One of the most discussed features of Windows Vista is the User Account Control (UAC) feature. The UAC pops up whenever something is attempting to make use of something that is in the domain of the administrator.
Many users have complained that the UAC is the "dialog that cries wolf" in that it comes up so often that users end up either ignoring it or turning it off -- both of which nullify the purpose of the UAC.
ZDNet's Mary Jo Foley argues that UAC needs an overhaul and talks about some of the discussions that are on the way.
Will Microsoft extend UAC to be more flexible and usable by users? Should it be left to a Symantec to solve or should Stardock (whom I work for) extend it to support more options?
What's your view on the Windows Vista UAC?
View: Vista's UAC needs an overhaul
Many users have complained that the UAC is the "dialog that cries wolf" in that it comes up so often that users end up either ignoring it or turning it off -- both of which nullify the purpose of the UAC.
ZDNet's Mary Jo Foley argues that UAC needs an overhaul and talks about some of the discussions that are on the way.
Will Microsoft extend UAC to be more flexible and usable by users? Should it be left to a Symantec to solve or should Stardock (whom I work for) extend it to support more options?
What's your view on the Windows Vista UAC?
View: Vista's UAC needs an overhaul
Well that's just stupid. It's those who know what they're doing who gain the most benefit from UAC. It's ignorant fools who turn it off.
Well that's just stupid. It's those who know what they're doing who gain the most benefit from UAC. It's ignorant fools who turn it off.
I was about to say the same thing...
Never got a virus in my machine for more than an hour in the last 4 years.
On the last 4 years all i had was 3 of them.
UAC is annoying for anyone who develops hardware-based systems.
Ignorance is needing an idiot window asking for authorization everytime i need to make a sys change.
I work fixing machines, i do know what i am doing, i don't want windows to spend my time with dozens of windows everytime i try to compile and test something i am developing that changes the sys.
Ignorant fool is who needs a machine to think for him.
Never got a virus in my machine for more than an hour in the last 4 years.
On the last 4 years all i had was 3 of them.
UAC is annoying for anyone who develops hardware-based systems.
Ignorance is needing an idiot window asking for authorization everytime i need to make a sys change.
I work fixing machines, i do know what i am doing, i don't want windows to spend my time with dozens of windows everytime i try to compile and test something i am developing that changes the sys.
None of that makes any sense. I'm a developer, and UAC hasn't bothered me in the slightest. I very rarely see UAC prompts, and I love the added control it gives me over my applications.
You clearly don't understand UAC or privilege isolation, which is unfortunate because you're needlessly putting yourself at greater risk.
That sentence means absolutely nothing. I'd love to hear you try and explain what you meant by it, though.
Never got a virus in my machine for more than an hour in the last 4 years.
On the last 4 years all i had was 3 of them.
If you've never used an anti-virus, how come you know that you've "had three of them" and they lased "less than an hour"?
Never got a virus in my machine for more than an hour in the last 4 years.
On the last 4 years all i had was 3 of them.
If you've never used an anti-virus, how come you know that you've "had three of them" and they lased "less than an hour"?
He doesn't know, he just wants to look cool and geeky. People who usually answer like "I fix machines" "I never use AV and haven't been hit by a virus" do it because they think it makes them look more knowledgeable than they really are.
No 3rd parties should be allowed to touch UAC. What do a bunch of skinning engine developers know about PC security anyway?
UAC is not broken as the title misleadingly states.
Second, if you read the article that zdnet linked to over on wc, you would see that what Stardock suggested would be for uac to remember programs that had been given permission. who better to to implement something as straight forward as that as the people who extend the OS already. You should try out Stardock's other programs before dismissing them as a bunch of "skinning engine developers".
Second, if you read the article that zdnet linked to over on wc, you would see that what Stardock suggested would be for uac to remember programs that had been given permission. who better to to implement something as straight forward as that as the people who extend the OS already. You should try out Stardock's other programs before dismissing them as a bunch of "skinning engine developers".
It takes about 5 seconds to find a giant hole with the "stardock" solution. If you "permit" application x to always run after consenting to it, then when some malware down the line tries to run application x and exploit it, you just lost control of your computer and didn't have a way to know about it.
UAC is designed to alert you that something is requesting permissions that permit an attacker to compromise your system. If you weren't expecting anything to require escallated privleges, you can head it off at the pass, so to speak. Software, unfortunately, isn't "smart" enough to determine the intent of code so it has to depend on something that is (ie: the user) to make an intelligent decision.
I think the main problem with UAC is that after so many years of not having that function in the earlier Windows versions, most people have learned by the school of hard knocks so to speak. I learned the hard way several times when I would install something that wasn't safe unknowingly. It was a hard lesson, but I learned by experience what was good and what isn't as well as what is done on the system by the end user. Now, I simply know what to do and not and thus far my system has been safe.
For the inexperienced user of Windows, it is a great tool to help prevent your system from being hijacked. However, in my wife's case, it would totally throw her off and eventually make her mad each and every time it would come up. She is your average PC user which is unaware of the malicious technologies out there which can harm the pc. In my support calls I do for my business and have done in the past, it is usually the user who gets in trouble with malware unintentionally which makes things run terrible on their system.
I support Microsoft's strategy for using that feature in Vista and their decision to give the user the option to turn it off.
I thought the UAC annoyances where pretty much just about stuff like exe installers, ie inherited problems, not design issues.
The linux counterpart isn't really less intrusive, it's just that pretty much every linux app only installs for one user, and it allways instalsl in your folders sicne you won't even be able to install to system folders unless you dop a sudo on the install.
The only problem with UAC is 3Rd party developers who have never developed windows apps that doesn't put files in non user dirs, thishas been entirely possibly with pretty much all apps since XP and 2k. UAC is here partly for two reasons, one being to make content developers start to develop windows apps properly.
They are, unless they're in the "Common Start Menu" which is shared by all user accounts. Those are the ones you have to elevate to delete (although it's very easy to change that). Interestingly, the Common Desktop was changed in the RTM version to have delete permissions for all admin accounts without elevating.
I thought the UAC annoyances where pretty much just about stuff like exe installers, ie inherited problems, not design issues.
Why does UAC pop up a box when you're running as admin and have clicked on a program that requires admin privileges? I already know it needs admin privileges, that's why I'm using the admin account dammit to save myself typing in passwords all the time. Now I just waste time having to confirm what I already did (just like having to click on an embedded object in IE to interact with it. Oh, but now I get to click it AGAIN to do what I wanted because of "the user has to activate it" crap. Either that, or the developer has to jump through hoops and use JavaScript in an external file so it "auto-activates" for one crap browser.)
They are, unless they're in the "Common Start Menu" which is shared by all user accounts. Those are the ones you have to elevate to delete (although it's very easy to change that). Interestingly, the Common Desktop was changed in the RTM version to have delete permissions for all admin accounts without elevating.
But what's the point of that kind of stuff being common in a multiuser environment?
i don't know how to work around that so it is off ATM...
i use a batch file on a share drive to install Steam. if I just execute the batch file, nothing gets installed. if i use Run as administrator, it says batch file not found.
The problem is, most users are too stupid to use their own computers. There's a trade off here between security and usability, but it had to be done in my opinion. Besides, now you can install software on a limited account with the admin password - a much easier feature for administrating computers at home.
UAC has nothing to do with not trusting users. UAC will have the greatest benefit for smarter users (who understand what it's actually doing).
UAC is about not trusting applications like Outlook or Firefox to be 100% secure, which no application is. That's why UAC lets you isolate them, limiting the damage they can do if they're compromised by an attacker.
I bet that you're into S&M as well.
You have never spent much time in Vista have you? Vista's UAC is actually easier - admin accounts can elevate without having to type a username or password (as you would with "sudo" in Linux, or on the Mac).
The operations that require elevation are 99% the same between these OSes... basically anything that can affect other user accounts on the system.
You have never spent much time in Vista have you? Vista's UAC is actually easier - admin accounts can elevate without having to type a username or password (as you would with "sudo" in Linux, or on the Mac).
The operations that require elevation are 99% the same between these OSes... basically anything that can affect other user accounts on the system.
Now that's funny
Admin accounts don't have to sudo on linux to perform admin tasks, that's the whole point of being admin.
Last edited by ichi on 22 Feb 2007 - 20:57
No OS is as user friendly as it could be
Linux might not be Foub-friendly, but it's definitely ichi-friendly, and as you can surely understand that's all I care about.
I read that from eweek magazine editorial. it true we need to change our habits.
I have several programs (graphical designs packages) that as part of their routines goes out and checks to see if any updates and/or patches are available. Now, under Windows XP this is not a problem, it goes out, checks the server, if there's an update the program asks if I want to install, downloads and installs without an issue. Under Windows Vista, however, the behavior is a mess. It still asks if you want to download, it will download the update, but then it will just stop trying to update at all. The reason is that Vista *requires* you to run as Administrator in order to install software, if you have the UAC active.
You can do some things, you can turn off UAC but that defeats the purpose of UAC. You can right click on the icon and Run as Administrator each time, but that is annoying. Or you can go to the icon properties and click 'Always run as Administrator' but that opens a potential hole to allow something nasty into the system. Nowhere in here was an option provided that allows a user to load and run programs and allow the programs to behave as they were designed while providing a measure of security for the user. Gamers in particular will be seeing this when updates to their MMORPG programs begin failing to install, and the reason why is that Vista won't allow you to install the software in that fashion any longer.
The idea behind UAC may have been well intentioned. It's the implementation of it that has raised hackles far and wide.
I have several programs (graphical designs packages) that as part of their routines goes out and checks to see if any updates and/or patches are available. Now, under Windows XP this is not a problem, it goes out, checks the server, if there's an update the program asks if I want to install, downloads and installs without an issue. Under Windows Vista, however, the behavior is a mess. It still asks if you want to download, it will download the update, but then it will just stop trying to update at all. The reason is that Vista *requires* you to run as Administrator in order to install software, if you have the UAC active.
You can do some things, you can turn off UAC but that defeats the purpose of UAC. You can right click on the icon and Run as Administrator each time, but that is annoying. Or you can go to the icon properties and click 'Always run as Administrator' but that opens a potential hole to allow something nasty into the system. Nowhere in here was an option provided that allows a user to load and run programs and allow the programs to behave as they were designed while providing a measure of security for the user. Gamers in particular will be seeing this when updates to their MMORPG programs begin failing to install, and the reason why is that Vista won't allow you to install the software in that fashion any longer.
The idea behind UAC may have been well intentioned. It's the implementation of it that has raised hackles far and wide.
I concur with the statement. I've got to "allow" Neverwinter Nights 2 permission to check for updates every time I launch the update function.
Another application I have asks for a serial number to be entered. Since it stores the serial number in the registry, I get an error when attempting to register the application if it isn't launch "as an administrator". UAC doesn't even pop up in that case. The app just throws an error.
The idea is a good one, but the implementation is a bit... overzealous in its behavior.
or the fact that you installed said programs/games in non default folders, and you haven't given yourself ownership/full permission to those folders. If you for example have games or apps folders on other disks, you will need fullpermissions to these, or UAC will ask about everything you do there.
Is it the fault of the programmers? Or the fault of Microsoft who required those programmers to use those system directories and files for their applications? Remember that many of the requirements for where programs needed to be installed were dictated by Microsoft and the fact that DLLs had to be placed in certain folders in order to work correctly.
>> or the fact that you installed said programs/games in non default folders, and you haven't given yourself ownership/full permission to those folders. If you for example have games or apps folders on other disks, you will need fullpermissions to these, or UAC will ask about everything you do there. <<
No, these programs are being installed in the default directories, which again was more of a Microsoft-directed requirement. Despite the fact that they are installed in Program Files, you still don't have full access over them because of the way that Microsoft has implemented the security model in Vista. It's more of a 'yes, we know you're an admin, but we're not going to let you install unless you're ADMIN' sort of function, and that's what makes it difficult, if not impossible to deal with. The concept that programs need to have access to networks and pull down updates is extremely restrictive under Vista, except for Microsoft products (which are installed in the same directories and do not display the same restrictions as third-party applications.)
For example, Quake 3 Arena's punkbuster implementation MUST have admin access to check the validity of drivers, possible hacks, etc. I tried to run as admin from the shortcut and it wouldn't work.
I turned off UAC and it worked fine...for a while.
The other day, Punkbuster started generating OS exception errors, even though nothing had changed with them, Quake, or on the system. I went to turn off Run as Admin, just in case, but it was ghosted/grayed out - after all, I'm supposed to be running EVERYTHING as admin with UAC off under an administrator account, right? Apparently not.
So I had to turn UAC on and set the run as admin flag in the program icon. Now it all worked great.
EXCEPT another program I had, ObjectDock Plus from Stardock. All of a sudden, with UAC on, the sysstats docklets can't read the system stats like network transfer speed and CPU usage and one of the autohiding docks won't unhide anymore, hehe.
Soooooooooooo, I turned UAC back off, and now ObjectDock Plus works fine, as does Quake 3 - though now the Run as Admin checkbox is checked AND grayed out (instead of unchecked and grayed out) - haha.
So when is running as an Administrator NOT running as an Administrator? Under Vista.
The implementation is flawed in some ways that are going to frustrate end users to, well, no end.
UAC for administrators gives them the same permission set as limited users. The difference seems to be they don't need a password then allowing system wide changes like limited users do.
http://en.wikipedia.org/wiki/Union_Aerospace_Corporation
Is it really time to overhaul an already compromised security solution because your favorite old app hickups on it? Really?
The smart thing is to ignore the third party vendors and customizers, not UAC.
STFU, UAC.
"Those who do not understand Unix will reinvent it, poorly." <--has never been more appropriate.
"Those who do not understand Unix will reinvent it, poorly." <--has never been more appropriate.
Try using something later than Beta2.
Are you suggesting MS isn't trying to get closer to the UNIX model with Vista?
(P.s. Love the Mac commercial where the PC Guy is asked by man in black (UAC) to confirm every action and thought he has. I LOL.)
Just like those firewall prompts you hate so much. Just turn off the prompts or your firewall if you hate it that much but don't blame the software for doing what its supposed to be doing.
"the only way to make it work was to allow everything" is the whole point behind UAC. It allows you to run "everything" without havng to use an administrative account.
You can choose to have your firewall/UAC/whatever turned on for your protection and face those dreaded prompts or you can turn them all off and not have the prompts. It's up to you. But blaming the software for doing its job just demonstrates your limited understanding.
You don't need admin to do everyday things like browsing, playing media, office work, etc.
For example, the O.S. should know that you intentionally run a setup app, or something like that, and so it shouldn't ask if you really want to do that. It should be watching for programs not run by the user.
Of course, then there's the old hacker trickery problem, convincing users to run applications they really shouldn't, but maybe the O.S. should be able to detect something like this?
Just a thought or two.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.