4 ms·

> Placing restrictions on user accounts is only useful for protecting the system from users, which is a valid concern on a network with shared resources but wor

> Placing restrictions on user accounts is only useful for protecting the system from users, which is a valid concern on a network with shared resources but worse than useless on a personal desktop. True for home users; not necessarily true for corporate users-- where computers are IT-managed (i.e. "don't let end users fuck them up") and may be shared (which is highly situational-- the degree to which computers are shared varies highly from company to company, or even deployment to deployment). Heck, it's not even unheard of to end up with multiple "simultaneous" users on a single-seat desktop machine-- every major OS these days supports some form of fast user switching, which will leave one user's programs running while another user's physically sitting at the machine.

AnIdiotOnTheNet 8y ago
A few things, since I work in IT: we don't give a damn about your workstation. It's a fungible resource. Reimaging is easy and relatively quick. We even let you have local admin because who cares. Users are not prone to playing around with settings they don't understand, in my experience. If someone was constantly needing their workstation reimaged we'd probably just fire them for being incompetent. Ideally, the OS would be completely separate from the applications and configuration and be immutable, and that would go a long way towards eliminating those kinds of problems. We managed to share home desktop computers in the 90s without significant problems, even though the OSs we used didn't support multiple user accounts at all. And there's no reason you need user accounts to accomplish what you're describing. You can still have profiles (preferences, application configs, etc), and you can encrypt them with a passphrase if you have any reason not to trust others using the same device. > Heck, it's not even unheard of to end up with multiple "simultaneous" users on a single-seat desktop machine A vanishingly small use case inside an already vanishingly small use case.
- IWeldMelons 8y ago
  Not everyone lives in a first world country. I live in the Central Asia, and $200 a month is a decent salary here. And it is normal to share a computer between different family members.
  - AnIdiotOnTheNet 8y ago
    Again, we did that in the 90s here in the west all the time and user accounts weren't necessary and their introduction did not really solve anything.
jrockway 8y ago
I still don't think users are the right model. For example, look at how Amazon allows multiple users to access one of their shared computers (it's a service called EC2). They don't use Linux users. You get root and the other people using that machine are protected from you. I believe there is now an option (or maybe it's the default) in Windows to run IE under a hypervisor, to totally isolate it from the local machine. This is moving in the direction of providing something useful. Though to be fair protecting the OS doesn't make much sense to me. I guess it's nice to guarantee that your computer will boot no matter what you do to it, but again, that is not the problem people are actually facing. The corporate threat model involves things like protecting people from getting an email that says "click this OAuth button to give this malware access to your email". None of the critical software is running on a user's workstation, so whatever is going on there doesn't matter.

AnIdiotOnTheNet 8y ago

A few things, since I work in IT: we don't give a damn about your workstation. It's a fungible resource. Reimaging is easy and relatively quick. We even let you have local admin because who cares. Users are not prone to playing around with settings they don't understand, in my experience. If someone was constantly needing their workstation reimaged we'd probably just fire them for being incompetent. Ideally, the OS would be completely separate from the applications and configuration and be immutable, and that would go a long way towards eliminating those kinds of problems. We managed to share home desktop computers in the 90s without significant problems, even though the OSs we used didn't support multiple user accounts at all. And there's no reason you need user accounts to accomplish what you're describing. You can still have profiles (preferences, application configs, etc), and you can encrypt them with a passphrase if you have any reason not to trust others using the same device. > Heck, it's not even unheard of to end up with multiple "simultaneous" users on a single-seat desktop machine A vanishingly small use case inside an already vanishingly small use case.

IWeldMelons 8y ago
Not everyone lives in a first world country. I live in the Central Asia, and $200 a month is a decent salary here. And it is normal to share a computer between different family members.
- AnIdiotOnTheNet 8y ago
  Again, we did that in the 90s here in the west all the time and user accounts weren't necessary and their introduction did not really solve anything.

jrockway 8y ago

I still don't think users are the right model. For example, look at how Amazon allows multiple users to access one of their shared computers (it's a service called EC2). They don't use Linux users. You get root and the other people using that machine are protected from you. I believe there is now an option (or maybe it's the default) in Windows to run IE under a hypervisor, to totally isolate it from the local machine. This is moving in the direction of providing something useful. Though to be fair protecting the OS doesn't make much sense to me. I guess it's nice to guarantee that your computer will boot no matter what you do to it, but again, that is not the problem people are actually facing. The corporate threat model involves things like protecting people from getting an email that says "click this OAuth button to give this malware access to your email". None of the critical software is running on a user's workstation, so whatever is going on there doesn't matter.