8 ms·

Support for better symlink handling in Windows 10

133 points by hashhar 10y ago

0xCMP 10y ago
MS is doing good in my book. They should keep it up. Eventually people will start giving them a chance again.
- DoofusOfDeath 10y ago
  The problem is that MS has such an amazing record of strategic underhandedness, it would take many years of consistently good behavior for me to trust their intentions. By the way, exactly _which_ of their patents do they claim Linux violates, and exactly what data are they collecting from Windows 10 boxes?
  - 0xCMP 10y ago
    Yep very true. I'm a little dogmatic about too. I haven't even installed VS Code even though I know it's supposed to be pretty good. Burned too hard plus looking at what they did to others before me makes a pattern that is hard to ignore.
    - bitcrazed 10y ago
      To be fair, VSCode is open source so you could go look if you were interested: https://github.com/Microsoft/vscode https://github.com/Microsoft/vscode
- oxide 10y ago
  It's always one step forward, two steps back with Microsoft. Every time I start to warm up to them again, they make me feel stupid shortly afterwards by blowing it. It's an abusive relationship, in a sense.
  - 0xCMP 10y ago
    We all have our stories. MS has done a number on me.
- daveguy 10y ago
  I think they are less doing good and more scared shitless that they put off a huge swath of computer savvy users with their forced upgrades and mandatory tracking. The nuggets they throw to the dev/unix communities are smoke and mirrors. Strategic pleas of "please don't abandon our creaky ship!"
atishay811 10y ago
Finally. This was strange to request admin privileges. I wish they find a solution around the path length issues as well.
- vmarsy 10y ago
  Is this solution not fitting your needs ? https://mspoweruser.com/ntfs-260-character-windows-10/ https://mspoweruser.com/ntfs-260-character-windows-10/
  - xorblurb 10y ago
    I tried that in the AU: let's just say this is better than nothing. Well. Hm. Well, actually I'm not even sure about that; First not only programs must opt-in (through a manifest) -- and that is quite natural given the way some existing Win32 functions are modified, but that won't be taken into effect unless the computer is also opt'ed in. That second condition both makes little sense, and is improperly documented (the doc tells us: a manifested app or the GPO option; while in reality this is: AND) Then a single example so that you can understand the new "quality" of what MS is shipping: SetCurrentDirectory() https://msdn.microsoft.com/en-us/library/windows/desktop/aa365530(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3... Once you've manifested your program correctly (mainly by extracting what is interesting from powershell.exe, like usual because MSDN is shitty and does not describe the procedure to create the manifest with enough details) and configured your install with the good GPO (home edition users: go to hell) you happily starts to try the good old SetCurrentDirectory without the 260 chars limit. It fails. 2 hours latter you understand that it fails because the MAX_PATH LIMIT IS STILL THERE IF lpPathName DOES NOT END WITH A BACKSLASH ‘ß‘¬ð’€¬ð€þ¬ð€ You then take a look at CreateProcess and understand that there is just no way to bypass the MAX_PATH limit with it on some of its params. So you stop trying to use that half-backed and poorly documented "feature". The MAX_PATH (=260) limit in Windows is not gone. Maybe it's 5% gone, but that insufficient as hell.
    - poizan42 10y ago
      You don't need GPO though ( https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3... ): > A registry key allows you to enable or disable the new long path behavior. To enable long path behavior set the registry key at HKLM\SYSTEM\CurrentControlSet\Control\FileSystem LongPathsEnabled (Type: REG_DWORD).
_lce0 10y ago
How far till windows ships with a whole linux's kernel down there?
- dom0 10y ago
  The NT kernel was always heavily modelled after the unices of the time (but avoided quite some flaws from the get-go, and of course had quite a lot of differences as well due to that and other necessities, like the driver API).
  - criddell 10y ago
    I thought it was more DEC-ish (VMS?).
    - serge2k 10y ago
      It is, Cutler famously hated Unix.
      - deleted 10y ago
        [deleted]
- besselheim 10y ago
  They already emulate a Linux kernel, in recent Windows 10 releases: https://msdn.microsoft.com/commandline/wsl/about https://msdn.microsoft.com/commandline/wsl/about
- dmitrygr 10y ago
  Considering that NT kernel is a much better design, I'd rather get Linux Mint (with UI) on top of NT.
  - fermuch 10y ago
    Could you provide some link to read about this? First time I've heard about it.
sundvor 10y ago
This is great; I love how Microsoft have become so responsive to community demands and wishes. Personally, I've used mklink /d for quite some time, in particular to manage game installs. This became necessary once they started hitting the 30-50GB mark; suddenly those 500GB SSDs / NVMEs didn't feel so big anymore! (Not that I have much if any time to play anymore..)
- criddell 10y ago
  Do you know why you have to do it as Administrator? It seems like mklink shouldn't need special privileges.
  - Dylan16807 10y ago
    The worry was Time Of Check To Time Of Use attacks, but I guess they've decided the balance has changed. Also you've always been able to make junction points without admin.
    - kodfodrasz 10y ago
      Unfortunately I cannot find the link now, but recently I have found a funny article related to these vulnurabilities: If you set up VPN on Windows 10 Mobile for some reason MS has decided to remove the option to resolve DNS at the far end of the VPN. (AFAIK this was present on WP 8.1) I have found a guide how to enable it: Create a symlink on an NTFS sd card pointing to a specific location (an ini file which is hidden in Windows 10 Mobile from you), insert the card, open the file in file browser with an editor, and change a setting.
- toyg 10y ago
  Mklink is also the recommended (safest and easiest) way to deploy JVM patch-releases in a lot of settings.
  - sundvor 10y ago
    Interesting; will read up on that, sounds like something that could be useful elsewhere also. Just got a new preconfigured laptop which was almost full on system. Small 120gb SSD, but had a 1TB spinner. Found that there was 30GB worth of MSSQL DBs, so being lazy I simply moved the files to D and symlinked the directory. The only gotcha was making sure MSSQL had permissions to the new target folder.
OliverJones 10y ago
ln -s a generation ... goes by ... and we get mklink but still no hard links and no use-counted file system. Haven't the Bell Labs patents expired by now?
- compsciphd 10y ago
  huh? https://msdn.microsoft.com/en-us/library/windows/desktop/aa365006(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...
  - kodfodrasz 10y ago
    isn't this documentation a bit dated? AFAIK as of Win10 hard and soft links exist, and also junctions, which are a third, similar but different concept.
    - ygra 10y ago
      Isn't that exactly what the documentation says? I mentions directory junctions, hard links and symlinks. Mind you, hard links and directory junctions have existed for quite a while (going back at least to Windows 2000). Symlinks have been added in Vista.
      - jaclaz 10y ago
        Not really, they were added to NTFS in XP times, see my previous post. https://news.ycombinator.com/item?id=13095172 https://news.ycombinator.com/item?id=13095172
- serge2k 10y ago
  windows has hard links.
- riffic 10y ago
  "Those who do not understand Unix are condemned to reinvent it, poorly."
vic-traill 10y ago
> Now in Windows 10 Creators Update, a user (with admin rights) can first enable Developer Mode, and then any user on the machine can run the mklink command without elevating a command-line console. So an Administrator-equiv account still needs to be in the chain of events to make this useful on a per machine basis? If this is the case I'm not sure how this makes symbolic links more useful to me in a Windows environment... ? By default access to remote (network) symbolic links is disabled . You can enable it with fsutil [0]. Between the need for admin-equiv for mklink and the per-computer requirement to fsutil-enable sym links on network shares, symbolic links are unusable in a Windows environment. I don't see how this feature changes that. [0]https://blogs.msdn.microsoft.com/junfeng/2012/05/07/the-symbolic-link-cannot-be-followed-because-its-type-is-disabled/ https://blogs.msdn.microsoft.com/junfeng/2012/05/07/the-symb... [edit: fixed typo on 'fsutil', 'sym' and 'symbolic links'. The curse of posting on a mobile device]
- aarongolliver 10y ago
  If you're provisioning lots of Windows machines, why not just make these two commands part of that process?
  - sixbrx 10y ago
    For me the issue is more that software like version control systems and archiver utitlities that need to understand and create symlinks, might just continue to not support symlinks on Windows. When the software is running as an unprivileged user, it will still fail be able to create symlinks by default, which doesn't make the feature very enticing to add and support for the developers of the software. Git has been in that category, I don't know if this is enough to trigger a change or not. Here's hoping...
  - vic-traill 10y ago
    I'll take some a kick at provisioning this via GPO on Monday. I suppose the issue at hand here is that - at minimum - it appears that use of symbolic links requires a Group Policy that specifies both support for mklink and fsutil to be configured, the former requiring admin-equivilency to enable symbolic links to work for a non-admin user. As someone who grew up using 'ln -s' in userspace to create symbolic links, this seems to be a rather high barrier to use of a very convenient user function - "Want to use symbolic links for convenience? Have your admin create GPOS to facilitate this" seems a half-assed answer....
nmstoker 10y ago
Sounds positive, but the article skirts over whether there are any downsides. Surely there must be lots of ways this could get abused? (presumably that's why it sits behind Developer mode rather than being default)
- SwellJoe 10y ago
  Symlink vulnerabilities are pretty well understood. Though, people still make mistakes now and then. Simple answer about one of the most common/dangerous: A symlink could be made to point to a system file. If a program running with elevated privileges could then be convinced to manipulate the contents of the file pointed to by the symlink, whoever could use that program on the symlink could cause it to modify the system file. There have been real world vulnerabilities like this (I've shipped a few), but they're not super common and they're often limited in their capability to cause damage...they require an elevated privilege app, that is poorly written, that has untrusted users that can poke at it. It probably requires some kind of shell access, or some sort of local account (email account, maybe), in addition to the poorly written program that has elevated privileges. https://www.exploit-db.com/papers/13199/ https://www.exploit-db.com/papers/13199/
  - JoshTriplett 10y ago
    There's an easy fix for that: allow unprivileged applications to create symbolic links, but by default, only allow applications to access/follow symbolic links owned by 1) the same user that owns the target file, 2) the user the current process runs as, or 3) an administrator. Since people currently can't usefully use symlinks at all except as an adminstrator, that should not introduce any compatibility issues. Linux has a similar protection mechanism (/proc/sys/fs/protected_symlinks), though it only applies to sticky world-writable directories like /tmp.
to3m 10y ago
Regarding the "interest over time" graph, it's fantastic to see people designing graphs that are just as meaningful for the colour-blind as they are for those of us with normal colour vision.
- SaulOfTheJungle 10y ago
  I noticed that too — without a legend, who am I supposed to decipher what each color means?
- rezxv 10y ago
  Because it's a direct screen capture from Google Trends, and for me, it's pretty clear which are they: CVS, SVN, Hg, Git. Here, I've re-created it for you: https://www.google.com/trends/explore?date=all&q=%2Fm%2F05vqwg,%2Fm%2F012ct9,%2Fm%2F08441_,%2Fm%2F09d6g https://www.google.com/trends/explore?date=all&q=%2Fm%2F05vq...
- kodfodrasz 10y ago
  Luckily there was a link to the google page where the picture was taken, where you can examine the graph more in detail. https://www.google.com/trends/explore?date=all&q=%2Fm%2F05vqwg,%2Fm%2F012ct9,%2Fm%2F08441_,%2Fm%2F09d6g https://www.google.com/trends/explore?date=all&q=%2Fm%2F05vq...
dreamlayers 10y ago
The problem before was that the symlink creation privilege gets removed by UAC. So, if you gave the privilege to a non-admin user they could use it, but an admin user would always require UAC elevation to create symlinks. https://stackoverflow.com/questions/15320550/why-is-secreatesymboliclinkprivilege-ignored-on-windows-8 https://stackoverflow.com/questions/15320550/why-is-secreate...
SwellJoe 10y ago
I never thought I'd see the day. Now, if only they'd get * in filenames right, I'd be able to check out all of my git repos on a Windows system.
- tooFastFuckYou 10y ago
  And use the correct (NORMAL) slash in paths, instead of the idiotic backslash.
toyg 10y ago
It would be nice if they added this to Powershell. Last time I tried, mklink was only valid in cmd.exe. Tbh I don't see the point of this policy change anyway. Developer Mode means it can't be used in Production, so what are we saving exactly? The 0.000001 seconds it takes to launch a console in admin mode, assuming you didn't already disable UAC like most devs do...?
- ygra 10y ago
  Two options: cmd /c mklink ... New-Item -Type SymbolicLink -Path symlink -Target target As for me, I rarely need to symlink files, so directory junctions work just fine, which don't need administrator privileges.
majkinetor 10y ago
mklink FFS? Even tho cmd.exe is not default shell any more. I can't understand such a big failure! What ? This thing was hard to do ? https://learn-powershell.net/2013/07/16/creating-a-symbolic-link-using-powershell/ https://learn-powershell.net/2013/07/16/creating-a-symbolic-...
twelve40 10y ago
I applaud them for trying, but decades into it, Windows scripting still makes me want to cry : ( Habits aside (I typically enjoy working with unfamiliar languages), with a decent shell you feel like a superhuman flying at lightspeed. In cmd.exe and even Powershell (and sometimes even Cygwin) you feel like you are talking to a 3-year-old, having to switch to "simple English" and grimacing to get a very simple point across...
- brazzledazzle 10y ago
  Have you tried the new cli and Linux compatibility in Windows 10?
  - twelve40 10y ago
    I've not... does it also require mklink in "developer mode", or can you just do ln -sf? ...
    - Intermernet 10y ago
      I just successfully ran `ln -s /mnt/c/Windows/System .` in my home directory in bash. It didn't pop up any dialogues, but I'm a local admin on my machine so it may be different otherwise. I can create a non-admin account and test it, but it's late and I need to go to bed :-)
jaclaz 10y ago
To be fair, the symlink functionality is present in NTFS since XP (though MS never provided a tool to make use of them) and there is a filter driver (Open Source, both 32 bit and 64 bit) by Masatoshi Kimura, see here (search on the page for "driver"): http://schinagl.priv.at/nt/hardlinkshellext/linkshellextension.html http://schinagl.priv.at/nt/hardlinkshellext/linkshellextensi... that provides symlinks on XP and possibly Server 2003 (additionally without any issues with UAC, which is simply not there).
- jungletek 10y ago
  +1 Link Shell Extension is extremely useful!
felixrieseberg 10y ago
I worked at Microsoft during the development of this - and I'm so very happy it finally shipped. We started working on this about a year ago after chatting with npm, git, Ember, and various other command line tools that were substantially slower (or straight up broken) on Windows. I casually mentioned how big of a performance impact we could have to Satya's Assistant and found myself in a meeting with all required groups (filesystems, security, etc), making my case for non-elevated symlink support, within a few days. Windows still is a massive tanker, but I'm so excited for the Microsoft that is able to make sensible changes quickly.
- stuaxo 10y ago
  Fantastic work :) It's always worth bringing up stuff like this. In the open source world, I find just asking for features has about a 1 in 10 success rate so always worth it. Hopefully there will be a way of editing these in explorer too at some point.
- poizan42 10y ago
  Can you (or anyone else) explain the rationale behind having to specify a new flag SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE? What's wrong with simply just not removing SeCreateSymboliclinkPrivilege from the restricted token, and by default including it from unprivileged users?
  - hashhar 10y ago
    Backward compatibility?
    - poizan42 10y ago
      Sounds unlikely given that you could already give SeCreateSymbolicLink to any users - and the thought that someone could rely on a privilege not being there in the restricted token sounds pretty terrifying to me.
  - bitcrazed 10y ago
    The primary motivation for adding the SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE flag is to not disrupt the behavior of existing code. Because of pre-existing behavior, existing apps are likely to be built to assume that symlinks cannot be created when the app is running without admin rights. If the behavior changed such that the app could now create symlinks but not have admin rights, the app and/or its dependent scripts etc. will likely misbehave. Therefore, we added a new flag - SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE - which allows developers to expressly indicate that their code is specifically built to handle the ability to create symlinks should their code be running on a supporting platform (i.e. Win10 Creators Update, or later) even if the app does not have admin rights. HTH.
MrZipf 10y ago
Well, this is cool. Kudos to the folks that made this happen. It was always a tragedy that the Windows Shell team insisted on creating their own "Shortcut" mechanism and not shaping the existing FS team symlinks to give a unified mechanism. It used to be a big ask to get teams to work with each other. Could this be ye oldest piece of functionality to arrive in Windows yet? We also had ANSI sequences at the cmd prompt this year. And native ISO mounting in 2011. But non-admin symlinks go back way further. Cool.
- stuaxo 10y ago
  I think the original shortcuts come from pretty early windows systems (.lnk files may have been around 95, but .pif files seem basically equivalent and existed by 3, but probably earlier).
  - TazeTSchnitzel 10y ago
    Windows has multiple forms of shortcut. .PIF is for running DOS applications with a particularly configured environment. .LNK is for shortcuts to files, folders, and applications. .URL is for links to websites or other URLs (Steam uses this, interestingly).
- TazeTSchnitzel 10y ago
  Existing FS symlinks? Did FAT support them? .lnk came about in Windows 95.
Roritharr 10y ago
Please tell me this is going to make my Vagrant issues go away...
captainmuon 10y ago
Wow. As a side note, this will also enable real symlinks in cygwin. There is already a setting CYGWIN=winsymlinks:native, but this doesn't work because you needed the rights to create native symlinks, and you usually don't run cygwin elevated. (Actually, the situation was pretty messed up. There was a group policy that allowed regular (non-admin) users to create symlinks, but this never really worked, since UAC made processed drop a bunch of rights including symlink creation. So you needed a) either an admin account or a regular account, with the policy set, on Win Pro, and b) you needed to request elevation (which is subtly different from Run As Administrator) or disable UAC (which is dangerous and borks Metro apps in Windows >= 8).) I'm so so glad they fixed this. Next step: Proper GUI for this in Explorer (and also for extended attributes, etc.).

133 points by hashhar 10y ago

0xCMP 10y ago

MS is doing good in my book. They should keep it up. Eventually people will start giving them a chance again.

DoofusOfDeath 10y ago
The problem is that MS has such an amazing record of strategic underhandedness, it would take many years of consistently good behavior for me to trust their intentions. By the way, exactly _which_ of their patents do they claim Linux violates, and exactly what data are they collecting from Windows 10 boxes?
- 0xCMP 10y ago
  Yep very true. I'm a little dogmatic about too. I haven't even installed VS Code even though I know it's supposed to be pretty good. Burned too hard plus looking at what they did to others before me makes a pattern that is hard to ignore.
  - bitcrazed 10y ago
    To be fair, VSCode is open source so you could go look if you were interested: https://github.com/Microsoft/vscode https://github.com/Microsoft/vscode
oxide 10y ago
It's always one step forward, two steps back with Microsoft. Every time I start to warm up to them again, they make me feel stupid shortly afterwards by blowing it. It's an abusive relationship, in a sense.
- 0xCMP 10y ago
  We all have our stories. MS has done a number on me.
daveguy 10y ago
I think they are less doing good and more scared shitless that they put off a huge swath of computer savvy users with their forced upgrades and mandatory tracking. The nuggets they throw to the dev/unix communities are smoke and mirrors. Strategic pleas of "please don't abandon our creaky ship!"

atishay811 10y ago

Finally. This was strange to request admin privileges. I wish they find a solution around the path length issues as well.

vmarsy 10y ago
Is this solution not fitting your needs ? https://mspoweruser.com/ntfs-260-character-windows-10/ https://mspoweruser.com/ntfs-260-character-windows-10/
- xorblurb 10y ago
  I tried that in the AU: let's just say this is better than nothing. Well. Hm. Well, actually I'm not even sure about that; First not only programs must opt-in (through a manifest) -- and that is quite natural given the way some existing Win32 functions are modified, but that won't be taken into effect unless the computer is also opt'ed in. That second condition both makes little sense, and is improperly documented (the doc tells us: a manifested app or the GPO option; while in reality this is: AND) Then a single example so that you can understand the new "quality" of what MS is shipping: SetCurrentDirectory() https://msdn.microsoft.com/en-us/library/windows/desktop/aa365530(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3... Once you've manifested your program correctly (mainly by extracting what is interesting from powershell.exe, like usual because MSDN is shitty and does not describe the procedure to create the manifest with enough details) and configured your install with the good GPO (home edition users: go to hell) you happily starts to try the good old SetCurrentDirectory without the 260 chars limit. It fails. 2 hours latter you understand that it fails because the MAX_PATH LIMIT IS STILL THERE IF lpPathName DOES NOT END WITH A BACKSLASH ‘ß‘¬ð’€¬ð€þ¬ð€ You then take a look at CreateProcess and understand that there is just no way to bypass the MAX_PATH limit with it on some of its params. So you stop trying to use that half-backed and poorly documented "feature". The MAX_PATH (=260) limit in Windows is not gone. Maybe it's 5% gone, but that insufficient as hell.
  - poizan42 10y ago
    You don't need GPO though ( https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3... ): > A registry key allows you to enable or disable the new long path behavior. To enable long path behavior set the registry key at HKLM\SYSTEM\CurrentControlSet\Control\FileSystem LongPathsEnabled (Type: REG_DWORD).

_lce0 10y ago

How far till windows ships with a whole linux's kernel down there?

dom0 10y ago
The NT kernel was always heavily modelled after the unices of the time (but avoided quite some flaws from the get-go, and of course had quite a lot of differences as well due to that and other necessities, like the driver API).
- criddell 10y ago
  I thought it was more DEC-ish (VMS?).
  - serge2k 10y ago
    It is, Cutler famously hated Unix.
    - deleted 10y ago
      [deleted]
besselheim 10y ago
They already emulate a Linux kernel, in recent Windows 10 releases: https://msdn.microsoft.com/commandline/wsl/about https://msdn.microsoft.com/commandline/wsl/about
dmitrygr 10y ago
Considering that NT kernel is a much better design, I'd rather get Linux Mint (with UI) on top of NT.
- fermuch 10y ago
  Could you provide some link to read about this? First time I've heard about it.

sundvor 10y ago

This is great; I love how Microsoft have become so responsive to community demands and wishes. Personally, I've used mklink /d for quite some time, in particular to manage game installs. This became necessary once they started hitting the 30-50GB mark; suddenly those 500GB SSDs / NVMEs didn't feel so big anymore! (Not that I have much if any time to play anymore..)

criddell 10y ago
Do you know why you have to do it as Administrator? It seems like mklink shouldn't need special privileges.
- Dylan16807 10y ago
  The worry was Time Of Check To Time Of Use attacks, but I guess they've decided the balance has changed. Also you've always been able to make junction points without admin.
  - kodfodrasz 10y ago
    Unfortunately I cannot find the link now, but recently I have found a funny article related to these vulnurabilities: If you set up VPN on Windows 10 Mobile for some reason MS has decided to remove the option to resolve DNS at the far end of the VPN. (AFAIK this was present on WP 8.1) I have found a guide how to enable it: Create a symlink on an NTFS sd card pointing to a specific location (an ini file which is hidden in Windows 10 Mobile from you), insert the card, open the file in file browser with an editor, and change a setting.
toyg 10y ago
Mklink is also the recommended (safest and easiest) way to deploy JVM patch-releases in a lot of settings.
- sundvor 10y ago
  Interesting; will read up on that, sounds like something that could be useful elsewhere also. Just got a new preconfigured laptop which was almost full on system. Small 120gb SSD, but had a 1TB spinner. Found that there was 30GB worth of MSSQL DBs, so being lazy I simply moved the files to D and symlinked the directory. The only gotcha was making sure MSSQL had permissions to the new target folder.

OliverJones 10y ago

ln -s a generation ... goes by ... and we get mklink but still no hard links and no use-counted file system. Haven't the Bell Labs patents expired by now?

compsciphd 10y ago
huh? https://msdn.microsoft.com/en-us/library/windows/desktop/aa365006(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...
- kodfodrasz 10y ago
  isn't this documentation a bit dated? AFAIK as of Win10 hard and soft links exist, and also junctions, which are a third, similar but different concept.
  - ygra 10y ago
    Isn't that exactly what the documentation says? I mentions directory junctions, hard links and symlinks. Mind you, hard links and directory junctions have existed for quite a while (going back at least to Windows 2000). Symlinks have been added in Vista.
    - jaclaz 10y ago
      Not really, they were added to NTFS in XP times, see my previous post. https://news.ycombinator.com/item?id=13095172 https://news.ycombinator.com/item?id=13095172
serge2k 10y ago
windows has hard links.
riffic 10y ago
"Those who do not understand Unix are condemned to reinvent it, poorly."

vic-traill 10y ago

> Now in Windows 10 Creators Update, a user (with admin rights) can first enable Developer Mode, and then any user on the machine can run the mklink command without elevating a command-line console. So an Administrator-equiv account still needs to be in the chain of events to make this useful on a per machine basis? If this is the case I'm not sure how this makes symbolic links more useful to me in a Windows environment... ? By default access to remote (network) symbolic links is disabled . You can enable it with fsutil [0]. Between the need for admin-equiv for mklink and the per-computer requirement to fsutil-enable sym links on network shares, symbolic links are unusable in a Windows environment. I don't see how this feature changes that. [0]https://blogs.msdn.microsoft.com/junfeng/2012/05/07/the-symbolic-link-cannot-be-followed-because-its-type-is-disabled/ https://blogs.msdn.microsoft.com/junfeng/2012/05/07/the-symb... [edit: fixed typo on 'fsutil', 'sym' and 'symbolic links'. The curse of posting on a mobile device]

aarongolliver 10y ago
If you're provisioning lots of Windows machines, why not just make these two commands part of that process?
- sixbrx 10y ago
  For me the issue is more that software like version control systems and archiver utitlities that need to understand and create symlinks, might just continue to not support symlinks on Windows. When the software is running as an unprivileged user, it will still fail be able to create symlinks by default, which doesn't make the feature very enticing to add and support for the developers of the software. Git has been in that category, I don't know if this is enough to trigger a change or not. Here's hoping...
- vic-traill 10y ago
  I'll take some a kick at provisioning this via GPO on Monday. I suppose the issue at hand here is that - at minimum - it appears that use of symbolic links requires a Group Policy that specifies both support for mklink and fsutil to be configured, the former requiring admin-equivilency to enable symbolic links to work for a non-admin user. As someone who grew up using 'ln -s' in userspace to create symbolic links, this seems to be a rather high barrier to use of a very convenient user function - "Want to use symbolic links for convenience? Have your admin create GPOS to facilitate this" seems a half-assed answer....

nmstoker 10y ago

Sounds positive, but the article skirts over whether there are any downsides. Surely there must be lots of ways this could get abused? (presumably that's why it sits behind Developer mode rather than being default)

SwellJoe 10y ago
Symlink vulnerabilities are pretty well understood. Though, people still make mistakes now and then. Simple answer about one of the most common/dangerous: A symlink could be made to point to a system file. If a program running with elevated privileges could then be convinced to manipulate the contents of the file pointed to by the symlink, whoever could use that program on the symlink could cause it to modify the system file. There have been real world vulnerabilities like this (I've shipped a few), but they're not super common and they're often limited in their capability to cause damage...they require an elevated privilege app, that is poorly written, that has untrusted users that can poke at it. It probably requires some kind of shell access, or some sort of local account (email account, maybe), in addition to the poorly written program that has elevated privileges. https://www.exploit-db.com/papers/13199/ https://www.exploit-db.com/papers/13199/
- JoshTriplett 10y ago
  There's an easy fix for that: allow unprivileged applications to create symbolic links, but by default, only allow applications to access/follow symbolic links owned by 1) the same user that owns the target file, 2) the user the current process runs as, or 3) an administrator. Since people currently can't usefully use symlinks at all except as an adminstrator, that should not introduce any compatibility issues. Linux has a similar protection mechanism (/proc/sys/fs/protected_symlinks), though it only applies to sticky world-writable directories like /tmp.

to3m 10y ago

Regarding the "interest over time" graph, it's fantastic to see people designing graphs that are just as meaningful for the colour-blind as they are for those of us with normal colour vision.

SaulOfTheJungle 10y ago
I noticed that too — without a legend, who am I supposed to decipher what each color means?
rezxv 10y ago
Because it's a direct screen capture from Google Trends, and for me, it's pretty clear which are they: CVS, SVN, Hg, Git. Here, I've re-created it for you: https://www.google.com/trends/explore?date=all&q=%2Fm%2F05vqwg,%2Fm%2F012ct9,%2Fm%2F08441_,%2Fm%2F09d6g https://www.google.com/trends/explore?date=all&q=%2Fm%2F05vq...
kodfodrasz 10y ago
Luckily there was a link to the google page where the picture was taken, where you can examine the graph more in detail. https://www.google.com/trends/explore?date=all&q=%2Fm%2F05vqwg,%2Fm%2F012ct9,%2Fm%2F08441_,%2Fm%2F09d6g https://www.google.com/trends/explore?date=all&q=%2Fm%2F05vq...

dreamlayers 10y ago

The problem before was that the symlink creation privilege gets removed by UAC. So, if you gave the privilege to a non-admin user they could use it, but an admin user would always require UAC elevation to create symlinks. https://stackoverflow.com/questions/15320550/why-is-secreatesymboliclinkprivilege-ignored-on-windows-8 https://stackoverflow.com/questions/15320550/why-is-secreate...

SwellJoe 10y ago

I never thought I'd see the day. Now, if only they'd get * in filenames right, I'd be able to check out all of my git repos on a Windows system.

tooFastFuckYou 10y ago
And use the correct (NORMAL) slash in paths, instead of the idiotic backslash.

toyg 10y ago

It would be nice if they added this to Powershell. Last time I tried, mklink was only valid in cmd.exe. Tbh I don't see the point of this policy change anyway. Developer Mode means it can't be used in Production, so what are we saving exactly? The 0.000001 seconds it takes to launch a console in admin mode, assuming you didn't already disable UAC like most devs do...?

ygra 10y ago
Two options: cmd /c mklink ... New-Item -Type SymbolicLink -Path symlink -Target target As for me, I rarely need to symlink files, so directory junctions work just fine, which don't need administrator privileges.

majkinetor 10y ago

mklink FFS? Even tho cmd.exe is not default shell any more. I can't understand such a big failure! What ? This thing was hard to do ? https://learn-powershell.net/2013/07/16/creating-a-symbolic-link-using-powershell/ https://learn-powershell.net/2013/07/16/creating-a-symbolic-...

twelve40 10y ago

I applaud them for trying, but decades into it, Windows scripting still makes me want to cry : ( Habits aside (I typically enjoy working with unfamiliar languages), with a decent shell you feel like a superhuman flying at lightspeed. In cmd.exe and even Powershell (and sometimes even Cygwin) you feel like you are talking to a 3-year-old, having to switch to "simple English" and grimacing to get a very simple point across...

brazzledazzle 10y ago
Have you tried the new cli and Linux compatibility in Windows 10?
- twelve40 10y ago
  I've not... does it also require mklink in "developer mode", or can you just do ln -sf? ...
  - Intermernet 10y ago
    I just successfully ran `ln -s /mnt/c/Windows/System .` in my home directory in bash. It didn't pop up any dialogues, but I'm a local admin on my machine so it may be different otherwise. I can create a non-admin account and test it, but it's late and I need to go to bed :-)

jaclaz 10y ago

To be fair, the symlink functionality is present in NTFS since XP (though MS never provided a tool to make use of them) and there is a filter driver (Open Source, both 32 bit and 64 bit) by Masatoshi Kimura, see here (search on the page for "driver"): http://schinagl.priv.at/nt/hardlinkshellext/linkshellextension.html http://schinagl.priv.at/nt/hardlinkshellext/linkshellextensi... that provides symlinks on XP and possibly Server 2003 (additionally without any issues with UAC, which is simply not there).

jungletek 10y ago
+1 Link Shell Extension is extremely useful!

felixrieseberg 10y ago

I worked at Microsoft during the development of this - and I'm so very happy it finally shipped. We started working on this about a year ago after chatting with npm, git, Ember, and various other command line tools that were substantially slower (or straight up broken) on Windows. I casually mentioned how big of a performance impact we could have to Satya's Assistant and found myself in a meeting with all required groups (filesystems, security, etc), making my case for non-elevated symlink support, within a few days. Windows still is a massive tanker, but I'm so excited for the Microsoft that is able to make sensible changes quickly.

stuaxo 10y ago
Fantastic work :) It's always worth bringing up stuff like this. In the open source world, I find just asking for features has about a 1 in 10 success rate so always worth it. Hopefully there will be a way of editing these in explorer too at some point.
poizan42 10y ago
Can you (or anyone else) explain the rationale behind having to specify a new flag SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE? What's wrong with simply just not removing SeCreateSymboliclinkPrivilege from the restricted token, and by default including it from unprivileged users?
- hashhar 10y ago
  Backward compatibility?
  - poizan42 10y ago
    Sounds unlikely given that you could already give SeCreateSymbolicLink to any users - and the thought that someone could rely on a privilege not being there in the restricted token sounds pretty terrifying to me.
- bitcrazed 10y ago
  The primary motivation for adding the SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE flag is to not disrupt the behavior of existing code. Because of pre-existing behavior, existing apps are likely to be built to assume that symlinks cannot be created when the app is running without admin rights. If the behavior changed such that the app could now create symlinks but not have admin rights, the app and/or its dependent scripts etc. will likely misbehave. Therefore, we added a new flag - SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE - which allows developers to expressly indicate that their code is specifically built to handle the ability to create symlinks should their code be running on a supporting platform (i.e. Win10 Creators Update, or later) even if the app does not have admin rights. HTH.

MrZipf 10y ago

Well, this is cool. Kudos to the folks that made this happen. It was always a tragedy that the Windows Shell team insisted on creating their own "Shortcut" mechanism and not shaping the existing FS team symlinks to give a unified mechanism. It used to be a big ask to get teams to work with each other. Could this be ye oldest piece of functionality to arrive in Windows yet? We also had ANSI sequences at the cmd prompt this year. And native ISO mounting in 2011. But non-admin symlinks go back way further. Cool.

stuaxo 10y ago
I think the original shortcuts come from pretty early windows systems (.lnk files may have been around 95, but .pif files seem basically equivalent and existed by 3, but probably earlier).
- TazeTSchnitzel 10y ago
  Windows has multiple forms of shortcut. .PIF is for running DOS applications with a particularly configured environment. .LNK is for shortcuts to files, folders, and applications. .URL is for links to websites or other URLs (Steam uses this, interestingly).
TazeTSchnitzel 10y ago
Existing FS symlinks? Did FAT support them? .lnk came about in Windows 95.

Roritharr 10y ago

Please tell me this is going to make my Vagrant issues go away...

captainmuon 10y ago

Wow. As a side note, this will also enable real symlinks in cygwin. There is already a setting CYGWIN=winsymlinks:native, but this doesn't work because you needed the rights to create native symlinks, and you usually don't run cygwin elevated. (Actually, the situation was pretty messed up. There was a group policy that allowed regular (non-admin) users to create symlinks, but this never really worked, since UAC made processed drop a bunch of rights including symlink creation. So you needed a) either an admin account or a regular account, with the policy set, on Win Pro, and b) you needed to request elevation (which is subtly different from Run As Administrator) or disable UAC (which is dangerous and borks Metro apps in Windows >= 8).) I'm so so glad they fixed this. Next step: Proper GUI for this in Explorer (and also for extended attributes, etc.).