Slashdot Mirror
MS Suggests Using Shims For XP-To-Win7 Transition
eldavojohn writes "Windows XP (and a lot of MS OS code before that) had a fundamental security flaw whereby the default setting made the ordinary user run as the superuser. Vista & Windows 7 have fixed that and implemented The Correct Paradigm. But what about the pre-Vista applications written to utilize superuser privileges? How do you migrate them forward? Well, running a virtualized instance of XP in Windows 7 is an option we've talked about. But Microsoft is pushing the idea of using 'shims,' which are a way to bypass or trick the code into thinking it's still running as user/superuser mode in Windows XP. This is an old trick that Microsoft has often employed, and it has brought the Windows kernel a long ways, in a duct-tape sort of fashion. At the TechEd conference in LA, Microsoft associate software architect Chris Jackson joked, 'If you walk too loudly down the hall near the [Windows] kernel developers, you'll break 20 to 30 apps.' So for you enterprise developers fretting about transitioning to Windows 7, shims are your suggested solution."
I thought it said "shivs". I guess that would be another way to coerce people into giving up their precious XP.
But MS's support for backwards compatibility is THE REASON they own the desktop.
You can slam all you want, but they will continue to own the desktop because they run all the apps you want.
Leave it to MS to suggest hacking their own code to make it work.
First post??
just to get the software to work properly, you may as well just move to linux
You might as well virtualize XP on Linux.
Windows XP (and a lot of MS OS code before that) had a fundamental security flaw whereby the default setting made the ordinary user run as the superuser
No way! Really? Next you'll be telling me you can't switch to another virtual console if your GUI crashes, or review the OS code to satisfy yourself it's not malicious.
At the TechEd conference in LA, Microsoft associate software architect Chris Jackson joked, 'If you walk too loudly down the hall near the [Windows] kernel developers, you'll break 20 to 30 apps.'
Yeah, real funny. Our software is fragile as fuck, HA-ha
Who's laughing at that goddamn joke? Oh, right, Microsoft is -- all the way to the bank.
i would downplay this notion of shims, and ballyhoo this notion of duct tape
shims just sound like a lame hack. using a shim means you've given up on elegance and respectability
but duct tape is awesome! if you use duct tape to solve a problem you are a manly mcgyveresque resourceful type
windows 7: the duct tape os, is a mark of pride dude!
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
When my company eventually switched over to Vista, the software just took a few tweaks here and there, e.g, what can be found here. So far in our tests on the RC, we haven't *had* to run anything as a SU, and everything has been "curable" with little hacks here and there.
If you are smart, you are usually on software support anyway, and your publisher can help you out. When we tried AutoCAD Inventor in Vista/Seven, it was just a quick call to AutoDesk to get it working. My thoughts on legacy software? Stay away from it!!!
So maybe it's just in my area, but I always heard the word Shim as a reference to a shemale (she-him). Helping with Windows transitions... hrm.
Shims work.
It reminds me of the part in "Zen & the Art of Motorcycle Maintenance" where he suggests to John that beer can aluminum would be the perfect shim to keep his handlebars from slipping. John rejects the idea of using a beercan on his beemer, and so goes to buy "quality shimstock" which is probably made from beercans.
We shim many things, and I had no clue till I took off the siding of my house, and redid a few doors. Shims are how we make construction look good, and still get it done in a timely manner.
Surely it applies to programming as well?
How much is your data worth? Back it up now.
Try getting a Lexmark all in one device to work while NOT admin - ain gonna happen. If you call up Lexmark to ask why their shits broke, they pawn it off on Microsoft. I spent quite a bit of time figuring out folders to change ownership permissions on to make that bastard work without giving admin to everyone.
The preceding post was not a Slashvertisement.
The 3rd party apps guys need to learn to write their applications properly, and stop writing stupid, hackey code.
Your app does not need local admin or eleviated powers, thats stupid.
Code your apps to proper standards, and stop whining. You are just being whipped into doing things right, because MS is finaly tighting up the stardards they should have been enforcing from the start.
Don't bash MS for security, then whine when your apps can't run with elevated powers.
Thats retarded.
If you were really shafted, then the shims is worth a go.
In many many cases, applications can be fixed to run without admin rights. By checking using regmon, filemon, and similar, you can get a handle on what an app is opening and where the permissions issue lies.
This is a bit time consuming, and its a negative, but it is do-able.
There are four things that proceed the problem.
Lazy users
Very lazy developers. -- The prime cause of security failures in Windows.
People only too happy to simply run as admin -- Bad practice
MS setting users as admin to fit point 1,2,3
Windows is not insecure, not any level worse than anything else, but developers, users, and vendor run it insecurely, and worse, have an encouraging attitude for doing so.
MS have gone about the UAC thing very badly, but overall the step and move towards a UAC alike structure is long overdue, and is badly needed.
We`re all equal
For a single-user system (the majority of Windows desktops), it doesn't matter whether or not the user is an Administrator, at least from a security perspective. What threats are you protecting against by subjecting users to extra authentication buttons when installing apps? The only thing the single user really cares about is his own data! Malware running with his (non-administratior) access can destroy his data just as well as malware running as administrator. With either permission, the malware can spread via sockets, file infections, or web access.
This obsession with UAC on single-user desktop systems is simply misguided. Yes, some existing malware may break if it runs with non-admin privileges. But once non-admin becomes common, malware authors will just stop presupposing admin access when coding.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
> they will continue to own the desktop because they run all the apps you want.
Yeah, how's that iPhone dev work going for you? Xcode and the simulator working smooth, eh?
Talk about termites stuck in amber...
This seems to be aimed at applications which insist on running with administrator rights but don't actually use them. If the app actually tries to do something that needs administrator rights, it's going to fail anyway.
If applications without administrator rights can put files in administrator directories, especially ones that have OS components, then turning off administrator privileges is sort of pointless.
Well, maybe it is. But it's the large number of other apps that are at risk of breaking. Even if every one were written correctly, it'd be tough to maintain 100% compatibility. Add in the fact that many are written massively incorrectly (i.e. fragile) and you have a really tough road ahead of you.
Also, breaking 30 apps is peanuts, there has to be well over a million apps for Windows.
http://lkml.org/lkml/2005/8/20/95
Well, since what you described looks something like what chroot+setuid do on a Unix system, 25 apps in 2 days by 3 people is *extremely* slow.
Reading the title, did anyone else first think of the other sort of "shim"?
If it is not broken, don't fix it.
If it is broken, and can not be fixed, provide a workaround.
If after the workaround it is still broken, shim it.
The shim is therefore the workaround for the workaround.
Now then, if we Vertulize the Shim, and put it in the forest where no one can hear it crash, does the problem realy exist?
Sounds like a great way to get to five 9's to me.
YMMV
This requires Windows source code so that you can hook the API's. Who the heck has that for any applications they run? Instead, this is a fix being presented to ISV's... however, if an ISV hasn't fixed their code yet, they probably aren't going to bother now.
----- obSig
Its these crap-tastic applications that caused problems in XP let alone the horrendous issues they will cause in Vista\7. To this day it baffles me that Developers assume end users are administrators of their computers, despite countless security experts explaining this is a bad idea. Aside from a few small (5-10 users) companies, no one gives administrator rights to their end users unless they are completely incompetent or just overburdened by political nonsense then it just creates more issues down the line. So just write it correctly the first time and your shims will vanish!
confused...
I was looking around to insert, or shim, the conversation with my own thoughts about the shim-job. I was thinking that ms' shims were analogous to replacing leaky sphinctres with grommets and shims, but the code being dry stuffing. Or, the code is like glass fed to the machine, which... Oh, shim me... i need to shim my shim comment... my vision must be shimmery...
Anyway, it looks like either ms needs to provide virtualization to contain these bad apps, or just stop providing infrastructure support. Any 3rd-party devs who shim or bypass the non-support should (or could?) be blacklisted and clients warned their bad/leaky shims will not be plugged/supported.
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
but you can't retroactively design something.
Just as the beemer should have had a smaller space for the handlebars, what do you do when the product is already adopted?
How much is your data worth? Back it up now.
"If you walk too loudly down the hall near the [Windows] kernel developers, you'll break 20 to 30 apps."
What if Steve Ballmer enters the room and do the Monkey Dance screaming "Woooooooohoooooooo!"
Besides breaking a chair or toes, what else would get broken?
Case in point against OS backwards compatibility: I use Photoshop on the Mac, and have done so since 1992, from the 68040 under System 7 to the PowerPC on OS9 to OS X on Intel. For all this time it's been the same program that has moved along with the times, as they were going to anyway to keep the product alive and relevant. I can't run PS 2.5 unless I use an emulator, find some System 7/8 disks, etc. But the bigger point is, except for retro-purposes, why would I want to?
I'm beginning to wonder how much software is in existence that is still running that requires some long, long, depreciated API. The typical examples are the home-grown accounting system, the weird shareware program that does this *one* thing we need, etc. How much of this software is *really*, and I mean *really* out there, that exists in this form and this form only.
To this point, I know someone who has a Mac running OS 8 because he runs an accounting package that was written just for him by a long-gone programmer who's last message was "no, it won't work on OS 9". Instead of feeling the pressure to upgrade his system, he just keeps it running on his original Mac Centris something-or-other while he does all his other work on his Mac Pro.
I lost mine in WW2, you insensitive clods!
No wait... you said shims?!?!
Nevermind.
It takes an idiot to do cool things - that's why it's cool!
Maybe running as a normal user is the "correct" way of doing it (gotta love the arrogance there...) but I personally will never run that way.
I have heard all the arguments, from the fact that its easy to type rm -rf /, to the fact that viruses auto install with an IE misclick. The problem with the "correct" way of doing things is that it is very annoying to be typing in passwords all the time! Just try and use a apple mac computer. It asks you to authenticate the keychain consistently. Especially, when as a technician, you are making lots of changes to the OS. I would hate for windows to go this direction. Personally, I believe that it desensitizes people into typing their password into any box that asks.
I will submit that in all the years I have been logging in as root on linux, and administrator on windows, I have NEVER mis typed a file system altering command, deleted my hard drive, or had any other negative experiences running as super users. I also turn off the delete confirmation on my recycle bin. Does this make me a dangerous user? I doubt it.
I just really resent the arrogance of the summary basically stating that super user logins are a design faux pas and should be eliminated anywhere and everywhere. Does my argument have merit? does no one else constantly run as root/admin?
As a potential lottery winner, I totally support tax cuts for the wealthy
The future is the Virtual Machine.
Imagine for a moment, that every application included it's own OS. Of course that OS would be a very dumbed down sort of thing, but it would be entirely independent of the host OS except for some standard inter-vm communication requirements for clipboards, file management, etc.
Your host OS would be responsible for managing the file system, display, and networking, all of which it would provide access to via some standard protocols. The applications would support those protocols and contain their own OS and drivers tailored to those standards. The applications could be built in a NTVM, LinuxVM, BSDVM, SolarisVM, etc as long as it was just complete enough to support the application.
Imagine it like a typical virtual machine, but even less dependent upon the host OS. Sure the applications would be larger, but that's rarely a problem anymore.
Sometimes the best solution is to stop wasting time looking for an easy solution.
Those two programs handle vista really well. If you launch either with insufficient permissions for it to do its work, it'll tell you. If Vista moved some files into whatever safe zone Vista sometimes moves things, the mod manager will tell you and offer to move them back. The author "timeslip" did a great job.
going to be shouted down for this, but aren't "shims" or "patches" and "work-arounds" just part of getting shit done?
I probably won't get modded at all thanks to catching this discussion so late in the game, but I managed to get an insider poke at SysInternals, hard enough that they updated their BGInfo application to fix just this problem (for a test-lab Win7 machine no less). Difference is, I routed it through a guy at Microsoft who actually lives and breathes this stuff - Aaron Margosis. Check out his blog on application compatibility and least user access, he's been working through it since XP came out, and has really helped my company make strides towards a solid-performing (more) secure desktop for my users. http://blogs.msdn.com/aaron_margosis/
It's my machine. Nobody uses it but me. Why the hell would I ever run it in crippled mode? Freedom requires responsibility: fine. I'll take responsibility for what I install. I don't install dodgy software or software with viruses.
Quit treating the users like five-year-olds and let them do what they want with their own damn machines.
I piss off bigots.
Big whoop... I've been using shims to space my HTML for years...
..."So for you enterprise developers fretting about transitioning to Windows 7, writing your enterprise applications correctly is your solution."
The poster slaps Microsoft for suggesting 'shims' and then pretends that there's nothing wrong with enterprise developers writing crap code that ASSumes priviledges that it should not...? Smells like Teen Hypocrisy.
Loading...
Nethack may be old, but the binary you use on Linux was compiled recently. Set up an old Linux system (RH 6.2, to throw something out there), run Nethack on it, and then try to run the same binary on a new system. It won't work.
It does if you run Solaris (and FreeBSD I think). Both have pretty good ABI layers (and even their kernel APIs are pretty stable).
Just because some Unix-y systems don't have good backward compatibility, doesn't mean others don't.
And API / source-level compatibility isn't that bad of a thing either. If all companies had to do was recompile to get their XP apps usable on Vista/7, it'd be a lot less work then trying to rewrite it.
I can't really agree that backward compat. is the reason MS owns the desktop.
If they made a new version of Windows which was lean and mean, and operated, for the most part, like the Windows everyone already knows, I think it would be a success.
MS has already made comments in that direction, and a future version of Windows may do this. It's not even a big deal, since any backward compatibility can simply be dealt with by setting up virtual machines.
What the FOSSies REALLY don't want to hear is that Windows is a success because consumers prefer Windows. Look at markets without "markets" (meaning, areas with high piracy). Windows STILL dominates those areas, even though consumers aren't being "sold" anything. People would rather STEAL Windows than use a FREE version of Linux. Why? Because people simply prefer Windows.
Odd they would have certain things run in the background as a superuser. It's a major flaw, it would be like having a Linux box just go off and run things as Root, which I mean can happen but not in the Microsoft context.
Why don't they make a new user group that can access though use of a software tunnel the "Root" user on Windows and then have the "Root" user passed information from the intermediate user but only the stack references and PCB's it needs and nothing more. This could majorly tighten up the security.
I know I had to implement a method such as this when I made my own OS for a college project. I had to let the "Root" user on the system access very certain aspects of the system but most of the time it didn't matter. I think implementing that Idea would be a far better and more secure method of what there trying to achieve.
Thanks
LinuxOverWindows
...any stupid program that tries to write to $PROGDIR or do anything else stupid has the changes re-directed to somewhere safe.
When Vista first came out, and I was asked to test my WIN32 app to make sure it still worked, I was pleasantly surprised to find that all my ...PrivateProfile code that uses the default location no longer required me to grant global access to an .ini file in the Windows directory. They seem to make a copy under 'application data' and use that. A very simple and elegant solution that fixes a nasty problem for apps that want to just work on all WIN32 platforms.
Of course, I could've changed the app to explicitly copy the .ini files someplace writeable, but then I'd have to pick different places depending on what version of Windows I was running under. Having a default location that actually works is a much better solution. So, I cancelled my plans to code an app-specified location, figuring Vista would just solve the problem for me. But then again, Vista was Vista, so the problem never got solved. I sure wish they would've just installed this particular shim into XP. But then again, Microsoft is Microsoft, so...
Posted from my Android phone. Oh, I can change this? There, that's better...
is designed for these sort of situations. http://www.beyondtrust.com/
The registry was supposed to replace .ini files. Of course now everyone is going back to text config files to make their apps portable.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
And this has been economically possible for Microsoft through the use of shims. Without Shimeng &c. Microsoft would have had to have the basic Windows code itself detect what ancient program is running and misbehave accordingly. Using shims they can move most of the dirty tricks out of the central Windows code, keeping its codebase somewhat cleaner.
A bit of a shameless plug, but if you'd like more information on these "shims", I've started a series of articles on the technology (still hoping to complete it shortly) on my blog at http://www.alex-ionescu.com/?p=39. FYI, there's over 8000 of them in Windows today, and each time you launch an app, these checks are made.
Yeah, watch me race out with all the other image-conscious sheep and pay yet more megabucks to be part of the completely artificial "upgrade" cycle.
My existing hardware, OS, and apps all run very well, thanks.
Having to throw that out and buy much "faster" new computers just to run the latest OS, seems a little, um, what's the correct word...oh, I know: "retarded".
This type of thing has been used in Windows terminal servers for awhile. Microsoft uses certain workarounds to allow more applications to run in a terminal environment with less privileges than one might have on a full workstation. Yea, not every app works in Terminal Server but most do.
In my opinion, most of this is blown way out of proportion. Most applications run fine in Vista, and Windows 7 is even better when it comes to its compatibility mode. Sure, drivers are a little point of contention but even in 64-bit Vista/W7 the support from vendors has become really good.
There's always going to be some old legacy applications that won't work right, but they're the exception, not the rule. Workarounds will be required for these applications but they're just not a prevalent as people seem to make them out to be.
- It's not the Macs I hate. It's Digg users. -
You know, nobody bought Vista anyways, and if this new debacle isn't proof enough, maybe its time for MS to let "legacy" compatibility go the way of the dodo.
I want to delete my account but Slashdot doesn't allow it.
Do you need your program to work on Windows 3.1? The Windows Registry has been the preferred location for storing program data since Windows 95. I think the problem here is that you need to get with the mid-90s and rid of your calls to *PrivateProfile* APIs.
> It depends on what they did to "compete unfairly". For example, it is not illegal for a vendor to have a contract with an OEM that the OEM could not buy a competitor's products if the vendor is not in a market monopoly position.
IIRC, they broke contracts, screwed over partners, and out-and-out stole other people's code and products. They lost several lawsuits over this, but the fines were small enough that they came out ahead. Wikipedia doesn't have as many details as I remember, but some of how they bent over Stac Electronics should give you an idea of the kind of games they played. There are also more recent things like this and this.
They've never been a nice company. They screw over their 'partners' more than anyone.
...not immediately thing of "chroot" when he heard this?
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Like DLL Hell, getting the correct collection of shims to run multiple legacy apps sounds just like the situation we call DLL Hell.