On the other hand, one of the weaknesses of GTA is that while it is supposedly very open and non-restrictive, you have to unlock areas and content by playing missions. Does this game suffer from the same syndrome? No. Crackdown doesn't restrict where you can go or what you can do, aside from the fact you'll probably get your ass kicked if you haven't spent some time leveling up your character.
It is also extremely difficult, although usually not impossible, to get to the rooftops of some of the higher buildings without having at least a level 2 agility.
I've had the game since the day it came out, and I had been playing the demo for several weeks prior to that.
I am probably one of 6 people who bought the game for the game, and not the Halo 3 beta invite. The demo was a *blast* and was probably the most fun I've had on the 360. Yes, more than Gears of War.
The game starts off a bit slow. You're not really sure what to do. Eventually you'll realize that this open ended game play is what makes Crackdown so much damn fun. Don't feel like doing the missions or taking on the bad guys? Fine. Go have fun leaping from rooftop to rooftop, or leveling up your explosives skills to the point where a single grenade can take out a dozen cars sitting in traffic.
The whole concept of "leveling" your character through the various power ups turns out to be extremely, extremely addicting. It turns into an almost uncontrollable compulsion to get those green orbs. And the blue orbs? Forget about it. They're like heroin. Even the animation that you get when you reach the next level is addicting. You're guy does a highlander style quickening with a bit of an explosive blast wave added in for effect. Everything around you gets knocked over and thrown about 10 feet... including bad guys. I often find myself trying to time my level-ups so that I'm in a crowded area or next to a bunch of cars. Something very satisfying about having things blown away from you... quite the power trip.
Once you've defeated the baddies in Los Muertos, you'll probably wander over to Volk's territory. Previously, the game didn't really offer *that* much of a challenge on the default settings. As long as you weren't stupid and stayed in one place too long, dying wasn't all that common. That changes fast. The Volk will kick your ass. They're smarter. They have MUCH bigger guns (um... rocket launcher = pain), and they have double life meters. And don't get me started on the Shai Gen.
Are there flaws? Yes. The bosses are often too weak... although if you turn up the difficulty level a notch they can give you your money's worth. The story line is iffy. There aren't enough... um... structured missions. One of the strength's of GTA is that while it was very open and non-restrictive, it also had structure if your chose to participate. Crackdown lacks this.
There are also a few control glitches. I've found myself trying to pick up a car, but not be given the option for no real reason. It can also be frustratingly difficult to attack the correct baddie when there are lots of bodies laying around because you target all bad guys, not just the alive and kicking ones.
That said, the game is a LOT of fun. It's the first time on my 360 that I've had "Mario Thumb". (You know... the sore, red thumb caused by repeated button mashing.) And when you start playing co-op... wow. It really doesn't get much better. Honestly. Especially when you decide it's more fun to try and kill each other than complete the missions. (Supercop vs Supercop = BOOOOOOM!)
At one point I set a trap for my co-op nemesis. He was chasing me and I drove past a large group of cars stuck in traffic. In essentially one motion I leaped from my car, spun around, and fired a rocket into the group of cars just as he was passing them. The resulting explosion sent his car flying through the air uncontrollably. I then targeted his car and nailed it with 6 or 7 rockets, keeping it flipping through the air. It was like something out of a movie... and man was it fun.
This is one of those games that you really just have to play. Give it 30 minutes of you're time and all of a sudden you'll realize you've been playing it for 6 hours.
I'm really not sure why I'm bother to reply to you... but I'll take the bait anyway.
First, signing alone is useless. It is one of the three vital components of a MAC desktop. Second, unless it is open to all comers it will be fairly useless. Competition among verification services is the only way to get accurate ones.
Huh? Signing allows me to identify where the application came from and that it has not been modified since it was signed. It's extremely useful. Get a grip.
Applications don't ship with ACLs, I don't see a way to measure the input from multiple groups, and I don't see a distinction between certified software from a given domain and verified software from a developer or third party.
Measure input from multiple groups about what? Are you saying that you want people to vote on whether or not an application is safe? That's an interesting idea, but one that doesn't exist anywhere right now, as far as I know.
It is very, very possible in a non-managed word as you put it. MAC have been in use for over a decade. If one was included and enabled by default in Windows, developers would code with that in mind. What makes you think it is not possible?
You have any documentation about how the Mac magically makes it so that unmanaged applications can be restricted from performing tasks that the user running that application can perform, and in a manner that would not require all existing applications to be rewritten? No, I suspect you don't. There are certain vital requirements that you need to have in order to make sure an application can only do certain things, regardless of the user's privileges running it. Verifiability of the code, restriction of direct memory access, and a wide variety of other things. Objective-C on the Mac has none of these. Only managed environments, such as Java and.NET, currently provide this functionality.
I only tried RC1 and it certainly did then, but regardless by all accounts there are a great many notifications for common tasks. One fairly reputable review on a security site I read showed it appearing 7 times while the user attempted to change their IP address. Because they decided not to use persistence of authentication for a given period it will almost certainly appear a lot more than sudo based systems. Add to this the terrible UI (Allow)(Deny) that does not have unique action for a given prompt and it is certain to be fairly useless to the average person.
Oh, so you haven't even used the product your bashing incoherently. Big surprise. Changing your IP in Vista causes 1 UAC prompt, so you're full of crap there as well. As far as "persistence" of authentication, yes, they do have that. When you authorize something to run elevated, it continues to run elevated until you close it. Just like sudo. When performing multiple file copy operations, which internally are all separate operations, Explorer will automatically persist the authorization. The only time you'll see multiple UAC dialogs is if you perform multiple, discrete tasks via difference processes. Just like in Linux. So you're wrong again.
I scanned through that article the other day. I did not see it listing the services. It looked like PR fluff.
What list are you looking for? A list of services that are "required"? Required by who? It depends on the user. That article points out how Microsoft dramatically improved the security of services in general, including how they prevent network access for all that don't require it. In other words, it directly addresses the "concerns" of The Register article. But I guess you didn't catch that during your "scanning".
No, most of the work in Vista was expanding into other markets and embracing them and trying to gain feature parity with OS X. Vista adds eye candy, searching, widgets, expose, included apps, etc. in order to try to counter Apple's slow gains in market share.
If you had read the link I posted regarding signed ActiveX, you would see that it only allows signed ActiveX installations if group policy explicitly allows that particular company's software. In other words, only if the IT department says that particular control or company is OK.
This makes Vista far more secure than XP in the sense that users will no longer have to be admin simply to access the controls they need to get their job done. They can run as a standard user and still install the control(s) they need.
Microsoft should absolutely implement an application signing scheme, but not to allow or deny applications the ability to run. They need an open signing/certification framework where you users can subscribe to multiple services and use the merged results as a method of determining trust. That is step one. Let the OS and users know how trustworthy a binary is. Some.exe I just got aimed by a stranger with no credentials should not be given the same level of trust as the pre-installed wordpad program which should not be given the same level of trust as Adobe Dreamweaver. Aside from the "open" part of your request, Microsoft does have this. Applications can be signed using digital certificates, and policies can be used to restrict access to certain applications based on these policies. (And it's very flexible. It can be done on a per-app basis, a per-company basis, a per-version basis, etc.) Your request regarding being able to restrict what that app does is not really possible in the non-managed world, but it's exactly what Code Access Security does in the.NET world. Vista includes.NET v3, so we'll see a lot more of these things being used more frequently.
It asks when you change your desktop background. I've seen this several times on Slashdot. NO IT DOES NOT. (It did back in RC1, but hasn't since RC2.)
This site lists 134 services enabled by default in Vista. Note, these are not necessarily network services but they do have the potential for exploitation. I'm not sure which network services are enabled by default, but I know there are several. Do you have a list or are you just assuming the Register is wrong with no evidence of your own? That site lists services that you can disable without it breaking Vista. That's a *lot* different than services that you can disable without affecting Vista's common functionality. Sure, I can disable the service that handles network device discovery, but then all of a sudden I can't connect to my Xbox 360 anymore.
The Register made a claim about Vista having unnecessary services on by default. I said they should back up that claim with examples. Microsoft spent a lot of time making sure things we not enabled if they didn't need to be to support common use-cases out of the box.
I don't think anyone in the security industry can look at Vista and think MS really sat down and thought through what it would take to make malware problems a rarity on Windows. Really? Why? Seems to me they did exactly that.
hey obviously went for low hanging fruit and perceived security late in the game rather than a security minded release from the outset. The outset of what? If we're talking about Vista (and not XP, or 9x), then I would say you're completely wrong. The biggest changes in Vista are centered around security. Not only that, but it's the first consumer OS to come out of Redmond to be developed entirely via the Secure Development Lifecycle. Other products that have been developing using this, such as IIS 6, have an *excellent* track record on security. Far better, in fact, than their open source rivals. (Compare IIS 6 with Apache, and you'll see I'm right.)
This is not a revolutionarily secure OS, but a tweak of XP. What would it have taken for you to describe this as more than a "tweak of XP"?
I fully expected this kind of baloney from The Register. Do people here honestly think that a site that refers to Microsoft as "The Vole" would give a fair minded, intelligent, and well though out review of a Microsoft product. (Not sure why I'm asking that question on Slashdot... but whatever.)
However, there is a brokering mechanism that enables users to download files to any location they have access to, or to install browser plugins and extensions, and the like. So users are still invited to make a mess of their systems, and no doubt many will, while Microsoft has a chance to shift blame away from itself.
Uh huh. First, you can't install plugins/extensions (with the exception of signed ActiveX) without admin privs. Period. Second, how, exactly, would you propose the user be able to save files to their Documents folder, or do any other file operation in their profile (or basically anyplace on the system) without this brokering mechanism? Would you prefer that Microsoft not allow users to download *any* files via the browser? Ya, that would work out well.
However, IE7 on Vista does still write to parts of the registry in protected mode.
IE7 is running as an extremely low-rights user. This does *not* mean that it doesn't have the ability to write to any part of the registry. It means that the register's ACLs must explicitly allow write access to the IE's low-rights user. Certain locations have been explicitly marked as write-safe for the low integrity process. The example given by The Register is one of them. In other words, it's not an issue.
However, DEP, when full on, may cause a number of applications to crash, or interfere with their installation. I'm betting that a majority of users will opt for the more conservative setting, and this of course means less defense for everyone.
You're betting that the majority of users, most of whom think "DEP" is an actor's last name, will go and hunt down the DEP setting and turn it off because it will supposedly cause lots of applications to crash? Really? You mean they won't selectively turn it off via the dialog box that comes up after a DEP-related crash that asks if you want to turn it off just for this application? Oh, and what quantitative study are you sighting that shows that lots of commonly used applications will crash because of DEP? Give me a break.
User Account Control (UAC) is another good idea, because it finally, finally, finally allows the machine's owner to work from a standard user account, and still perform administrative tasks by supplying admin credentials as needed on a per-action basis. You know, the way Linux has been doing it forever.
Windows has supported running individual processes as admin (or any other account) since NT4. It was integrated into the GUI in Windows 2000. That is not the point of UAC, and it's not how Linux does it at all. If you try and run an application or perform an operation on Linux or Unix that requires admin access, it will fail. It doesn't prompt you. It's a subtle, but big difference. And it's a critical difference in the Windows world where that vast majority of applications won't work without admin privs.
Of course, it only works if everyone stays out of the admin account as much as possible, and if everyone with an admin password knows better than to install a questionable program with admin privileges. And there's the catch: "Windows needs your permission to install this cleverly-disguised Trojan nifty program. Click Yes to get rooted continue."
Wrong. It works regardless of what user you *think* you're running as. An admin account on Vista (with UAC enabled) is NOT AN ADMIN ACCOUNT. It's a limited user. The *only* difference is that an admin account isn't prompted to t
So changing the desktop wallpaper is a security issue in Linux too? Vista does not prompt you with UAC to change your freaking desktop wallpaper. Why the hell is this modded insightful?
Oh, that's right, because it bashes Microsoft and this is Slashdot. Never mind.
Thanks to years of fuckups by MICROS~1, when using Windows you must have elevated priviliges in order to run ordinary application programs. First, they weren't "fuckups". Windows has a very long legacy and it needs to preserve backwards compatibility or nobody would buy the new version. There is simply no way around that. Since a large part of that legacy was with single user systems with very few permissions, Windows applications rarely cared about permissions since they didn't really exist.
Second, for the past 8 years Microsoft has been screaming at ISVs to make their applications "Logo" certified, which is basically just a fancy name to describe an application that doesn't do stupid crap like write to c:\Program Files. The fact that ISVs have ignored Microsoft is really not Microsoft's fault.
Third, there are almost no applications that require elevated privs to run on Vista. Vista has an app compatibility layer that intercepts calls to restricted locations and redirects them to "virtual" folders under the user's path. This allows that vast majority of applications to run without admin privs and without the user even knowing there is something iffy going on. The only applications where this doesn't really work are applications that really do need admin privs, like a debugger or anti-virus application.
So perhaps you should spend less time coming up with clever ways to misspell Microsoft and more time learning about the products you're bashing.
The better solution is what OS X does: extend "sudo" to the GUI. The first time the app needs escalated privileges, prompt for the user's password. Then, cache those privileges for a reasonable amount of time and don't prompt. Unless the app in question is compromised in that interval, it doesn't matter. It's not a matter of the "app in question" being compromised. Vista doesn't elevate the entire user, it only elevates the application. For the entire length of execution of that application, the application will run elevated. For instance, Visual Studio.NET is an application that pretty much always needs to be run as admin. When I run the application as admin, it stays as admin. I get 1 UAC prompt, and for the entire lifetime of the process it is running as admin. No caching. No timeouts. No additional prompts.
If you cached the elevated credentials authorization for "X" minutes, or whatever, you would be giving a free pass to any malware that happened to be trying to do something bad. That's an incredibly bad solution. But I have to assume that's not what you're suggesting.
Browsing into "Program Files" throws up a UAC alert. No, it doesn't. By default, all users on the system can read files in c:\Program Files.
Writing to "Program Files" should throw up a UAC alert, but only the first time in the caching period. It does throw up a UAC, but I've already explained why the "caching period" is a bad idea. Now, what might be a good idea is running explorer.exe elevated when you need to perform lots of different file operations that require admin privs. And you can easily do that.
If you follow the second train of thought, you see that the caching mechanism is just fine, since if Explorer.exe was authorized 30 seconds ago, it's unlikely it was compromised since then, and should retain that authorization. Ok, I think I see where the confusion is. Explorer is unique in the sense that when you authorize a file operation via UAC it doesn't elevate the entire explorer process. There are a bunch of reasons for this. You *can* elevate the entire explorer process if you want, which will achieve what you're looking to do.
That barrage of UAC prompts only happened in pre-RC1 copies of Vista.
Now it causes none as long as you own the shortcut. (A shortcut is just a file, and permissions apply the same way they do to other files.)
If you don't own the file, it causes 1 UAC prompt.
This is no different from if you tried to delete a file on your Linux box that you didn't own. You would be forced to elevate your user to delete the file.
I don't want Windows yanking me away from whatever I'm doing because I got bored waiting for the UAC prompt to appear then all of a sudden it decides to finally show up and hog keyboard/mouse focus. Vista only steals focus if the application that caused the UAC prompt is still the active application window. If you've moved on to do something else, the UAC prompt appears flashing in the start menu until you click on it, then the secure desktop appears.
First of all, sudo is a much better way to do administrative tasks in *NIX. But aside from that, how many clicks does it take to enable/disable UAC? It is a lot faster to "su root" and then exit than click through even two menus. We're talking about something you might have to do once every few months. Do you seriously content that having something take 5 seconds longer is a bid deal?
But most of all: how long did Microsoft work on Vista and why could they not have done an intelligent job of it? So what would have been a better solution?
It's easy to say that UAC is a bad idea... but it's a lot harder to come up with a better solution.
So go ahead, give it a shot.
Why do you need to make excuses on a product that was in development for five years? I'm not trying to "make excuses". I'm trying to explain their reasoning... but obviously some people don't care and would rather just bash.
Funny, that's exactly the way that Windows Vista works.
The problem is that most Windows *applications* want to do things that require admin privs because they're poorly written.
There is nothing inherent to the Windows architecture that requires an application installer to have admin privs. It's just that most applications were written that way.
UAC is an effort to preserve compatibility while making the default user experience safer, and that's exactly what it does.
UAC only kicks in when I try to do something to a file or system resource that I don't have permission to access. Period. End of story.
In the unix world, if I want to modify a file that I don't own I must elevate my permissions using something like su root. And that's somehow *less* annoying than Vista's UAC prompt?
The only time I can see this being more annoying is when I'm doing lots of actions that require admin privs. Microsoft did their best to group operations in such a way that you only get one prompt. If I try and delete 20 files, all of which I don't have access to, I'll get 1 UAC prompt.
But sometimes they can't group these operations together, such as when I'm installing several applications when I'm first setting up my machine. In these scenarios, su root is superior in the sense that I su root once and that's it. With UAC, I'll get a prompt for each install.
But if you know you're going to be installing lots of applications and you don't want to be bothered with multiple UAC prompts, then just turn off UAC while you're doing those installations. Simple as that. And not harder that su root.
So what's the big deal? The vast majority of users don't install new applications every day. In fact, the vast majority of users don't do anything that requires admin privs on a daily basis. This is a non-issue.
I've been using Vista since late November. During the first few days of use I got a lot of UAC prompts, but I really didn't find them all that annoying. One extra click just wasn't a big deal. After getting my machine setup the way I wanted it, I rarely got any UAC prompts. Just doesn't happen all that often.
Since almost everybody who will run Vista will get it on a new machine with most of the software they will use pre-installed, this is even more of a non-issue.
But the biggest point is that the way that unix does it, with a session-based elevation, is no less time consuming (in fact, it's usually more time consuming), and it's FAR more dangerous for a "dumb" user because they will tend to just leave their session elevated.
Not OS files, but my own documents in my user directory. I find that hard to believe, unless you're talking about pre-RC2 Vista. Operations on files which you own or have normal permissions to, such as all the files in your user directory, do *not* cause a UAC prompt. Simple as that. Think of it this way, if you were on Unix, it would simply deny you access to the file in question. You would then have to su root to get the job done. In Vista, it makes that elevation a lot faster and easier.
For repeated, but seperate operations (like installing a lot of applications when you're setting up your machine), you can disable UAC. This is basically the same thing as su root if your account is an admin account. Once you're done, re-enable it. It's really not that hard.
Stuff like changing the layout of my Start menu. You'll only get a UAC prompt when modify start menu folders that are shown to all users. Why? Because these aren't folders you own. See my previous point. Also, why bother rearranging start menu folders in Vista? If you want to find something, type in the first couple of letters and it appears. It's MUCH faster than drilling down through folders.
Stuff like changing my desktop background. Stuff like copying a line of text from a web page in IE7 to paste in a document. You're either making this up, or you were using something that was even pre-pre RC1. This simply does not happen with Vista post-RC1.
It seems to be a fairly common sentiment that while stealing is a bad thing, stealing from the rich is OK.
If you honestly think that movie stars get paid too much, don't steal the resulting work, just don't buy it.
How much a DVD costs is determined by what people are willing to pay for it. Period. You can whine a cry about these idiot movie stars making 50x what you make, but if you go buy their movies anyway then you're just being stupid.
There are two primary reasons for games not working perfectly on Vista:
1.) Crappy video drivers. (Especially nVidia drivers.)
2.) The game needs admin privs.
If you're a victim of crappy drivers, well, that's the price you pay for being on the bleeding edge, I guess. ATI's drivers are fairly good. They had WHQL certified drivers released before Vista's consumer launch. nVidia, on the other hand, is dragging their ass. They've had a long time to get these drivers done. If you want to blame somebody, blame them.
If the game doesn't run without admin privs, then blame the game manufacturer. How do you know ahead of time? Well, if it has the "Designed for Windows XP" logo on the box, you should be good to go. These games were certified by Microsoft, and as part of that certification, they couldn't do stupid crap like write to c:\Program Files. If your game doesn't have that logo, then who knows.
Luckily, games that require admin privs can still be run on Vista without too much trouble. Just right click the game icon and select "Run as Administrator". Even better, right click it, go to properties, select Compatibility, and check the "Run as Administrator" option so that it always runs as admin. This will solve 99% of most people's gaming issues.
But games that don't run on Vista have nothing to do with Vista's "complexity" (it's a freaking modern OS, of course it's complex...), and it has nothing to do with some DirectX 9 incompatibility (the Dx9 bits ship with Vista).
Not to mention the fact that other sites mention pretty good luck with running games on Vista.
As usual, compatibility issues have more to do with 3rd party incompetence than with the quality of Microsoft's OS.
Well maybe because 4 of the 5 features have been demoed in Vista for over a year, and if the tables were turned everybody would be screaming "copycat" and "they stole that idea".
Funny, every review of a feature of Windows Vista that I read mentioned Apple and OS X. *Every single one.* It was incredible.
Yet this review doesn't mention Microsoft or Vista once, despite the fact that all of the features are available on Vista right now. (Although the "remote searching" feature isn't as complete as 10.5's, and it won't be until Longhorn Server is released.)
If this was a Vista review, there would have probably been no fewer than 5 comparisons to OS X.
This is about freedom of speech. It may not be about "rights" or the law, but it is most definitely about freedom of speech.
Anybody claiming that Google or Amazon are breaking any laws by doing this is incorrect, but claiming that this isn't a freedom of speech issue is just as incorrect.
Both Amazon and Google should be derided and criticized for their actions, and that's what this post is all about.
Slashdot Mirror
Not at all. What about Paul's article is unresonable or incorrect?
... another way to look at it is that Microsoft actually showed compassion and basically saved Apple from bankruptcy.
Of course, that doesn't make a good Slashdot headline. So never mind.
It is also extremely difficult, although usually not impossible, to get to the rooftops of some of the higher buildings without having at least a level 2 agility.
I've had the game since the day it came out, and I had been playing the demo for several weeks prior to that.
I am probably one of 6 people who bought the game for the game, and not the Halo 3 beta invite. The demo was a *blast* and was probably the most fun I've had on the 360. Yes, more than Gears of War.
The game starts off a bit slow. You're not really sure what to do. Eventually you'll realize that this open ended game play is what makes Crackdown so much damn fun. Don't feel like doing the missions or taking on the bad guys? Fine. Go have fun leaping from rooftop to rooftop, or leveling up your explosives skills to the point where a single grenade can take out a dozen cars sitting in traffic.
The whole concept of "leveling" your character through the various power ups turns out to be extremely, extremely addicting. It turns into an almost uncontrollable compulsion to get those green orbs. And the blue orbs? Forget about it. They're like heroin. Even the animation that you get when you reach the next level is addicting. You're guy does a highlander style quickening with a bit of an explosive blast wave added in for effect. Everything around you gets knocked over and thrown about 10 feet... including bad guys. I often find myself trying to time my level-ups so that I'm in a crowded area or next to a bunch of cars. Something very satisfying about having things blown away from you... quite the power trip.
Once you've defeated the baddies in Los Muertos, you'll probably wander over to Volk's territory. Previously, the game didn't really offer *that* much of a challenge on the default settings. As long as you weren't stupid and stayed in one place too long, dying wasn't all that common. That changes fast. The Volk will kick your ass. They're smarter. They have MUCH bigger guns (um... rocket launcher = pain), and they have double life meters. And don't get me started on the Shai Gen.
Are there flaws? Yes. The bosses are often too weak... although if you turn up the difficulty level a notch they can give you your money's worth. The story line is iffy. There aren't enough... um... structured missions. One of the strength's of GTA is that while it was very open and non-restrictive, it also had structure if your chose to participate. Crackdown lacks this.
There are also a few control glitches. I've found myself trying to pick up a car, but not be given the option for no real reason. It can also be frustratingly difficult to attack the correct baddie when there are lots of bodies laying around because you target all bad guys, not just the alive and kicking ones.
That said, the game is a LOT of fun. It's the first time on my 360 that I've had "Mario Thumb". (You know... the sore, red thumb caused by repeated button mashing.) And when you start playing co-op... wow. It really doesn't get much better. Honestly. Especially when you decide it's more fun to try and kill each other than complete the missions. (Supercop vs Supercop = BOOOOOOM!)
At one point I set a trap for my co-op nemesis. He was chasing me and I drove past a large group of cars stuck in traffic. In essentially one motion I leaped from my car, spun around, and fired a rocket into the group of cars just as he was passing them. The resulting explosion sent his car flying through the air uncontrollably. I then targeted his car and nailed it with 6 or 7 rockets, keeping it flipping through the air. It was like something out of a movie... and man was it fun.
This is one of those games that you really just have to play. Give it 30 minutes of you're time and all of a sudden you'll realize you've been playing it for 6 hours.
First, signing alone is useless. It is one of the three vital components of a MAC desktop. Second, unless it is open to all comers it will be fairly useless. Competition among verification services is the only way to get accurate ones.
Huh? Signing allows me to identify where the application came from and that it has not been modified since it was signed. It's extremely useful. Get a grip.
Applications don't ship with ACLs, I don't see a way to measure the input from multiple groups, and I don't see a distinction between certified software from a given domain and verified software from a developer or third party.
Measure input from multiple groups about what? Are you saying that you want people to vote on whether or not an application is safe? That's an interesting idea, but one that doesn't exist anywhere right now, as far as I know.
It is very, very possible in a non-managed word as you put it. MAC have been in use for over a decade. If one was included and enabled by default in Windows, developers would code with that in mind. What makes you think it is not possible?
You have any documentation about how the Mac magically makes it so that unmanaged applications can be restricted from performing tasks that the user running that application can perform, and in a manner that would not require all existing applications to be rewritten? No, I suspect you don't. There are certain vital requirements that you need to have in order to make sure an application can only do certain things, regardless of the user's privileges running it. Verifiability of the code, restriction of direct memory access, and a wide variety of other things. Objective-C on the Mac has none of these. Only managed environments, such as Java and .NET, currently provide this functionality.
I only tried RC1 and it certainly did then, but regardless by all accounts there are a great many notifications for common tasks. One fairly reputable review on a security site I read showed it appearing 7 times while the user attempted to change their IP address. Because they decided not to use persistence of authentication for a given period it will almost certainly appear a lot more than sudo based systems. Add to this the terrible UI (Allow)(Deny) that does not have unique action for a given prompt and it is certain to be fairly useless to the average person.
Oh, so you haven't even used the product your bashing incoherently. Big surprise. Changing your IP in Vista causes 1 UAC prompt, so you're full of crap there as well. As far as "persistence" of authentication, yes, they do have that. When you authorize something to run elevated, it continues to run elevated until you close it. Just like sudo. When performing multiple file copy operations, which internally are all separate operations, Explorer will automatically persist the authorization. The only time you'll see multiple UAC dialogs is if you perform multiple, discrete tasks via difference processes. Just like in Linux. So you're wrong again.
I scanned through that article the other day. I did not see it listing the services. It looked like PR fluff.
What list are you looking for? A list of services that are "required"? Required by who? It depends on the user. That article points out how Microsoft dramatically improved the security of services in general, including how they prevent network access for all that don't require it. In other words, it directly addresses the "concerns" of The Register article. But I guess you didn't catch that during your "scanning".
No, most of the work in Vista was expanding into other markets and embracing them and trying to gain feature parity with OS X. Vista adds eye candy, searching, widgets, expose, included apps, etc. in order to try to counter Apple's slow gains in market share.
Apples slow gains in market share? Ya,
If you had read the link I posted regarding signed ActiveX, you would see that it only allows signed ActiveX installations if group policy explicitly allows that particular company's software. In other words, only if the IT department says that particular control or company is OK.
This makes Vista far more secure than XP in the sense that users will no longer have to be admin simply to access the controls they need to get their job done. They can run as a standard user and still install the control(s) they need.
The Register made a claim about Vista having unnecessary services on by default. I said they should back up that claim with examples. Microsoft spent a lot of time making sure things we not enabled if they didn't need to be to support common use-cases out of the box. I don't think anyone in the security industry can look at Vista and think MS really sat down and thought through what it would take to make malware problems a rarity on Windows. Really? Why? Seems to me they did exactly that. hey obviously went for low hanging fruit and perceived security late in the game rather than a security minded release from the outset. The outset of what? If we're talking about Vista (and not XP, or 9x), then I would say you're completely wrong. The biggest changes in Vista are centered around security. Not only that, but it's the first consumer OS to come out of Redmond to be developed entirely via the Secure Development Lifecycle. Other products that have been developing using this, such as IIS 6, have an *excellent* track record on security. Far better, in fact, than their open source rivals. (Compare IIS 6 with Apache, and you'll see I'm right.) This is not a revolutionarily secure OS, but a tweak of XP. What would it have taken for you to describe this as more than a "tweak of XP"?
So, point by point:
While referring to IE's Protected Mode feature:
However, there is a brokering mechanism that enables users to download files to any location they have access to, or to install browser plugins and extensions, and the like. So users are still invited to make a mess of their systems, and no doubt many will, while Microsoft has a chance to shift blame away from itself.
Uh huh. First, you can't install plugins/extensions (with the exception of signed ActiveX) without admin privs. Period. Second, how, exactly, would you propose the user be able to save files to their Documents folder, or do any other file operation in their profile (or basically anyplace on the system) without this brokering mechanism? Would you prefer that Microsoft not allow users to download *any* files via the browser? Ya, that would work out well.
However, IE7 on Vista does still write to parts of the registry in protected mode.
IE7 is running as an extremely low-rights user. This does *not* mean that it doesn't have the ability to write to any part of the registry. It means that the register's ACLs must explicitly allow write access to the IE's low-rights user. Certain locations have been explicitly marked as write-safe for the low integrity process. The example given by The Register is one of them. In other words, it's not an issue.
However, DEP, when full on, may cause a number of applications to crash, or interfere with their installation. I'm betting that a majority of users will opt for the more conservative setting, and this of course means less defense for everyone.
You're betting that the majority of users, most of whom think "DEP" is an actor's last name, will go and hunt down the DEP setting and turn it off because it will supposedly cause lots of applications to crash? Really? You mean they won't selectively turn it off via the dialog box that comes up after a DEP-related crash that asks if you want to turn it off just for this application? Oh, and what quantitative study are you sighting that shows that lots of commonly used applications will crash because of DEP? Give me a break.
User Account Control (UAC) is another good idea, because it finally, finally, finally allows the machine's owner to work from a standard user account, and still perform administrative tasks by supplying admin credentials as needed on a per-action basis. You know, the way Linux has been doing it forever.
Windows has supported running individual processes as admin (or any other account) since NT4. It was integrated into the GUI in Windows 2000. That is not the point of UAC, and it's not how Linux does it at all. If you try and run an application or perform an operation on Linux or Unix that requires admin access, it will fail. It doesn't prompt you. It's a subtle, but big difference. And it's a critical difference in the Windows world where that vast majority of applications won't work without admin privs.
Of course, it only works if everyone stays out of the admin account as much as possible, and if everyone with an admin password knows better than to install a questionable program with admin privileges. And there's the catch: "Windows needs your permission to install this cleverly-disguised Trojan nifty program. Click Yes to get rooted continue."
Wrong. It works regardless of what user you *think* you're running as. An admin account on Vista (with UAC enabled) is NOT AN ADMIN ACCOUNT. It's a limited user. The *only* difference is that an admin account isn't prompted to t
Oh, that's right, because it bashes Microsoft and this is Slashdot. Never mind.
You're correct. I was wrong about the session-based generalization.
But my point stands. How is this any different that UAC?
Second, for the past 8 years Microsoft has been screaming at ISVs to make their applications "Logo" certified, which is basically just a fancy name to describe an application that doesn't do stupid crap like write to c:\Program Files. The fact that ISVs have ignored Microsoft is really not Microsoft's fault.
Third, there are almost no applications that require elevated privs to run on Vista. Vista has an app compatibility layer that intercepts calls to restricted locations and redirects them to "virtual" folders under the user's path. This allows that vast majority of applications to run without admin privs and without the user even knowing there is something iffy going on. The only applications where this doesn't really work are applications that really do need admin privs, like a debugger or anti-virus application.
So perhaps you should spend less time coming up with clever ways to misspell Microsoft and more time learning about the products you're bashing.
Ok. So SUDO lets you run one command as root.
How is this different than UAC aside from being done from the command line?
If SUDO is amazing technology, than so is UAC.
If you cached the elevated credentials authorization for "X" minutes, or whatever, you would be giving a free pass to any malware that happened to be trying to do something bad. That's an incredibly bad solution. But I have to assume that's not what you're suggesting. Browsing into "Program Files" throws up a UAC alert. No, it doesn't. By default, all users on the system can read files in c:\Program Files. Writing to "Program Files" should throw up a UAC alert, but only the first time in the caching period. It does throw up a UAC, but I've already explained why the "caching period" is a bad idea. Now, what might be a good idea is running explorer.exe elevated when you need to perform lots of different file operations that require admin privs. And you can easily do that. If you follow the second train of thought, you see that the caching mechanism is just fine, since if Explorer.exe was authorized 30 seconds ago, it's unlikely it was compromised since then, and should retain that authorization. Ok, I think I see where the confusion is. Explorer is unique in the sense that when you authorize a file operation via UAC it doesn't elevate the entire explorer process. There are a bunch of reasons for this. You *can* elevate the entire explorer process if you want, which will achieve what you're looking to do.
That make sense?
Fuck you buddy. I'm just trying to dispel all the FUD.
Are you so arrogant that you think people must be getting paid if they disagree with you?
That barrage of UAC prompts only happened in pre-RC1 copies of Vista.
Now it causes none as long as you own the shortcut. (A shortcut is just a file, and permissions apply the same way they do to other files.)
If you don't own the file, it causes 1 UAC prompt.
This is no different from if you tried to delete a file on your Linux box that you didn't own. You would be forced to elevate your user to delete the file.
The change was post-RC1 I think.
It's easy to say that UAC is a bad idea... but it's a lot harder to come up with a better solution.
So go ahead, give it a shot. Why do you need to make excuses on a product that was in development for five years? I'm not trying to "make excuses". I'm trying to explain their reasoning... but obviously some people don't care and would rather just bash.
Funny, that's exactly the way that Windows Vista works.
The problem is that most Windows *applications* want to do things that require admin privs because they're poorly written.
There is nothing inherent to the Windows architecture that requires an application installer to have admin privs. It's just that most applications were written that way.
UAC is an effort to preserve compatibility while making the default user experience safer, and that's exactly what it does.
UAC only kicks in when I try to do something to a file or system resource that I don't have permission to access. Period. End of story.
In the unix world, if I want to modify a file that I don't own I must elevate my permissions using something like su root. And that's somehow *less* annoying than Vista's UAC prompt?
The only time I can see this being more annoying is when I'm doing lots of actions that require admin privs. Microsoft did their best to group operations in such a way that you only get one prompt. If I try and delete 20 files, all of which I don't have access to, I'll get 1 UAC prompt.
But sometimes they can't group these operations together, such as when I'm installing several applications when I'm first setting up my machine. In these scenarios, su root is superior in the sense that I su root once and that's it. With UAC, I'll get a prompt for each install.
But if you know you're going to be installing lots of applications and you don't want to be bothered with multiple UAC prompts, then just turn off UAC while you're doing those installations. Simple as that. And not harder that su root.
So what's the big deal? The vast majority of users don't install new applications every day. In fact, the vast majority of users don't do anything that requires admin privs on a daily basis. This is a non-issue.
I've been using Vista since late November. During the first few days of use I got a lot of UAC prompts, but I really didn't find them all that annoying. One extra click just wasn't a big deal. After getting my machine setup the way I wanted it, I rarely got any UAC prompts. Just doesn't happen all that often.
Since almost everybody who will run Vista will get it on a new machine with most of the software they will use pre-installed, this is even more of a non-issue.
But the biggest point is that the way that unix does it, with a session-based elevation, is no less time consuming (in fact, it's usually more time consuming), and it's FAR more dangerous for a "dumb" user because they will tend to just leave their session elevated.
For repeated, but seperate operations (like installing a lot of applications when you're setting up your machine), you can disable UAC. This is basically the same thing as su root if your account is an admin account. Once you're done, re-enable it. It's really not that hard. Stuff like changing the layout of my Start menu. You'll only get a UAC prompt when modify start menu folders that are shown to all users. Why? Because these aren't folders you own. See my previous point. Also, why bother rearranging start menu folders in Vista? If you want to find something, type in the first couple of letters and it appears. It's MUCH faster than drilling down through folders. Stuff like changing my desktop background. Stuff like copying a line of text from a web page in IE7 to paste in a document. You're either making this up, or you were using something that was even pre-pre RC1. This simply does not happen with Vista post-RC1.
It seems to be a fairly common sentiment that while stealing is a bad thing, stealing from the rich is OK.
If you honestly think that movie stars get paid too much, don't steal the resulting work, just don't buy it.
How much a DVD costs is determined by what people are willing to pay for it. Period. You can whine a cry about these idiot movie stars making 50x what you make, but if you go buy their movies anyway then you're just being stupid.
There are two primary reasons for games not working perfectly on Vista:
1.) Crappy video drivers. (Especially nVidia drivers.)
2.) The game needs admin privs.
If you're a victim of crappy drivers, well, that's the price you pay for being on the bleeding edge, I guess. ATI's drivers are fairly good. They had WHQL certified drivers released before Vista's consumer launch. nVidia, on the other hand, is dragging their ass. They've had a long time to get these drivers done. If you want to blame somebody, blame them.
If the game doesn't run without admin privs, then blame the game manufacturer. How do you know ahead of time? Well, if it has the "Designed for Windows XP" logo on the box, you should be good to go. These games were certified by Microsoft, and as part of that certification, they couldn't do stupid crap like write to c:\Program Files. If your game doesn't have that logo, then who knows.
Luckily, games that require admin privs can still be run on Vista without too much trouble. Just right click the game icon and select "Run as Administrator". Even better, right click it, go to properties, select Compatibility, and check the "Run as Administrator" option so that it always runs as admin. This will solve 99% of most people's gaming issues.
But games that don't run on Vista have nothing to do with Vista's "complexity" (it's a freaking modern OS, of course it's complex...), and it has nothing to do with some DirectX 9 incompatibility (the Dx9 bits ship with Vista).
Not to mention the fact that other sites mention pretty good luck with running games on Vista.
As usual, compatibility issues have more to do with 3rd party incompetence than with the quality of Microsoft's OS.
Well maybe because 4 of the 5 features have been demoed in Vista for over a year, and if the tables were turned everybody would be screaming "copycat" and "they stole that idea".
Maybe that's why.
Funny, every review of a feature of Windows Vista that I read mentioned Apple and OS X. *Every single one.* It was incredible.
Yet this review doesn't mention Microsoft or Vista once, despite the fact that all of the features are available on Vista right now. (Although the "remote searching" feature isn't as complete as 10.5's, and it won't be until Longhorn Server is released.)
If this was a Vista review, there would have probably been no fewer than 5 comparisons to OS X.
This is about freedom of speech. It may not be about "rights" or the law, but it is most definitely about freedom of speech.
Anybody claiming that Google or Amazon are breaking any laws by doing this is incorrect, but claiming that this isn't a freedom of speech issue is just as incorrect.
Both Amazon and Google should be derided and criticized for their actions, and that's what this post is all about.