Yes, MS is aware that the actions of 3rd party apps reflect upon them. The Designed for Windows XP logo is the carrot/stick that they use to get developers to stick to these (and other) standards.
Although I haven't read these docs in a while, I don't see Microsoft changing the Registry scheme. It has proven to be a pretty robust methodology provided it is used intelligently by the applications that leverage it.
The requirements you describe are met by providing applications their own registry space under the HKLM\Software\companyname> namespace. All other areas are generally used by the OS and more-or-less off-limits (depending on the application's need to query or modify OS functionality). If an application had data that didn't really belong in the registry (user-associated file data, for example) it should probably go into the user's profile under "C:\Documents and Settings\Username\Application Data\companyname>\Program" directory. If you run Windows you almost certainly already have some of these already.
Re:Can an MS expert answer some questions please?
on
Microsoft Clips Longhorn
·
· Score: 4, Interesting
Applications run under the context of the user that runs them. If the application needs additional permissions, then it either needs to install itself as a service (which would require entering service account information upon installation) or somehow ask the user to provide necessary credentials.
Microsoft has a feature (which can be enabled) whereby when initiates the installation of a software package, the installation program runs under the credentials of the system account. Like any security feature, it may be nice for some situations (as an admin you don't have to truck on over the user to log on every time they wanna install something) and bad for others (potential security hole). The choice is yours to make as an administrator. But it is a nice middle ground between allowing a user to run as administrator of his/her box all day long (due to risk of trojans, etc), and having to baby-sit them every time they want to install something new.
So the ACL system is pretty effective, so long as users don't run as Administrator of the computer. Microsoft best practices are to NOT have the user run as Administrator of the computer. Unfortunately, many companies don't follow this advice. See, unfortunatley, many poorly-written third party apps require rights to certain areas of the file system or registry, and they are old programs that worked fine before such systems were locked down (for good security reasons) by Microsoft. Due to reasons unknown (frugality, probably) most companies aren't willing to go through the work of finding out what registry settings each of 300+ applications need and developing a script to give users access to those areas. So they take the short route and give users full control of the Registry, or of the box. And that gives virii/trojan horses fertile ground to wreak havok.
Re:Can an MS expert answer some questions please?
on
Microsoft Clips Longhorn
·
· Score: 5, Insightful
1. Does Windows XP currently allow every application full write access to the Registry, or at least access to registry components for other applications?
No, the Registry has an access-control/authorization subsystem very similar to the file system.
2. If so, does this strike anyone else as a really bad idea from the view of modularity, scalability, and security?
It would be a bad idea, if it was the case (which it is not).
3. Will Longhorn keep the Windows Registry?
Absolutely. There are way too many third-party applications that leverage the registry to eliminate it. If MS were to eliminate the registry, they would have the same outcry that took place when they locked down the file system. See, prior to Windows 2000, users and applications could write anywhere in the file system. Lots of (badly-written) application would sprinkle their configuration files all over the place. This was clearly a problem with ISVs, so MS took action and enforced that (by default) users could only write into their user profile directory. Well, everyone complained that MS "broke" all their apps... but the real culprit was all these poorly-written apps that were dumping user configuration information into files like C:\WINDOWS\config.ini
Re:WinFS WILL be in the next version, just no netw
on
Microsoft Clips Longhorn
·
· Score: 5, Funny
You could submit a story that Microsoft causes cancer, and they'd publish it with a bunch of spoof or dead links without batting an eye.
You can't have it both ways. We all know the official government line that the state taxes the rich to help the poor. But according to you, tax deductions are "by definition" the government helping the poor.
Bravo. You've captured the achilles heel of the Republican party.
But don't forgot the hollow promises of the Democrats: that money spent on government services to "help the poor" and "improve infrastructure" actually go to those causes.
Once you put both sides of the coin together you realize Government is using class warfare as a wedge to insert insert itself as a middleman.
By way of example, in Massachusetts the state government refuses to allow tax deductions for charitable contributions. Why is that? Perhaps because their view is that help to the poor should *always* come from the government middleman. The rich helping the poor leaves government out of the equation. The horror!
Your analogy of Trusted Computing to medical research in concentration camps is shockingly inappropriate.
Moreover, your assertion that Trusted computing should be fought because it is "immoral" and "evil" smacks of the very same totalitarianism you appear to despise. Are you the sole person to determine what is immoral and evil? What if I have a different morality or viewpoint? Will you compare me to a WWII doctor, then, too?
If you lived in Boston you'd know for sure that "lower" prices with the card really mean avoiding price gouging.
In Boston, Stop & Shop regularly sells meat for double-to-triple the market cost ($5/lb for regular hamburger?). But if you use the card, you get it for $2/lb.
In marketingspeak, that's 60% OFF! You just saved $6 on a two-pound package! And the cards now are very careful about tabulating your accumulated yearly "Savings" at the bottom of each and every receipt.
Netware is a solid platform and proven its stability, where Windows has failed.
Not sure about that one, chief. File & Print services have become a commodity service. I mean, freaking Microsoft Exchange (a mail product) can do File services. Novell has stood still for way too long. I remember back in '97 getting my CNE for Novell 4.11. Today, NetWare 6 is practically the exact same system.
Novell has for too long denied the value of the application server. Now they are being forced to make choices because it has finally come down to do-or-die for them. Sure, it's good to see that the company, when finally scared witless can make the right decision.
But unfortunately, I think innovation is an area where Microsoft has simply kicked Novell's ass. And in this case Novell has nobody to blame but themselves for sitting on their hands.
Sure Novell still has superior File & Print capability, that isn't enough anymore to float a boat the size of Novell.
Nobody every guarantees anything with Software Assurance. That might be how YOU understood it when you read about it on slashdot. People who make decisions on these things look into them more than the first paragraph.
In your mind, they are "screwed". Software Assurance works like an insurance policy that you can buy on various products. If a newer version of the product is released during the term under which you're covered, you get an additional matching license for the new product (and you still keep the old license).
Software Assurance is an OPTION. You still have the choice of purchasing plain 'ole licenses. Software Assurance is looked at positively by bean counters that want predictable year-over-year costs. And if you think that's dumb, you should take it up with the bean counters.
Offtopic, but do you feel screwed when you buy car insurance and don't get into an accident? I'm asking because it's really the same kind of thing.
Your explanation might sound great to the/. crowd, but you shouldn't talk about stuff you don't know about.
Sorry to inform you that Microsoft still offers the Select Licensing agreement which does not include Software Assurance by default. And Select Licensing is a volume license agreement that has substantial discounts from retail.
*Caselaw* is needed, not tinfoil hats
on
Guilty By Association
·
· Score: 3, Insightful
I think you need to have some faith that the Judicial branch will see through a charge built on "Guilt by Assocation". There is excellent case law that shows how unsuccessful a prosecutor will be in building a case in this manner.
The bigger question is, should the government be allowed to mine this data to look for individuals to put under surveillance. What are the criteria here?
The only historical model we have of this type of thing is landline phone taps. Again, the Judicial system had to get involved -- in the form of a judge or grand jury. Today, the scope of opportunity is so much greater than just telephone lines.
I personally think we need more policymaking and caselaw in the area of government-commercial database relationships. It will come, but only after the government oversteps its bounds a few times and gets its foot chopped off by a successful lawsuit.
Yup. I pretty much agree with you. It's stupid to impoverish everybody this way. But I ask you: why hasn't the spending stopped? For me, the situation becomes clear when I look at it from this angle: it's not about Rich Americans vs. Poor Americans. That's the old Republican vs. Democrat angle. Today, Republicans and Democrats are essentially the same party: the Corporate party. And the game has changed into corporations vs. individuals. Since individuals today either don't vote, or vote based on which candidate spends the most marketing dollar, our government has become enslaved by a campaign finance system that encourages corporations to contribute as much money as they like to the Corporate party. Governments doing something for the individuals (whether rich or poor) is as ridiculous an idea as a monopoly trying to break a sweat for its customers. Just my view...
It is money literally owned (via your citizenship) by you. Making it go away is in your benefit more than George Bushes (because he has so much of his own money).
Well, except that George Bush is spending it on gifts to rich corporations who then move their money offshore... leaving the rest of us with the bag.
My point is that if our government didn't feel the need to spend itself into oblivion, we wouldn't be in this mess.
The federal government's spending is out of control, and rather than curtail spending they see loading up the National Debt and reducing the value of the dollar as a wonderful way to keep the largess flowing.
They are not economists and therefore, they don't necessarily see the whole picture
Well, you're right in having some skepticism about a statement like that. But in this case, I think it's true. What people see everyday are things like job availability, market prices for oranges, crap like that.
Economists study capital. They work for those with capital. They are paid to analyze and produce policy that increases capital. They have no "allegiance" to workers. Sometimes they have to propose solutions that cause pain to joe six-pack. Now nobody wants to tell Joe about this, and if he can't figure it out... well even better.
I'm reminded of this fact every time Alan Greenspan opens his pie-hole and spouts off about how open borders will increase jobs in America. What f*ing planet is he on? What type of jobs should unemployed Americans be retraining for (again)?
It seems clear to me that his stealth goal is reduction of the National Debt. The Debt now grows at $1.77 billion per day. Our government's spending is just out of control. So since the government refuses to cut spending (actually its increasing by alarming amounts), The only way the government will ever pay that off is by reducing the value of the dollar. If that means the lives of millions of middle-class Americans are decimated in the process, so be it.
How do you reduce the value of the dollar? You make capital leave the country. Outsourcing!
So it seems to me that the quote above is correct -- it's not a job issue. It's a dollar issue. It's a trade imbalance issue. It's why the Euro is skyrocketing, it's why Gold is going up, it's why the dollar is falling... and it is a SERIOUS threat to our nation. That's the "whole picture"... IMHO, anyway
Just because guns are involved in attacks by unhappy children and disgruntled workers, doesn't mean a healthy discussion of guns should be squashed.
If you think censoring sites that are pro-gun is justified because guns are involved... then it sounds like squelching sites of disgruntled workers and unhappy students is also justified. While we're at it, I think there was a technie in Massachusetts who killed some coworkers... should we ban slashdot?
A healthy discussion on any topic needs TWO OPINIONS.
Have you listened to the interview in its entirety? Did you read the Ombudsman report? Let me quote a choice part for you:
"...by coming across as a pro-Franken partisan rather than a neutral and curious journalist, Gross did almost nothing that might have allowed the interview to develop. By the time the interview was about halfway through, it felt as though Terry Gross was indeed "carrying Al Franken's water,""
You may be critical of O'Reilly, and I don't listen to him frequently enough to agree or disagree with you. But I stopped listening to NPR as an unbiased source of information when they: 1. Got caught secretly supplying thier donor/membership list to the Democratic National Committee 2. Chose to play the song "We Shall Overcome" during breaks in their coverage of the Clinton impeachment senate trial.
Slashdot Mirror
Thanks for the kind words.
Yes, MS is aware that the actions of 3rd party apps reflect upon them. The Designed for Windows XP logo is the carrot/stick that they use to get developers to stick to these (and other) standards.
Although I haven't read these docs in a while, I don't see Microsoft changing the Registry scheme. It has proven to be a pretty robust methodology provided it is used intelligently by the applications that leverage it.
The requirements you describe are met by providing applications their own registry space under the HKLM\Software\companyname> namespace. All other areas are generally used by the OS and more-or-less off-limits (depending on the application's need to query or modify OS functionality). If an application had data that didn't really belong in the registry (user-associated file data, for example) it should probably go into the user's profile under "C:\Documents and Settings\Username\Application Data\companyname>\Program" directory. If you run Windows you almost certainly already have some of these already.
Microsoft has a feature (which can be enabled) whereby when initiates the installation of a software package, the installation program runs under the credentials of the system account. Like any security feature, it may be nice for some situations (as an admin you don't have to truck on over the user to log on every time they wanna install something) and bad for others (potential security hole). The choice is yours to make as an administrator. But it is a nice middle ground between allowing a user to run as administrator of his/her box all day long (due to risk of trojans, etc), and having to baby-sit them every time they want to install something new.
So the ACL system is pretty effective, so long as users don't run as Administrator of the computer. Microsoft best practices are to NOT have the user run as Administrator of the computer. Unfortunately, many companies don't follow this advice. See, unfortunatley, many poorly-written third party apps require rights to certain areas of the file system or registry, and they are old programs that worked fine before such systems were locked down (for good security reasons) by Microsoft. Due to reasons unknown (frugality, probably) most companies aren't willing to go through the work of finding out what registry settings each of 300+ applications need and developing a script to give users access to those areas. So they take the short route and give users full control of the Registry, or of the box. And that gives virii/trojan horses fertile ground to wreak havok.
No, the Registry has an access-control/authorization subsystem very similar to the file system.
2. If so, does this strike anyone else as a really bad idea from the view of modularity, scalability, and security?
It would be a bad idea, if it was the case (which it is not).
3. Will Longhorn keep the Windows Registry?
Absolutely. There are way too many third-party applications that leverage the registry to eliminate it. If MS were to eliminate the registry, they would have the same outcry that took place when they locked down the file system. See, prior to Windows 2000, users and applications could write anywhere in the file system. Lots of (badly-written) application would sprinkle their configuration files all over the place. This was clearly a problem with ISVs, so MS took action and enforced that (by default) users could only write into their user profile directory. Well, everyone complained that MS "broke" all their apps... but the real culprit was all these poorly-written apps that were dumping user configuration information into files like C:\WINDOWS\config.ini
That would just be tit-for-tat. Forrester Research has already concluded that Linux/J2EE causes colon cancer
Alternatively, can you get something from your boss that will be useful to you?
Yeah, a whole bunch of hardware to sell on eBay is a good start!
You can't have it both ways. We all know the official government line that the state taxes the rich to help the poor. But according to you, tax deductions are "by definition" the government helping the poor.
What kind of logic is that?
Bravo. You've captured the achilles heel of the Republican party.
But don't forgot the hollow promises of the Democrats: that money spent on government services to "help the poor" and "improve infrastructure" actually go to those causes.
Once you put both sides of the coin together you realize Government is using class warfare as a wedge to insert insert itself as a middleman.
By way of example, in Massachusetts the state government refuses to allow tax deductions for charitable contributions. Why is that? Perhaps because their view is that help to the poor should *always* come from the government middleman. The rich helping the poor leaves government out of the equation. The horror!
Maybe the guy had died after drinking approximately 48 cans of coke in a 12-hour period, but was that the actual cause of death?
Stand up for your morals here and fight trusted computing.
So, I take that to mean that your morals should be telling you that trusted computing should be fought.
That sure sounds like imposing an opinion to me.Your analogy of Trusted Computing to medical research in concentration camps is shockingly inappropriate.
Moreover, your assertion that Trusted computing should be fought because it is "immoral" and "evil" smacks of the very same totalitarianism you appear to despise. Are you the sole person to determine what is immoral and evil? What if I have a different morality or viewpoint? Will you compare me to a WWII doctor, then, too?
If you lived in Boston you'd know for sure that "lower" prices with the card really mean avoiding price gouging.
In Boston, Stop & Shop regularly sells meat for double-to-triple the market cost ($5/lb for regular hamburger?). But if you use the card, you get it for $2/lb.
In marketingspeak, that's 60% OFF! You just saved $6 on a two-pound package! And the cards now are very careful about tabulating your accumulated yearly "Savings" at the bottom of each and every receipt.
Yes, it will lower costs for smaller business to implement them, because there won't be any small businesses left to implement them.
Not sure about that one, chief. File & Print services have become a commodity service. I mean, freaking Microsoft Exchange (a mail product) can do File services. Novell has stood still for way too long. I remember back in '97 getting my CNE for Novell 4.11. Today, NetWare 6 is practically the exact same system.
Novell has for too long denied the value of the application server. Now they are being forced to make choices because it has finally come down to do-or-die for them. Sure, it's good to see that the company, when finally scared witless can make the right decision.
But unfortunately, I think innovation is an area where Microsoft has simply kicked Novell's ass. And in this case Novell has nobody to blame but themselves for sitting on their hands.
Sure Novell still has superior File & Print capability, that isn't enough anymore to float a boat the size of Novell.
Nobody every guarantees anything with Software Assurance. That might be how YOU understood it when you read about it on slashdot. People who make decisions on these things look into them more than the first paragraph.
In your mind, they are "screwed". Software Assurance works like an insurance policy that you can buy on various products. If a newer version of the product is released during the term under which you're covered, you get an additional matching license for the new product (and you still keep the old license).
Software Assurance is an OPTION. You still have the choice of purchasing plain 'ole licenses. Software Assurance is looked at positively by bean counters that want predictable year-over-year costs. And if you think that's dumb, you should take it up with the bean counters.
Offtopic, but do you feel screwed when you buy car insurance and don't get into an accident? I'm asking because it's really the same kind of thing.
The musicians want compensation because they wrote the songs. So I can only assume you want compensation because you wrote the viruses.
So tell me, just how outraged will you be the next time the media suspiciously points to the Linux community as the source of Windows worms and virii?
Your explanation might sound great to the /. crowd, but you shouldn't talk about stuff you don't know about.
Sorry to inform you that Microsoft still offers the Select Licensing agreement which does not include Software Assurance by default. And Select Licensing is a volume license agreement that has substantial discounts from retail.
I think you need to have some faith that the Judicial branch will see through a charge built on "Guilt by Assocation". There is excellent case law that shows how unsuccessful a prosecutor will be in building a case in this manner.
The bigger question is, should the government be allowed to mine this data to look for individuals to put under surveillance. What are the criteria here?
The only historical model we have of this type of thing is landline phone taps. Again, the Judicial system had to get involved -- in the form of a judge or grand jury. Today, the scope of opportunity is so much greater than just telephone lines.
I personally think we need more policymaking and caselaw in the area of government-commercial database relationships. It will come, but only after the government oversteps its bounds a few times and gets its foot chopped off by a successful lawsuit.
With all the brainpower on Slashdot, I'm sure we can find a way!
Yup. I pretty much agree with you. It's stupid to impoverish everybody this way. But I ask you: why hasn't the spending stopped? For me, the situation becomes clear when I look at it from this angle: it's not about Rich Americans vs. Poor Americans. That's the old Republican vs. Democrat angle. Today, Republicans and Democrats are essentially the same party: the Corporate party. And the game has changed into corporations vs. individuals. Since individuals today either don't vote, or vote based on which candidate spends the most marketing dollar, our government has become enslaved by a campaign finance system that encourages corporations to contribute as much money as they like to the Corporate party. Governments doing something for the individuals (whether rich or poor) is as ridiculous an idea as a monopoly trying to break a sweat for its customers. Just my view...
Well, except that George Bush is spending it on gifts to rich corporations who then move their money offshore... leaving the rest of us with the bag.
My point is that if our government didn't feel the need to spend itself into oblivion, we wouldn't be in this mess.
The federal government's spending is out of control, and rather than curtail spending they see loading up the National Debt and reducing the value of the dollar as a wonderful way to keep the largess flowing.
Well, you're right in having some skepticism about a statement like that. But in this case, I think it's true. What people see everyday are things like job availability, market prices for oranges, crap like that.
Economists study capital. They work for those with capital. They are paid to analyze and produce policy that increases capital. They have no "allegiance" to workers. Sometimes they have to propose solutions that cause pain to joe six-pack. Now nobody wants to tell Joe about this, and if he can't figure it out... well even better.
I'm reminded of this fact every time Alan Greenspan opens his pie-hole and spouts off about how open borders will increase jobs in America. What f*ing planet is he on? What type of jobs should unemployed Americans be retraining for (again)?
It seems clear to me that his stealth goal is reduction of the National Debt. The Debt now grows at $1.77 billion per day. Our government's spending is just out of control. So since the government refuses to cut spending (actually its increasing by alarming amounts), The only way the government will ever pay that off is by reducing the value of the dollar. If that means the lives of millions of middle-class Americans are decimated in the process, so be it. How do you reduce the value of the dollar? You make capital leave the country. Outsourcing! So it seems to me that the quote above is correct -- it's not a job issue. It's a dollar issue. It's a trade imbalance issue. It's why the Euro is skyrocketing, it's why Gold is going up, it's why the dollar is falling... and it is a SERIOUS threat to our nation. That's the "whole picture"... IMHO, anyway
On an intellectual-property level. On practical levels, too.
Well, there you have it your honor. In the industry's own words: The rules of Intellectual Property are not practical!
Just because guns are involved in attacks by unhappy children and disgruntled workers, doesn't mean a healthy discussion of guns should be squashed.
If you think censoring sites that are pro-gun is justified because guns are involved... then it sounds like squelching sites of disgruntled workers and unhappy students is also justified. While we're at it, I think there was a technie in Massachusetts who killed some coworkers... should we ban slashdot?
A healthy discussion on any topic needs TWO OPINIONS.
"...by coming across as a pro-Franken partisan rather than a neutral and curious journalist, Gross did almost nothing that might have allowed the interview to develop. By the time the interview was about halfway through, it felt as though Terry Gross was indeed "carrying Al Franken's water,""
You may be critical of O'Reilly, and I don't listen to him frequently enough to agree or disagree with you. But I stopped listening to NPR as an unbiased source of information when they:
1. Got caught secretly supplying thier donor/membership list to the Democratic National Committee
2. Chose to play the song "We Shall Overcome" during breaks in their coverage of the Clinton impeachment senate trial.