6 ms·

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer running as admin by default.

toyg 11y ago
And judging by the pageviews on my blogpost on how to disable it, users didn't really like it very much...
- Rafert 11y ago
  Which was caused in part by badly behaving programs (writing user data to the Program Files directory) that triggered the UAC prompt, if I'm not mistaken.
  - TeMPOraL 11y ago
    They improved the system in the next release, and since Win7 UAC generally works perfectly even with the "badly behaving" software. Sensitive directories are now mirrored elsewhere in the filesystem, so that when your program wants to read from, say, Program Files directly, what it really reads is C:/Users/[username]/AppData/Local/VirtualStore/...
    - cmdrfred 11y ago
      I've never experienced this in writing my own software. If I try to read or write to a directory I'm not allow to I simply get access denied. f = open('C:/windows/test.txt') try: f.write('test') except Exception as ex: print ex IOError: [Errno 13] Permission denied: 'C:/windows'
      - TeMPOraL 11y ago
        Try the same with C:/test.txt. Open Explorer and see if the file actually appears in C:/.
    - pjmlp 11y ago
      That was already in Vista, if I remember correctly.
    - toyg 11y ago
      So that's what the policy "Virtualize file and registry write failures to per-user locations" does... uh, good to know :) thanks! In my particular legacy-apps' field, I believe most problems are due to interactions with the DCOM subsystem though.
      - TeMPOraL 11y ago
        Yeah, I only learned about it after I discovered what "~" is being resolved to in my Emacs installation on Windows...
rstupek 11y ago
I'm sure they didn't like it because security is, while necessary, a pita
hackuser 11y ago
> UAC was one of the biggest security improvements I assumed it was just an interface stapled onto the old system, and something underneath that allowed changing permissions without logging off. It might have had a big effect, but it doesn't sound like a significant change in the system. But maybe my assumptions are wrong ...
- alricb 11y ago
  In XP, you could always change permission without logging off, by using the runas command or Run as... in the context menu. I think you could also set shortcuts to run programs as Administrator. So you could run as a non privileged users, and you'd only need to log in as Administrator for some very specific tasks. However, there were many applications that didn't play nice with that model and required you to run as Administrator. By changing the default, MS had to do a big push to make software makers abide by the rules (which had been in place since XP (edit: in the mainstream branch) but were often ignored)
  - gpvos 11y ago
    You could do that under XP, but needed a separate user account for administrator. It was also more of a hassle, as you always had to enter the password when starting a program as Administrator. I ran with such a setup on my desktop, and remember that to install programs I usually logged out and logged in as Administrator again. Vista introduced a model that was almost as good, but made it more user-friendly and the default.
- quanticle 11y ago
  The entire concept of UAC and programs not running by default was introduced in Vista. It was such a big change that it pretty much ruined the reputation of the OS, single-handedly. I remember that one of the major complaints about Vista was the number and intrusiveness of UAC prompts, which occurred because programs were doing things like keeping settings in C:\Program Files, rather than the user's application data folder. Windows 7 has the same permissions model as Vista, but has a much better reputation, because by the time 7 was released, applications had been updated to not require as much in the way of permissions. From the users perspective, this meant that 7 "worked properly", even though little had changed in terms of the security model between Vista and 7.
amatwl 11y ago
UAC is not a security feature/ boundary (even according to MSFT themselves). It was aimed to help stop ISVs from writing software assuming admin privileges. Vista had A LOT of security improvements overall, but UAC shouldn't be considered as one of them (similar to PatchGuard for x64 Windows - it's cited as sometimes a security feature, but it's not).

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer running as admin by default.

toyg 11y ago

And judging by the pageviews on my blogpost on how to disable it, users didn't really like it very much...

Rafert 11y ago
Which was caused in part by badly behaving programs (writing user data to the Program Files directory) that triggered the UAC prompt, if I'm not mistaken.
- TeMPOraL 11y ago
  They improved the system in the next release, and since Win7 UAC generally works perfectly even with the "badly behaving" software. Sensitive directories are now mirrored elsewhere in the filesystem, so that when your program wants to read from, say, Program Files directly, what it really reads is C:/Users/[username]/AppData/Local/VirtualStore/...
  - cmdrfred 11y ago
    I've never experienced this in writing my own software. If I try to read or write to a directory I'm not allow to I simply get access denied. f = open('C:/windows/test.txt') try: f.write('test') except Exception as ex: print ex IOError: [Errno 13] Permission denied: 'C:/windows'
    - TeMPOraL 11y ago
      Try the same with C:/test.txt. Open Explorer and see if the file actually appears in C:/.
  - pjmlp 11y ago
    That was already in Vista, if I remember correctly.
  - toyg 11y ago
    So that's what the policy "Virtualize file and registry write failures to per-user locations" does... uh, good to know :) thanks! In my particular legacy-apps' field, I believe most problems are due to interactions with the DCOM subsystem though.
    - TeMPOraL 11y ago
      Yeah, I only learned about it after I discovered what "~" is being resolved to in my Emacs installation on Windows...

rstupek 11y ago

I'm sure they didn't like it because security is, while necessary, a pita

hackuser 11y ago

> UAC was one of the biggest security improvements I assumed it was just an interface stapled onto the old system, and something underneath that allowed changing permissions without logging off. It might have had a big effect, but it doesn't sound like a significant change in the system. But maybe my assumptions are wrong ...

alricb 11y ago
In XP, you could always change permission without logging off, by using the runas command or Run as... in the context menu. I think you could also set shortcuts to run programs as Administrator. So you could run as a non privileged users, and you'd only need to log in as Administrator for some very specific tasks. However, there were many applications that didn't play nice with that model and required you to run as Administrator. By changing the default, MS had to do a big push to make software makers abide by the rules (which had been in place since XP (edit: in the mainstream branch) but were often ignored)
- gpvos 11y ago
  You could do that under XP, but needed a separate user account for administrator. It was also more of a hassle, as you always had to enter the password when starting a program as Administrator. I ran with such a setup on my desktop, and remember that to install programs I usually logged out and logged in as Administrator again. Vista introduced a model that was almost as good, but made it more user-friendly and the default.
quanticle 11y ago
The entire concept of UAC and programs not running by default was introduced in Vista. It was such a big change that it pretty much ruined the reputation of the OS, single-handedly. I remember that one of the major complaints about Vista was the number and intrusiveness of UAC prompts, which occurred because programs were doing things like keeping settings in C:\Program Files, rather than the user's application data folder. Windows 7 has the same permissions model as Vista, but has a much better reputation, because by the time 7 was released, applications had been updated to not require as much in the way of permissions. From the users perspective, this meant that 7 "worked properly", even though little had changed in terms of the security model between Vista and 7.

amatwl 11y ago

UAC is not a security feature/ boundary (even according to MSFT themselves). It was aimed to help stop ISVs from writing software assuming admin privileges. Vista had A LOT of security improvements overall, but UAC shouldn't be considered as one of them (similar to PatchGuard for x64 Windows - it's cited as sometimes a security feature, but it's not).