imhotep said:
Honestly, this will do nothing for the overall security of the system.
Relying on a non technical user to make technical decisions is a disaster
waiting to happen. Most people will act just like the Blue Pill author and
click "yes" to everything. Also, it seems that, still, out of the box
users
will default to being in the admin group. The only real protection from
trojans is a low security level for users: don;t give them the privs to
install it in the first place!
So how has security been enhanced/improved?
Having the idea "there" is meanless...
Imhotep
Surprised as I am to say this, I am pretty much entirely in agreement
with you on this. UAC, which reduces an account at login if it is an
admin is a step toward making sure users run as limited accounts.
However, right now it is all too easy for that user to exert their elevated
privs, and they will.
The solution is as you indicate, in holding tightly any ability to exercise
elevated privileges. I wish OSs had grown up to actually, effectively use
all four rings in the initial Intel concepts, for that matter.
I think where you and I differ however is that you seem to believe that
MS could just make it different. This is just not so from a couple of
directions.
I ask first, if Red Hat had the same mix of "owners", or "users" or
whatever you want to call the large number of casual computer users
that only (I should cap that) users that ONLY want to use the machine
for browsing, media, email, cool stuff and that want to never (actually,
NEVER) have to get "bit dirty" (as in taking responsibility to config,
to patch, etc.) how would things pan out?
The other perspective you seem to lack is that MS (well, one cannot
generalize like that, so to be clear, in this case MS means as significant
faction in the Windows dev group) has long wanted to have a nice,
sane, clear distinction between user and admin. I can recall some
discussions in that direction in NT 4 beta associated with the change
in the Executive/Kernel boundary where we were saying if you can
really pull that off safely then surely restructuring storage so that we
can lock down, at the large grain folder level, the system binaries to
only read/exec for users, etc. etc. We did get a little motion that
direction, but . . . it was not until later, in the NT5 beta (prior to the
July 1999 rename to Windows 2000) where we were again pressing,
"hey, we just want a /usr, a /bin, etc. so we can fully compartmentalize,
etc." (and finding a lot of support/agreement) when it became clear to
me how it was not what they (same MS) wanted but what they could
do given the ecosystem (legacy, dependent third-party software firms,
legalities) that governed how far things could be moved in that direction.
XP moved the bar a little more, nudged the software industry a little
further, and so will Vista. The plain fact is that if MS were to, back
then or even now, enforce changes that many of us would like they
would probably be revisited by DoJ and the Euro commission.
Virtualization of storage and registry is an effort to assist in tightening
things without breaking lame applications or being seen as forcing those
vendors to invest in reversioning their products immediately. One sad
side-effect is that it will probably just lengthen the time before we stop
seeing so much lame software being written/marketed.
OK. Now I am not attempting to "spin". I am attempting to see if you
can appreciate the who behind the MS you often chastize, and that they
(similar comment about generalization) would in fact like to be able to
find a way out from being between the rock and the hard place, so to
speak. They have a legacy rooted in DOS built without any concept of
a network, or later, at least one that went outside of the room. They have
industries that rely on the platform for there very existence, and Windows
design changes can impact the cost of versioning for lots of companies.
Some of those software companies have barely moved in their skillset or
architecture from what they had when their world was DOS and Win 3.1.
They have a huge base of "average Joe/Jane" people, who do not want
to, and should not need to, become IT admins in order to take part in this
information age. They have people like you and I coming at them from
varied angles saying "do the right thing". And then they have a huge wealth
of skill, brain-trust, ideas of what can be done with pervasive
computational
devices pressing for large amounts of rather sophisticated support code in
and/or on the platform
So, I end by just asking you, would you like to be in that decision spot?
--
ra
(PS. May I remind you not to come back at me with diatribe about IE
or other crapware from which the majority of Windows related ills have
their origin. My discussion was about Windows, not Office, not IE, not
OE, etc.)
