Should Stardock fix Microsoft's UAC?
User Account Control on Vista discussion
Wednesday, February 21, 2007 by Frogboy | Discussion: WinCustomize News
In a new Macintosh advertisement, the PC has what looks like a body guard who keeps interupting the conversation with the Mac in the name of "security". The feature Apple is making fun of is called the User Account Control.
The idea behind UAC is to protect users from malicious software and other content that could affect the stability and integrity of the user's computer. But many users have expressed utter disdain for it. As a result, UAC ends up being disabled by users much to the chagrin of Microsoft.
But what if there was a different solution? What if third-parties were able to modify how UAC worked?
For example, imagine the UAC remembering what users had given it permission to previously? Right now, every time I open up Stardock Central, I'm prompted by UAC. Very annoying. What if after I selected "continue" it saved Stardock Central and its checksum such that it wouldn't come up again for that program as long as it was unchanged?
Another example would be after I select continue on the UAC, the account remains in an elevated state for say 5 minutes (or some user-defined time) so that anything else that needs UAC would automatically be passed.
I think just these two changes would significantly improve the usability of UAC to the point where most of the complaints would go away.
And I think these kinds of changes are absolutely necessary because, right now, users are just turning it off completely which is definitely not a good thing. You should definitely not turn off UAC but it is very understandable how annoying its current implementation can tend to be.
Microsoft has stated that any attempt to alter the functionality of UAC would be considered a security violation that would be dealt with accordingly. It's scary sounding stuff. But if the alternative is that millions simply turn off this functionality or the bad reputation of UAC slows migration to Windows Vista then what's the best path?
Which brings us back, should third-parties like Stardock step in and fix UAC on their own? Or should the user base wait and hope that Microsoft enhances the UAC experience?
 |
|
Page 4 of 5 | |
|
|---|
JcRabbit
Reply #62 Thursday, February 22, 2007 1:53 PM
Reply #62 Thursday, February 22, 2007 1:53 PM
As the developer of Winstep Xtreme, I feel for Stardock as their pains with the UAC are my pains as well (and, without a doubt, the pains of many thousands of other developers out there).
The UAC, in it's currently implementation, is simply brain damaged. It doesn't work, and it's forcing us, developers, to go to unbelievable extends to change software that worked perfectly in previous Windows versions. It's incredible frustrating, specially given the current lack of information provided by Microsoft. As for software that is NOT run-of-the-mill and is no longer in active development, tough luck - it simply won't work properly, or at all, in Vista.
As stated by many, it's still up to the user to allow an elevation of privilege or not. With the UAC crying wolf all the time (way too many things in Vista require an elevation of privilege), this is no different than before: it is still the user's responsibility to take care of their systems by clicking Yes or No!
As a responsible user, I only EVER caught a computer virus once, and that was in the first 3 months of buying my first PC, many, many, eons ago. I learned my lesson then. Like with a car, what people need are safety systems, not something that only lets you drive at 10 MPH because you might kill yourself in an accident otherwise. What you need are good Anti-Virus and Anti-Spyware tools (never understood why these two are not merged together in a single application as they should) and a proper Firewall. Add to that common sense, the same common sense that keeps most (sigh!) people from driving at 100 MPH on a wet road on a rainy day.
The current UAC implementation works by denying functionality, i.e.; it won't let virus do things that might damage your system, but it will also block other programs that might have VERY good and legit reasons to do the same thing. That is absolutely insane, and, since it's still up to the user to allow or deny a specific action, it changes almost NOTHING in terms of security while BREAKING thousands of applications.
For anyone interested, you can view a more detailed discussion about UAC problems from a developer's perspective in the Winstep Forums and in the MSDN Security Forums.
The UAC, in it's currently implementation, is simply brain damaged. It doesn't work, and it's forcing us, developers, to go to unbelievable extends to change software that worked perfectly in previous Windows versions. It's incredible frustrating, specially given the current lack of information provided by Microsoft. As for software that is NOT run-of-the-mill and is no longer in active development, tough luck - it simply won't work properly, or at all, in Vista.
As stated by many, it's still up to the user to allow an elevation of privilege or not. With the UAC crying wolf all the time (way too many things in Vista require an elevation of privilege), this is no different than before: it is still the user's responsibility to take care of their systems by clicking Yes or No!
As a responsible user, I only EVER caught a computer virus once, and that was in the first 3 months of buying my first PC, many, many, eons ago. I learned my lesson then. Like with a car, what people need are safety systems, not something that only lets you drive at 10 MPH because you might kill yourself in an accident otherwise. What you need are good Anti-Virus and Anti-Spyware tools (never understood why these two are not merged together in a single application as they should) and a proper Firewall. Add to that common sense, the same common sense that keeps most (sigh!) people from driving at 100 MPH on a wet road on a rainy day.
The current UAC implementation works by denying functionality, i.e.; it won't let virus do things that might damage your system, but it will also block other programs that might have VERY good and legit reasons to do the same thing. That is absolutely insane, and, since it's still up to the user to allow or deny a specific action, it changes almost NOTHING in terms of security while BREAKING thousands of applications.
For anyone interested, you can view a more detailed discussion about UAC problems from a developer's perspective in the Winstep Forums and in the MSDN Security Forums.
rabidrobot
Reply #64 Thursday, February 22, 2007 2:49 PM
Reply #64 Thursday, February 22, 2007 2:49 PM
While I found the UAC to be so annoying that I had to turn it off, I am having second thoughts about this.
This article in particular http://www.jimmah.com/vista/security/uac.aspx
had some great information.
I have been approaching UAC concerned only about how inconvenient I found it. I realize that most PC users do not do the things I do with my computer. I realize that frequently computers have more than one user, or are being used in a corporate environment. Indeed, it would seem that the vast majority of PC users will only infrequently see the UAC prompt.
Just because I like to install and try out several programs a week. Just because I like to access WMI from sidebar gadgets. Just because I use many older applications which silently fail with UAC enabled--all that does not mean that UAC is not a godsend for the more typical user.
Also, I need, as a person who like to make apps and widgets, to learn to live with UAC. I don't really want my apps to be another UAC annoyance when with a little forethought and planning I could design them to work alongside UAC. That is going to be my responsibility as a "developer", and it would be immature and shortsighted for me to ask users to circumvent their security just because I didn't want to take the time to do things right.
The article I linked above not only has great information on what UAC is and is not, but also has some helpful hints (which I will have to reboot to test, but..) about working with UAC. For example I found UAC particularly annoying when I was exploring the various control panels and changing settings. Turns out I probably could have just run "control.exe" as an administrator, and would have been able to make all the changes I wanted without being asked for confirmation at every step.
I'm not exactly happy about having to keep track myself which programs need a Run as Administrator shortcut (or right-click) and which can operate without this access. But I think that as developers adapt and update their products for this new system, that the annoyances will diminish.
Perfect, UAC is not. UAC can be more annoying than useful to a particular sort of power user. In particular I think the notifications should specifically state why the task needs elevated access--that is, what is it trying to do that is cause for concern. But I am going to give it another chance because I do believe in it in concept. If it interferes with my workflow significantly I may disable it entirely again, but I think I am going to give it a much closer look before making that decision.
This article in particular http://www.jimmah.com/vista/security/uac.aspx
had some great information.
I have been approaching UAC concerned only about how inconvenient I found it. I realize that most PC users do not do the things I do with my computer. I realize that frequently computers have more than one user, or are being used in a corporate environment. Indeed, it would seem that the vast majority of PC users will only infrequently see the UAC prompt.
Just because I like to install and try out several programs a week. Just because I like to access WMI from sidebar gadgets. Just because I use many older applications which silently fail with UAC enabled--all that does not mean that UAC is not a godsend for the more typical user.
Also, I need, as a person who like to make apps and widgets, to learn to live with UAC. I don't really want my apps to be another UAC annoyance when with a little forethought and planning I could design them to work alongside UAC. That is going to be my responsibility as a "developer", and it would be immature and shortsighted for me to ask users to circumvent their security just because I didn't want to take the time to do things right.
The article I linked above not only has great information on what UAC is and is not, but also has some helpful hints (which I will have to reboot to test, but..) about working with UAC. For example I found UAC particularly annoying when I was exploring the various control panels and changing settings. Turns out I probably could have just run "control.exe" as an administrator, and would have been able to make all the changes I wanted without being asked for confirmation at every step.
I'm not exactly happy about having to keep track myself which programs need a Run as Administrator shortcut (or right-click) and which can operate without this access. But I think that as developers adapt and update their products for this new system, that the annoyances will diminish.
Perfect, UAC is not. UAC can be more annoying than useful to a particular sort of power user. In particular I think the notifications should specifically state why the task needs elevated access--that is, what is it trying to do that is cause for concern. But I am going to give it another chance because I do believe in it in concept. If it interferes with my workflow significantly I may disable it entirely again, but I think I am going to give it a much closer look before making that decision.
Jan71
Reply #65 Thursday, February 22, 2007 3:52 PM
Reply #65 Thursday, February 22, 2007 3:52 PM
Rabidrobot,
thanks for this instructive article.
Unix users are for years used to the Administrator (or Super User) concept.
People have been bashing Microsoft because Windows was so vulnerable to viruses and, more important, users. Finally they come up with something that has been proved in the industry times and times again, and they get accused of delivering a broken piece of software ?
I really don't get it.
As you stated, most users will only rarely be confronted with this screen. Most of the time when they try to do something that was not intended for a normal user.
I consider myself a power user, even if I am not an experienced programmer. First thing I did was turning UAC off. Second thing I did was forcing not supported drivers to the system (heck, I picked all the parts myself, I know what I am doing!). Third thing I did was a complete clean install
because my USB storage was not recognized anymore.
Would UAC have saved me ? No, because I am a power user, and know how to counter it.
But it would (and will) block a lot of people from doing stupid things.
Brad, Stardock, I strongly advice against adapting the security rules to your needs.
Instead, try to play the game. I granted Administrator rights to Stardock Central, and it asks me only once for confirmation.
So the feature most asked, memorize the granted acces for a period of time, is already build in. Only you need to be Administrator to activate it
.
It is a new concept to Windows, and we will need to learn to work with it, but in the long run, we will all win, because viruses and trojans etc will have less opportunities to make havoc.
If one company starts to change the rules, others will follow, and we are back to zero.
Imagine a virus that makes use of Stardocks code to alter the security rules to its benefit.
How do you think Stardock will come out of that ?
Please read the mentioned article if you did not do it yet :
http://www.jimmah.com/vista/security/uac.aspx
Jan
thanks for this instructive article.
Unix users are for years used to the Administrator (or Super User) concept.
People have been bashing Microsoft because Windows was so vulnerable to viruses and, more important, users. Finally they come up with something that has been proved in the industry times and times again, and they get accused of delivering a broken piece of software ?
I really don't get it.
As you stated, most users will only rarely be confronted with this screen. Most of the time when they try to do something that was not intended for a normal user.
I consider myself a power user, even if I am not an experienced programmer. First thing I did was turning UAC off. Second thing I did was forcing not supported drivers to the system (heck, I picked all the parts myself, I know what I am doing!). Third thing I did was a complete clean install
because my USB storage was not recognized anymore. Would UAC have saved me ? No, because I am a power user, and know how to counter it.
But it would (and will) block a lot of people from doing stupid things.
Brad, Stardock, I strongly advice against adapting the security rules to your needs.
Instead, try to play the game. I granted Administrator rights to Stardock Central, and it asks me only once for confirmation.
So the feature most asked, memorize the granted acces for a period of time, is already build in. Only you need to be Administrator to activate it
.It is a new concept to Windows, and we will need to learn to work with it, but in the long run, we will all win, because viruses and trojans etc will have less opportunities to make havoc.
If one company starts to change the rules, others will follow, and we are back to zero.
Imagine a virus that makes use of Stardocks code to alter the security rules to its benefit.
How do you think Stardock will come out of that ?
Please read the mentioned article if you did not do it yet :
http://www.jimmah.com/vista/security/uac.aspx
Jan
BakInMyDay
Reply #66 Thursday, February 22, 2007 5:04 PM
Microsoft had a perfectly good model upon which to base UAC, had they been able to get over their "not invented here" mentality--the way that Linux does it. When you install most Linux distros, you have to set up a ROOT password, in addition to the password for each user account. Users don't run as ROOT; they run as USERS. When something needs to be done that requires ROOT access, you get a pop-up that prompts you for the ROOT password. This does not lock up the rest of the system the way that UAC nag-boxes do, and if you're so inclined, you can go and do something else before responding.
I hate UAC, and think that MSFT must have been smoking some bad weed when they designed it and its in-your-face obnoxiousness. The Linux approach is much simpler, and doesn't have the stench of the sorta-kinda "administrator" account that Vista puts into place.
I _know_ there are plenty of smart people working for Microsoft; why do some of their latest creations seem to have been put together after a weekend-long binge?
Reply #66 Thursday, February 22, 2007 5:04 PM
Microsoft had a perfectly good model upon which to base UAC, had they been able to get over their "not invented here" mentality--the way that Linux does it. When you install most Linux distros, you have to set up a ROOT password, in addition to the password for each user account. Users don't run as ROOT; they run as USERS. When something needs to be done that requires ROOT access, you get a pop-up that prompts you for the ROOT password. This does not lock up the rest of the system the way that UAC nag-boxes do, and if you're so inclined, you can go and do something else before responding.
I hate UAC, and think that MSFT must have been smoking some bad weed when they designed it and its in-your-face obnoxiousness. The Linux approach is much simpler, and doesn't have the stench of the sorta-kinda "administrator" account that Vista puts into place.
I _know_ there are plenty of smart people working for Microsoft; why do some of their latest creations seem to have been put together after a weekend-long binge?
JRSCCivic98
Reply #67 Thursday, February 22, 2007 5:22 PM
Yes!!! I have to say that I'm not a big Linux user simply because I think I just can't do in Linux what I can do in Windows. Windows runs everything that I use from games to apps to whatever... it just works because "it's the most popular OS in the world", not because it's good. With that said, I would have LOVED Vista if it came with a UAC that acted like Linux's does. When I played arround with Mandrake I loved that feature... you'd try and do something and it would prompt for the password. People knew that you're going into a special mode for that one process... it took a little thinking and realization from the user. I don't know what they didn't do it this way. The damn thing should prompt when something is trying to install or when something is trying to make system or registry changes or run a process that's not considered "normal". Why the f*** does it have to prompt me when I go into display properties? I know why I'm going in there... I freaking asked it to. Have any of you ever seen any spyware that changes your resolution on the fly? I sure haven't, so there's no need to ass-pucker the display properties with UAC. Network settings... yes, maybe, if it's advanced settings.
In the end, a lof of us will note one thing. We're all getting a lot of UAC prompts because we're trying to do things in Vista in "The old Windows way". They have changed a lot of the layout of the system and where stuff is and you'll notice that if you actually do things the "Vista Way" you will not get any UAC prompts unless you're really digging through stuff. I think MS must have hired some Mac people to design the visual layout of Office 2007 and Vista because when I sit in front of a Vista/Office 2007 system right now I feel about as visually dumb as when I sit in front of a Mac.
I think we all have to kind of forget how we do things in previous versions of Windows in order to feel "more at home" with Vista.
Reply #67 Thursday, February 22, 2007 5:22 PM
Microsoft had a perfectly good model upon which to base UAC, had they been able to get over their "not invented here" mentality--the way that Linux does it. When you install most Linux distros, you have to set up a ROOT password, in addition to the password for each user account. Users don't run as ROOT; they run as USERS. When something needs to be done that requires ROOT access, you get a pop-up that prompts you for the ROOT password. This does not lock up the rest of the system the way that UAC nag-boxes do, and if you're so inclined, you can go and do something else before responding.
Yes!!! I have to say that I'm not a big Linux user simply because I think I just can't do in Linux what I can do in Windows. Windows runs everything that I use from games to apps to whatever... it just works because "it's the most popular OS in the world", not because it's good. With that said, I would have LOVED Vista if it came with a UAC that acted like Linux's does. When I played arround with Mandrake I loved that feature... you'd try and do something and it would prompt for the password. People knew that you're going into a special mode for that one process... it took a little thinking and realization from the user. I don't know what they didn't do it this way. The damn thing should prompt when something is trying to install or when something is trying to make system or registry changes or run a process that's not considered "normal". Why the f*** does it have to prompt me when I go into display properties? I know why I'm going in there... I freaking asked it to. Have any of you ever seen any spyware that changes your resolution on the fly? I sure haven't, so there's no need to ass-pucker the display properties with UAC. Network settings... yes, maybe, if it's advanced settings.
In the end, a lof of us will note one thing. We're all getting a lot of UAC prompts because we're trying to do things in Vista in "The old Windows way". They have changed a lot of the layout of the system and where stuff is and you'll notice that if you actually do things the "Vista Way" you will not get any UAC prompts unless you're really digging through stuff. I think MS must have hired some Mac people to design the visual layout of Office 2007 and Vista because when I sit in front of a Vista/Office 2007 system right now I feel about as visually dumb as when I sit in front of a Mac.
I think we all have to kind of forget how we do things in previous versions of Windows in order to feel "more at home" with Vista.
DesignCaddy
Reply #68 Thursday, February 22, 2007 5:45 PM
Reply #68 Thursday, February 22, 2007 5:45 PM
I'm joining this late but, my fear with UAC is that it builds on top of something windows does not need made any worse:
Too many options.
UAC in its present form is indeed very annoying. I have several apps that require admin privileges and i'd like to be able to elevate them once, and have UAC remember that setting. I also disabled the secure desktop because it lags every time something is elevated; i prefer to simply click 'allow' once.
But even if stardock's- or somebody elses' - tweak app could allow you to adjust UAC to work better for you, it becomes just another setting in an endless sea of settings that require adjustment when you set up windows. Most of us don't mind going in to the registry or opening services to tweak something. But when my mother says "How can i make it stop?" and i start opening control panels and adjusting things for her, it hurts to see her eyes roll. It shouldn't have to be messed with.
I'm happy that windows allows for UAC to be tweaked at the service level by an expert. But it is unnecessary to have to be done. They should have just gotten it right. Prompts to install programs, prompts to change a system file. That's it. Lock up the windows folder and organize the OS better. Build your protocols differently so that changes CAN only be made from the control panel by the present user, instead of relying on a prompt that comes up every time that service is accesses by anybody.
That i have to confirm 3 times ( and frequently still be denied ) deleting a file is ridiculous. The OS should be smart enough to know that i initiated that command and not someone else, instead of me having to tell it over and over again.
Too many options.
UAC in its present form is indeed very annoying. I have several apps that require admin privileges and i'd like to be able to elevate them once, and have UAC remember that setting. I also disabled the secure desktop because it lags every time something is elevated; i prefer to simply click 'allow' once.
But even if stardock's- or somebody elses' - tweak app could allow you to adjust UAC to work better for you, it becomes just another setting in an endless sea of settings that require adjustment when you set up windows. Most of us don't mind going in to the registry or opening services to tweak something. But when my mother says "How can i make it stop?" and i start opening control panels and adjusting things for her, it hurts to see her eyes roll. It shouldn't have to be messed with.
I'm happy that windows allows for UAC to be tweaked at the service level by an expert. But it is unnecessary to have to be done. They should have just gotten it right. Prompts to install programs, prompts to change a system file. That's it. Lock up the windows folder and organize the OS better. Build your protocols differently so that changes CAN only be made from the control panel by the present user, instead of relying on a prompt that comes up every time that service is accesses by anybody.
That i have to confirm 3 times ( and frequently still be denied ) deleting a file is ridiculous. The OS should be smart enough to know that i initiated that command and not someone else, instead of me having to tell it over and over again.
Jan71
Reply #69 Thursday, February 22, 2007 5:48 PM
Reply #69 Thursday, February 22, 2007 5:48 PM
"Why the f*** does it have to prompt me when I go into display properties?"
I just checked it for you, it does not prompt me. Right clicked on the desktop, and went right in. No UAC bugging me. I double checked, yes I have UAC activated.
So I made a second, standard user to be sure. Only got prompted when I wanted to check if UAC was activated - while logged in as this new user- to enter my password. Which is expected, because I could deactivate UAC from here.
I really don't understand what the fuss is. I only get prompted when I want to change something, like installing a new program, change system settings and so on.
And for code not being compatible with Vista due to this ? I found out that if I run the program as Administrator, it does always what it is supposed to do, just the way it did under XP.
Now I can understand that a programmer has more problems with this concept, as he has to think how his code will be influenced by UAC. But a normal user that is working with his PC (going to the internet, write a letter, play a game, chat, ...) would not be bothered often.
I work with Linuw and Unix systems every day. This is just the same principle as root acces in Unix systems.
Jan
I just checked it for you, it does not prompt me. Right clicked on the desktop, and went right in. No UAC bugging me. I double checked, yes I have UAC activated.
So I made a second, standard user to be sure. Only got prompted when I wanted to check if UAC was activated - while logged in as this new user- to enter my password. Which is expected, because I could deactivate UAC from here.
I really don't understand what the fuss is. I only get prompted when I want to change something, like installing a new program, change system settings and so on.
And for code not being compatible with Vista due to this ? I found out that if I run the program as Administrator, it does always what it is supposed to do, just the way it did under XP.
Now I can understand that a programmer has more problems with this concept, as he has to think how his code will be influenced by UAC. But a normal user that is working with his PC (going to the internet, write a letter, play a game, chat, ...) would not be bothered often.
I work with Linuw and Unix systems every day. This is just the same principle as root acces in Unix systems.
Jan
JRSCCivic98
Reply #70 Thursday, February 22, 2007 5:55 PM
Go in and change the resolution. Or better yet, click on advanced in that screen and go to where you can create a system restore point. You will get a prompt.
Reply #70 Thursday, February 22, 2007 5:55 PM
I just checked it for you, it does not prompt me. Right clicked on the desktop, and went right in. No UAC bugging me. I double checked, yes I have UAC activated.
Go in and change the resolution. Or better yet, click on advanced in that screen and go to where you can create a system restore point. You will get a prompt.
MarkSnyder61
Reply #71 Thursday, February 22, 2007 7:22 PM
Reply #71 Thursday, February 22, 2007 7:22 PM
YES...the UAC is getting to annoy me and I may turn it off soon! 
AndreasV
Reply #72 Thursday, February 22, 2007 7:40 PM
Reply #72 Thursday, February 22, 2007 7:40 PM
"Right now, every time I open up Stardock Central, I'm prompted by UAC".
Then, fix your own software first! There should be no reason for an application that checks for updates to require admin rights. Only installing an update should require those rights.
Then, fix your own software first! There should be no reason for an application that checks for updates to require admin rights. Only installing an update should require those rights.
dogvetusa
Reply #73 Thursday, February 22, 2007 11:43 PM
Reply #73 Thursday, February 22, 2007 11:43 PM
if the UAC is as annoying as service pack 2 was with its informmation bar and outright refusal to allow for the remembering of certain things (dealing with website development), then I am quite glad I switched to the Apple.
Frogboy
Reply #74 Friday, February 23, 2007 12:30 AM
Reply #74 Friday, February 23, 2007 12:30 AM
"Right now, every time I open up Stardock Central, I'm prompted by UAC".
Then, fix your own software first! There should be no reason for an application that checks for updates to require admin rights. Only installing an update should require those rights.
Then, fix your own software first! There should be no reason for an application that checks for updates to require admin rights. Only installing an update should require those rights.
We agree. A program that simply does updates shouldn't get prompted. So how is this our fault?
JcRabbit
Reply #75 Friday, February 23, 2007 2:23 AM
Reply #75 Friday, February 23, 2007 2:23 AM
I found out that if I run the program as Administrator, it does always what it is supposed to do, just the way it did under XP.
Actually there are CRUCIAL differences. For instance: applications running at a higher privilege level (i.e.; as the Administrator) cannot accept files dragged & dropped from applications running at lower privilege levels. In fact, they ignore ALL messages sent to them by lower privilege applications.
For instance, if you decide to run ObjectDock as the Admin, then you will find yourself unable to drag files from Explorer and drop them into it because Explorer is running with a normal privilege level. If you don't run ObjectDock as the Admin, then, for instance, time synchronizing docklets (which run at the same privilege level as ObjectDock) will fail to set the system time, because - and that is ANOTHER example of the problem with the UAC - far too many things in Windows require Admin rights, like setting the system time.
You see, it makes sense, from a Corporation point of view, for things like setting the system time, changing display resolution, and LOTS and LOTS of other small things like that to require Admin privileges. For the Home user, however, it makes no sense at all!
Another problem is that there is no mechanism for applications to LOWER their privilege level (why the hell not? How would this break security?!). A real life example for this is application A that is launched from the installer (you know, when you install an application and the Setup program has a small checkbox that says 'Launch Application A' at the end): because the Setup program runs with a high privilege level, so will application A. Because application A cannot lower its privilege level, it will then be unable to, say, accept files dragged & dropped from Explorer. To the user, it will look like application A is broken. So what is the solution? Never to give the user the convenience to launch an application right after Setup? Blah!
And yet another problem: under Vista, applications running at normal privilege levels do not have write access to folders under c:\Program Files\, and this includes their own folder. Since a lot of applications save configuration data (INI files, for instance) in their own folder, this alone is going to be the source of many problems (Microsoft did come up with a mechanism to work around it, though, but it has its own problems). The solution is to start saving configuration files and the like in the My Documents or Application Data folders. But where to save themes and skins, then? If you save them to the 'My Documents' folder, the downloaded themes will then only be available to that user (since the My Documents folder is a per User folder), if you save them to 'Application Data', then the user will have a hard time navigating to this folder because it is hidden by default!
The problem with the UAC is not that it's a bad thing per se, just that the details and problems were not ironed out first in Microsoft's hurry to get Vista out the door. As it is, application developers have to go to great pains to change their applications to run properly on Vista, only to (probably) see all those efforts go to waste when Vista SP1 comes out and most of the problems get ironed out.
Actually there are CRUCIAL differences. For instance: applications running at a higher privilege level (i.e.; as the Administrator) cannot accept files dragged & dropped from applications running at lower privilege levels. In fact, they ignore ALL messages sent to them by lower privilege applications.
For instance, if you decide to run ObjectDock as the Admin, then you will find yourself unable to drag files from Explorer and drop them into it because Explorer is running with a normal privilege level. If you don't run ObjectDock as the Admin, then, for instance, time synchronizing docklets (which run at the same privilege level as ObjectDock) will fail to set the system time, because - and that is ANOTHER example of the problem with the UAC - far too many things in Windows require Admin rights, like setting the system time.
You see, it makes sense, from a Corporation point of view, for things like setting the system time, changing display resolution, and LOTS and LOTS of other small things like that to require Admin privileges. For the Home user, however, it makes no sense at all!
Another problem is that there is no mechanism for applications to LOWER their privilege level (why the hell not? How would this break security?!). A real life example for this is application A that is launched from the installer (you know, when you install an application and the Setup program has a small checkbox that says 'Launch Application A' at the end): because the Setup program runs with a high privilege level, so will application A. Because application A cannot lower its privilege level, it will then be unable to, say, accept files dragged & dropped from Explorer. To the user, it will look like application A is broken. So what is the solution? Never to give the user the convenience to launch an application right after Setup? Blah!
And yet another problem: under Vista, applications running at normal privilege levels do not have write access to folders under c:\Program Files\, and this includes their own folder. Since a lot of applications save configuration data (INI files, for instance) in their own folder, this alone is going to be the source of many problems (Microsoft did come up with a mechanism to work around it, though, but it has its own problems). The solution is to start saving configuration files and the like in the My Documents or Application Data folders. But where to save themes and skins, then? If you save them to the 'My Documents' folder, the downloaded themes will then only be available to that user (since the My Documents folder is a per User folder), if you save them to 'Application Data', then the user will have a hard time navigating to this folder because it is hidden by default!
The problem with the UAC is not that it's a bad thing per se, just that the details and problems were not ironed out first in Microsoft's hurry to get Vista out the door. As it is, application developers have to go to great pains to change their applications to run properly on Vista, only to (probably) see all those efforts go to waste when Vista SP1 comes out and most of the problems get ironed out.
JRSCCivic98
Reply #76 Friday, February 23, 2007 9:51 AM
Reply #76 Friday, February 23, 2007 9:51 AM
If you think that's bad check this problem out that I had. So I installed Synaptics's touchpad drivers for Vista on my test setup of Vista Ultimate. (Keep in mind that these drivers/touchpad app was written for Vista.) Well, on EVERY startup of Windows I get a prompt to allow syntpenh.exe to run. It's part of the driver that runs at startup in a registry entry under run. Anyway, I though it was a little anoying (It wasn't a UAC prompt, but rather one of those "This application comes from another computer and cannot be trusted) so I decided to take a look at the file properties. Sure enough, it was not MS Certified, but it did have the normal place in file properties at the bottom where you can "unlock" the file so that Windows will not think it's "unsafe and from the internet". So I made the change and restarted... got no errors when I made the change mind you. I restart and get the same prompt... I'm like WTF? So I check the file properties again and it's back to locked. I open explorer on that directory (Yep, it's in Program Files) and run Explorer as administrator this time thinking it may have been rights that wouldn't allow me to change the file properties (but then agian, I never got the permission denied error). So I change the file properties again and recheck them after changing them. It's changed... I reboot and the prompt comes back on. I check the file properties and it's back to blocked. That's about the time I decided to put my other drive back in with XP on it after emailing Synaptics about the problem.
Now excuse me while I go to Best Buy and yell at the idiots selling Vista Home Basic/Premium to business users that need to have access to a domain server (with full login support).
Now excuse me while I go to Best Buy and yell at the idiots selling Vista Home Basic/Premium to business users that need to have access to a domain server (with full login support).
AndreasV
Reply #77 Friday, February 23, 2007 2:49 PM
That's not what I said; A program doing updates SHOULD prompt. A program showing updates shouldn't.
Doing an update is something only admins are allowed to do, since it touches application files.
Showing updates (depending on if the regular user should be allowed to view them at all), should be something that could be done without requiring elevated rights.
In short, decouple the viewer from the updater; When a user selects an update to be installed, launch a seperate out-of-process thing, which in turn can be elevated.
Good security practice is to not want/get/give more rights than needed; only request more rights when needed and lose those elevated rights as soon as possible.
Reply #77 Friday, February 23, 2007 2:49 PM
We agree. A program that simply does updates shouldn't get prompted. So how is this our fault?
That's not what I said; A program doing updates SHOULD prompt. A program showing updates shouldn't.
Doing an update is something only admins are allowed to do, since it touches application files.
Showing updates (depending on if the regular user should be allowed to view them at all), should be something that could be done without requiring elevated rights.
In short, decouple the viewer from the updater; When a user selects an update to be installed, launch a seperate out-of-process thing, which in turn can be elevated.
Good security practice is to not want/get/give more rights than needed; only request more rights when needed and lose those elevated rights as soon as possible.
Randall30
Reply #78 Friday, February 23, 2007 5:39 PM
Reply #78 Friday, February 23, 2007 5:39 PM
What you are saying is make the UAC like Windows Firewall right? I think it is the dumbest thing ever invented.
People don't need UAC if the firewall and Windows spyware/malware tool is not good enough then screw it. UAC is total useless. Suppose to stop viruses but it really just pissed off people.
Microsoft UAC is just another thing to tick off users like downloading a WGA update every time you need to download software from Microsoft isn't enough!
People don't need UAC if the firewall and Windows spyware/malware tool is not good enough then screw it. UAC is total useless. Suppose to stop viruses but it really just pissed off people.
Microsoft UAC is just another thing to tick off users like downloading a WGA update every time you need to download software from Microsoft isn't enough!
Jafo
Reply #79 Friday, February 23, 2007 8:11 PM
Reply #79 Friday, February 23, 2007 8:11 PM
UAC is just microsoft's way of passing the responsibility for security on to the customer so they dont have to deal with it in the OS.
Exactly.
By inserting user responsibility for potentially damaging actions into the equation MS can be removed from total/sole culpability if/when something goes belly-up.
Think response...."You idiot...you disabled the inherent protection/advice?"
It's intended to REMIND the casual user that what he says 'yes' to is potentially damaging....and to self-educate.
"Power Users" may simply consider their expertise to not warrant such reminders....in which case, as with any OS modification tool there's absolutely no drama associated with their use....provided [again] suitable warnings pop up....the last UAC one being...."are you sure you want to modify/remove the functionality of this OS 'protection' tool?".
I see no problems there...
Re other comments here....Stardock has close connections with MS so any such 'tool' for Modding the OS would quite likely have in-house feedback and 'tacit' endorsement...
Yes, SD makes games but they also make programs with close integration with the MS OS so UAC modding would be a romp in the park....
JcRabbit
Reply #80 Friday, February 23, 2007 8:29 PM
THAT I have to agree with.
And, concerning the original topic, I really don't think Stardock should mess with the UAC - that is Microsoft's business. What I think Stardock should do, however, since it appears to have some 'weight' with Microsoft, is to pressure them into fixing, as fast as possible, all that is wrong with the current UAC implementation.
Reply #80 Friday, February 23, 2007 8:29 PM
That's not what I said; A program doing updates SHOULD prompt. A program showing updates shouldn't.
THAT I have to agree with.
And, concerning the original topic, I really don't think Stardock should mess with the UAC - that is Microsoft's business. What I think Stardock should do, however, since it appears to have some 'weight' with Microsoft, is to pressure them into fixing, as fast as possible, all that is wrong with the current UAC implementation.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 4 of 5 | |
|
|---|
Reply #61 Thursday, February 22, 2007 12:39 PM
Or at least make it remember stuff..
I dont mind the 1st time it asks, but even before getting to the UAC you have to hit ok 1-3 times (do you weant to install #1 ok, vistablabla has to get permission from the UAC agreed? #2 ok, and then the UAC itself.. #3 ok.) and a night of using my puter leaves me realy realy annoyed because of the constant holding my hand...
I friggin hate the uac