3 ms·

I never understood why this was a problem MS never felt they needed to address in the OS itself (architecturally). At this point, AV software should be obsolete

I never understood why this was a problem MS never felt they needed to address in the OS itself (architecturally). At this point, AV software should be obsolete. But, here we are.

munchbunny 7y ago
They do and have done it for many years. But it’s hard (impossible) to stop a user from (being tricked into) downloading some random crap and insisting on running it despite warnings about untrusted executables and warnings about the executable asking for administrator permissions.
- grawprog 7y ago
  The problem is a lot of legit programs cause the same terrifying popups in windows to the point where they become more of an annoyance than something you actually pay attention to.
  - munchbunny 7y ago
    The problem is that the same legit programs are doing things like using administrator permissions when they don’t need them and not signing their code, so the structural “protect users from themselves” features can’t kick in. Fundamentally power users want freedom over guard rails and casual users need those guard rails present (though in my experience there are plenty of power users who think they’re security savvy), so there’s not a one size fits all solution. At the moment I think Windows 10 S mode is a promising approach to give both groups what they want, which is also the kind of architectural solution you asked about.
    - bluGill 7y ago
      I have long said that Microsoft could make a big difference just be having office check on startup for administrator privileges, and refuse to start if found. Nobody with administrator rights needs to run Office. You should have a second non-administrator login for that type of thing.
sectiondetail 7y ago
I think Microsoft's engineers would love to, and do wherever possible. But Windows' #1 selling point is backwards-compatibility. It's possible that there's types of security hardening that simply can't be done without breaking large swathes of legacy business software.
WorldMaker 7y ago
Also, Microsoft has been bundling AV as an OS feature for a while now. A lot of damage was done by the US anti-trust judgment declaring AV to not be an OS feature, and for Microsoft needing to wait for that judgment to expire to bundle the feature (which is why it was a separate download for Windows XP, and why so many people still don't realize Windows 10 has AV built-in and 3rd Party options are unnecessary at best [and can be scams at worst]).

I never understood why this was a problem MS never felt they needed to address in the OS itself (architecturally). At this point, AV software should be obsolete. But, here we are.

munchbunny 7y ago

They do and have done it for many years. But it’s hard (impossible) to stop a user from (being tricked into) downloading some random crap and insisting on running it despite warnings about untrusted executables and warnings about the executable asking for administrator permissions.

grawprog 7y ago
The problem is a lot of legit programs cause the same terrifying popups in windows to the point where they become more of an annoyance than something you actually pay attention to.
- munchbunny 7y ago
  The problem is that the same legit programs are doing things like using administrator permissions when they don’t need them and not signing their code, so the structural “protect users from themselves” features can’t kick in. Fundamentally power users want freedom over guard rails and casual users need those guard rails present (though in my experience there are plenty of power users who think they’re security savvy), so there’s not a one size fits all solution. At the moment I think Windows 10 S mode is a promising approach to give both groups what they want, which is also the kind of architectural solution you asked about.
  - bluGill 7y ago
    I have long said that Microsoft could make a big difference just be having office check on startup for administrator privileges, and refuse to start if found. Nobody with administrator rights needs to run Office. You should have a second non-administrator login for that type of thing.

sectiondetail 7y ago

I think Microsoft's engineers would love to, and do wherever possible. But Windows' #1 selling point is backwards-compatibility. It's possible that there's types of security hardening that simply can't be done without breaking large swathes of legacy business software.

WorldMaker 7y ago

Also, Microsoft has been bundling AV as an OS feature for a while now. A lot of damage was done by the US anti-trust judgment declaring AV to not be an OS feature, and for Microsoft needing to wait for that judgment to expire to bundle the feature (which is why it was a separate download for Windows XP, and why so many people still don't realize Windows 10 has AV built-in and 3rd Party options are unnecessary at best [and can be scams at worst]).