Your right on Wheel, its in essence the same thing; point taken; other variations like HPUX have taken this broader too, I was too specific with my admin = root comment.
On the lower class users who don't get a prompt, in VISTA all users get the prompt, but if they don't have the equiv of wheel membership its a su esq sort of escelation vs a consent one.
On Unix admin=root, what Vista and OSX do are in essence the same thing though as I understand it in OSX its implemented at the application layer vs the os layer.
Not true, on Unix if you were running as a admin (root) you would not be prompted at all.
The difference is that in VISTA the default user is a type of admin (for app compat reasons), you can think of that admin as a restricted admin, as a restricted admin they can become a full admin by going through the UAC consent experience.
Now if you created a real standard user in VISTA and ran a program that required admin you would get a user id and password prompt, not a consent prompt; thats esentially the same think as windows saying oh for this action to work he needs to run su, lets run su for him so he doesnt ahve to figure that out on his own.
Again like unix except the OS figured out the need for SU for you.
The net net of all of this is the only differences between the two approaches are:
1. Even root needs to confirm changing system configuration, this is clearly a function of application compatability and having to deal with the history of Windows and its glutany of poorly designed applications (like the old iReboot)
2. Windows figures out the need for SU for you, again a function of the success/history of Windows and the associated needed usability/application compatability.
So they created a service (daemon) that exposed a interface that had no ACL on it that allowed the caller to perform privliged opperations, they had the administrator (root) install the service and grant it administrative permissions (again, root) and then had a unprivliged application call that interface.
Sounds exactly like unix to me, more over short of not having ACLs on the interface, Microsoft has white papers telling folks how to do just this.
In fact a CS major would know this as "least-privliged-design" oh-no mr. bill.
Only on Slashdot would this qualify as news.
Slashdot Mirror
Your right on Wheel, its in essence the same thing; point taken; other variations like HPUX have taken this broader too, I was too specific with my admin = root comment. On the lower class users who don't get a prompt, in VISTA all users get the prompt, but if they don't have the equiv of wheel membership its a su esq sort of escelation vs a consent one.
On Unix admin=root, what Vista and OSX do are in essence the same thing though as I understand it in OSX its implemented at the application layer vs the os layer.
Not true, on Unix if you were running as a admin (root) you would not be prompted at all. The difference is that in VISTA the default user is a type of admin (for app compat reasons), you can think of that admin as a restricted admin, as a restricted admin they can become a full admin by going through the UAC consent experience. Now if you created a real standard user in VISTA and ran a program that required admin you would get a user id and password prompt, not a consent prompt; thats esentially the same think as windows saying oh for this action to work he needs to run su, lets run su for him so he doesnt ahve to figure that out on his own. Again like unix except the OS figured out the need for SU for you. The net net of all of this is the only differences between the two approaches are: 1. Even root needs to confirm changing system configuration, this is clearly a function of application compatability and having to deal with the history of Windows and its glutany of poorly designed applications (like the old iReboot) 2. Windows figures out the need for SU for you, again a function of the success/history of Windows and the associated needed usability/application compatability.
So they created a service (daemon) that exposed a interface that had no ACL on it that allowed the caller to perform privliged opperations, they had the administrator (root) install the service and grant it administrative permissions (again, root) and then had a unprivliged application call that interface. Sounds exactly like unix to me, more over short of not having ACLs on the interface, Microsoft has white papers telling folks how to do just this. In fact a CS major would know this as "least-privliged-design" oh-no mr. bill. Only on Slashdot would this qualify as news.