3 ms·

Microsoft is shooting themselves in the foot here. Who will take real security warnings seriously after that?

reincarnate0x14 5y ago
That ship sailed years ago. Windows has trained people that all system dialogue boxes are a choice between "Use my computer" and "Don't use my computer."
- formerly_proven 5y ago
  Classic example in security UX how it's not done.
  - krylon 5y ago
    Have other operating systems done a better job, though? UI/UX is not something I can claim to be good at, but getting it right when it comes to security is difficult.
    - reincarnate0x14 5y ago
      Android, as an example, will at least tell what broad class of elevated privilege a program wants/needs so someone can make a guess as to whether or not that makes any sense. The worst part of the whole farce of Windows access control is that NT has a rich role-based security model that can apply granular controls to nearly any type of system object, but absolutely none of that is exposed in normal Windows user interaction and UAC is a completely separate band-aid that interacts with the ACLs in strange and often surprising ways.
      - krylon 5y ago
        Good point. I was thinking of old-school desktop and server operating systems. Having worked as a Windows admin for a couple of years, I think that is the most tragic aspect of Microsoft's software ecosystem. There is so much there that is inaccessible thanks to poor UI, poor or nonexistent documentation, or "hiding in plain sight" by being scattered across some dated UI, a few undocumented CLI utilities and a couple of obscure Registry keys; and maybe a config file, too, but you need to know where to look. To this day, I feel the urge to weep when I consider that Microsoft's often expensive software does not come with decent manual, while Free/Net/OpenBSD are free as in free speech and free beer, and they have superb documentation. If I were more paranoid, I might think is serves mainly to keep the countless companies offering consulting, training, and support in business.

That ship sailed years ago. Windows has trained people that all system dialogue boxes are a choice between "Use my computer" and "Don't use my computer."

formerly_proven 5y ago
Classic example in security UX how it's not done.
- krylon 5y ago
  Have other operating systems done a better job, though? UI/UX is not something I can claim to be good at, but getting it right when it comes to security is difficult.
  - reincarnate0x14 5y ago
    Android, as an example, will at least tell what broad class of elevated privilege a program wants/needs so someone can make a guess as to whether or not that makes any sense. The worst part of the whole farce of Windows access control is that NT has a rich role-based security model that can apply granular controls to nearly any type of system object, but absolutely none of that is exposed in normal Windows user interaction and UAC is a completely separate band-aid that interacts with the ACLs in strange and often surprising ways.
    - krylon 5y ago
      Good point. I was thinking of old-school desktop and server operating systems. Having worked as a Windows admin for a couple of years, I think that is the most tragic aspect of Microsoft's software ecosystem. There is so much there that is inaccessible thanks to poor UI, poor or nonexistent documentation, or "hiding in plain sight" by being scattered across some dated UI, a few undocumented CLI utilities and a couple of obscure Registry keys; and maybe a config file, too, but you need to know where to look. To this day, I feel the urge to weep when I consider that Microsoft's often expensive software does not come with decent manual, while Free/Net/OpenBSD are free as in free speech and free beer, and they have superb documentation. If I were more paranoid, I might think is serves mainly to keep the countless companies offering consulting, training, and support in business.