, and, as you say, emulate the older systems. Vista in all versions could have and SHOULD have had embedded in them that existing windows emulator.
But, they decided that certain "16-bit" help files code no longer suited their needs. Fortunately for them, it screwed over the help system and broke several Lotus SmartSuite help file functionality. Someone told me that it wasn't microsoft's responsibility to help Lotus run a bad help program. Thing is, EVERYbody used ms' help program in some way, and in some implementation.
But, a windows 98 emulator built into vista would have perpetuated use of "legacy" apps and probably would have delayed uptake in "new" versions ms would have loved to see 3rd parties sell, principally to compel "upgrading" (side-grading) to vista.
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
Fine. Disable it. I'm just sick and tired of people making misleading comments and outright LIES about it.
You are on the wrong forum. There's no horse dead enough we can't keep beating on.