4 ms·

Spacemonger uses the MFT and doesn't require Administrator privileges

by hd4 2y ago

smusamashah 2y ago
Is this the Spacemonger you are talking about https://web.archive.org/web/20121126062443/http://www.sixty-five.cc/sm/v1x.php https://web.archive.org/web/20121126062443/http://www.sixty-... It does not say anything like that in FAQ and i don't remember it being fast.
- hd4 2y ago
  Yes that one. Just use it and see. It's blazing fast.
  - smusamashah 2y ago
    Just learned that its open source now https://github.com/seanofw/spacemonger1 https://github.com/seanofw/spacemonger1
    - soylentcola 2y ago
      Been using the portable version of 1.4 for decades after first coming across it in some PC magazine or something like that many years ago. Not terribly pretty, but it does what I need and it still works.
  - password4321 2y ago
    I thought you meant the $15 utility from Stardock, but if not then I'm fairly confident it's not reading the MFT. https://github.com/seanofw/spacemonger1/blob/6a41c012534b170d1dfcd44a6adcbfd3417212d3/FolderTree.cpp#L414 https://github.com/seanofw/spacemonger1/blob/6a41c012534b170...
    - hd4 2y ago
      It's still interesting that they got it to work as fast and precise as they did.
  - adzm 2y ago
    It uses FindFirstFile etc https://github.com/seanofw/spacemonger1/blob/6a41c012534b170d1dfcd44a6adcbfd3417212d3/FolderTree.cpp#L414 https://github.com/seanofw/spacemonger1/blob/6a41c012534b170...
justsomehnguy 2y ago
AFAIR MFT access requires Administrator/SYSTEM rights and there is absolutely no way to read it as a regular user. The only workaround (used by Everything by VoidTools) is to install a service which would run with a needed rights and communicate with it in the GUI.
- faeriechangling 2y ago
  You call that a workaround but it’s basically the best possible situation security-wise. If this didn’t work securely then it wouldn’t be possible to implement disk defragmenter or even explorer. It’s so core to Windows NT’s security model that I wouldn’t call it a workaround. You do similar things even with more modern stacks - assign a permission to an application and grant permissions to the application to the user. The only real concern is that Windows NT permissions are not as granular as they could be.
  - mananaysiempre 2y ago
    > Windows NT permissions are not as granular as they could be. For objects, Windows NT permissions are ridiculously granular; e.g. GENERIC_WRITE can be mapped to a half-dozen separately settable type-specific flags, depending on the object type (file, named pipe, etc.). It’s too granular for even an administrator to make sense of, arguably, and the documentation is somewhere between bad and nonexistent. (The UI varies from decent, like the ACL editor you can access from e.g. Explorer, to “you can’t make this shit up”, like SDDL[1].) For subjects, the situation is not good, like on every other conventional OS. You could deal with that by introducing a “user” for each app, as on Android. But I’m not aware of any attempts to do that (that would expose this mechanism in a user-visible way). (Then there’s the UWP sandbox, which as far as I tell is build with complete disregard of the fundamental concepts above. I don’t think it’s worth taking seriously at this time.) [1] https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-string-format https://learn.microsoft.com/en-us/windows/win32/secauthz/sec...
    - faeriechangling 2y ago
      I have no idea if there’s a granular object permission that could give access to the MBR of a disk. I’ve thankfully never had to dig that deep into Windows internals. I’ve had to work with SDDL before to setup granular permissions for WMI monitoring on a whole lot of computers and my god, did it make me love the Cloud and Linux. I can’t emphasize enough how unintuitive setting these permissions is creates systemic over privileging.

Spacemonger uses the MFT and doesn't require Administrator privileges

by hd4 2y ago

Spacemonger uses the MFT and doesn't require Administrator privileges

Is this the Spacemonger you are talking about https://web.archive.org/web/20121126062443/http://www.sixty-five.cc/sm/v1x.php https://web.archive.org/web/20121126062443/http://www.sixty-... It does not say anything like that in FAQ and i don't remember it being fast.

hd4 2y ago
Yes that one. Just use it and see. It's blazing fast.
- smusamashah 2y ago
  Just learned that its open source now https://github.com/seanofw/spacemonger1 https://github.com/seanofw/spacemonger1
  - soylentcola 2y ago
    Been using the portable version of 1.4 for decades after first coming across it in some PC magazine or something like that many years ago. Not terribly pretty, but it does what I need and it still works.
- password4321 2y ago
  I thought you meant the $15 utility from Stardock, but if not then I'm fairly confident it's not reading the MFT. https://github.com/seanofw/spacemonger1/blob/6a41c012534b170d1dfcd44a6adcbfd3417212d3/FolderTree.cpp#L414 https://github.com/seanofw/spacemonger1/blob/6a41c012534b170...
  - hd4 2y ago
    It's still interesting that they got it to work as fast and precise as they did.
- adzm 2y ago
  It uses FindFirstFile etc https://github.com/seanofw/spacemonger1/blob/6a41c012534b170d1dfcd44a6adcbfd3417212d3/FolderTree.cpp#L414 https://github.com/seanofw/spacemonger1/blob/6a41c012534b170...

justsomehnguy 2y ago

AFAIR MFT access requires Administrator/SYSTEM rights and there is absolutely no way to read it as a regular user. The only workaround (used by Everything by VoidTools) is to install a service which would run with a needed rights and communicate with it in the GUI.

faeriechangling 2y ago
You call that a workaround but it’s basically the best possible situation security-wise. If this didn’t work securely then it wouldn’t be possible to implement disk defragmenter or even explorer. It’s so core to Windows NT’s security model that I wouldn’t call it a workaround. You do similar things even with more modern stacks - assign a permission to an application and grant permissions to the application to the user. The only real concern is that Windows NT permissions are not as granular as they could be.
- mananaysiempre 2y ago
  > Windows NT permissions are not as granular as they could be. For objects, Windows NT permissions are ridiculously granular; e.g. GENERIC_WRITE can be mapped to a half-dozen separately settable type-specific flags, depending on the object type (file, named pipe, etc.). It’s too granular for even an administrator to make sense of, arguably, and the documentation is somewhere between bad and nonexistent. (The UI varies from decent, like the ACL editor you can access from e.g. Explorer, to “you can’t make this shit up”, like SDDL[1].) For subjects, the situation is not good, like on every other conventional OS. You could deal with that by introducing a “user” for each app, as on Android. But I’m not aware of any attempts to do that (that would expose this mechanism in a user-visible way). (Then there’s the UWP sandbox, which as far as I tell is build with complete disregard of the fundamental concepts above. I don’t think it’s worth taking seriously at this time.) [1] https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-string-format https://learn.microsoft.com/en-us/windows/win32/secauthz/sec...
  - faeriechangling 2y ago
    I have no idea if there’s a granular object permission that could give access to the MBR of a disk. I’ve thankfully never had to dig that deep into Windows internals. I’ve had to work with SDDL before to setup granular permissions for WMI monitoring on a whole lot of computers and my god, did it make me love the Cloud and Linux. I can’t emphasize enough how unintuitive setting these permissions is creates systemic over privileging.