the real problem with UAC

You should be able to turn this "feature" off for programs you trust and leave it on for programs you are unaware of.

 

Symantec Project "UAC Tool"

Give this a try if you can't stand clicking Allow again and again. Not sure if it works with Windows 7, though.

 

I trust NO programs, especially ones with frequent updates and/or ones that seem to collect data. UAC is not that annoying for me that people make it seem.

 

There is no problem with UAC, there is only a problem with users who don't understand computer security. Oh, and I would not touch anything by Symantec with a barge pole, let alone allow it on any of my systems.

 

which is what microsoft set up for win7: they allow auto elevation for any application they know they can trust: signed apps from microsoft.

you should be able to feed own certificates to uac for auto-elevation, but i never read up on it (should be doable).

but, unsigned executables are never capable of being trustable.

never? yes, never.

 

This would be nice. But I don't expect the vast majority of user to understand enough about their system for this to be useful.

A better solution is for developers to figure out how not to trip up the prompt. Developers are the ones with the expertise and knowledge to make such decisions.

 

An excellent point, by the way: It is indeed true that excessive appearance of confirmation dialogs is often simply an indication of complete incompetence on the side of the developers of the application in question, who have foisted a piece of garbage on the unsuspecting customers that was coded as if it was still running on a DOS machine from the 1980s, happily writing configuration and even user data into system folders, or restricted areas of the registry.

I used to make a point of returning such software to the seller for a refund, while pointing out that the software in question is not compatible with Windows, violating guidelines that have been in effect for over a decade now. I must say, however, that by now such software if relatively rare, and mostly restricted to certain shareware applications. Hey, even Intuit now sells software that is Windows-compatible, and that is saying something...

 

I'd amend that to read:

There is no problem with UAC, there is only a problem with users and certain application programmers who don't understand computer security.

There are still some programers around that don't get it.

Gary

 

Now you're talking. This is precisely what I was referring to in my previous reply!

Gary

 

yep. i studied UAC so far, and close to no app i've seen popping up a uac dialog would have need for this.

the proper design for a modern, complex, system-changing app is to give it a service + a gui. the app would be the gui, it would be uac less non admin, and communicates only trough the service. the service on the other hand has a lot of restrictions on it what it can do (that's by default). but it has admin rights. together, they can do mostly anything.

there should be two places where uac pops up: when you want to install/uninstall anything (app, driver, update). and when you change something that affects the system in a possibly destructive way.

but one thing i'm sure: uac will evolve in the future. the plan is to have apps one day that specify exactly what they need, and only get that accessed, then. at installation time, the app says (sort of) i need access to update.mycompany.com, to the gpu, to your user files (of type .myext), etc etc.. and then the app can only do that.

but we're far away from this BECAUSE OF APP DEVELOPERS. they could specify their apps nearly like that today, removing any needs for uac style prompts, or full admin rights at all.

none of this will matter in some years. but for now, it's the best we can have.


it's never windows fault if some app pops up uac. it's windows last try to save you (mainly the system) from harm.

 

The real problem with UAC in Windows 7 is that the default setting allows it to be bypassed quite easily (and thus rendered useless). This pretty much requires the user to manually adjust UAC to "always prompt/maximum annoying-ness", which is unlikely for most users.

 

At some points UAC would become useless since most people would get annoyed and simply click yes, yes, yes without even reading what the message prompt says.

 

So the solution to that is to just do away with UAC? If not, what? How DO you protect folks from rogue apps?

Gary

 

People also forget UAC is a new and improved Runas. Too much emphasis on the "security" benefits. Not enough on the focus on how much suck the old Runas command was.

 

...or reading and only understanding that if they say no they do not get their program
yes, good point. i have no problem with uac, its turned off, from day 2 (did try it on day 1). i have a firewall and a virus checker. and i have backups.
@davepermen: it is the best we have now but still not ideal. i suppose the safe guard is that the type of user they trying to protect does not know how to turn it off.

 

i train the people to not read really, but to just think "was it me" that made the pop up. did i want to install something, or so. if not, say no.

reading is hard but uac can be very successful without reading.

 

Well UAC is step 1 in something called "user awareness". I mean, there could still be the flaw of the guy/girl who sees the UAC pop up and just thinks "oh it must be fine" and still clicks "yes", but the UAC prompt does indeed promote people to at least be aware of things happening to their system at all times.

I personally don't have trouble with UAC; I only get it while installing/updating stuff and the only time it becomes apparent is when I'm using cleanup applications such as defraggler or CCleaner but that's expected since those softwares do indeed affect my system.

 

yeah. and if you run those daily (or hourly), then you do something wrong anyways


to gazzacbr:
the real way to solve it, and remove any need to run as full system admin, is to have sort of federations, and groups and permissions. a setup would have the add/remove program permission, a setup for a driver the add/remove driver permission additionally. an app would have a connect-to-web permsission, or only a connect-to-domainlist. and access-these-files-on-the-system, etc.

and at install time you could chose to permitt those rights, or, in advanced mode, chose to "always get asked" or similar.

i hope btw, that ccleaner and such in the future might be able to scan without admin rights, and only when deleting system-data (not user data), asking for the rights. would look more propper, but is more work.

 

Well I sometimes run CCleaner daily to clear my whole internet cache in one go rather than manually do it for each browser I use(since I don't set it to automatically clear in case I needed something in the cache), but in general I agree with you.

And personally, I think the initial UAC popup is ok for programs like CCleaner so that users are aware that this application can and could do something to your system, but I agree that perhaps having a popup for deleting registry entries and other such modifications would perhaps be better.

 

well, if i do stuff i need to clear, i use private mode of the browser i'm in..

i would like to have elevated apps to have a different coloured border (like, red, or black).. even auto-elevated ones. so one can easily see if an app is evil.

and apps that are auto-elevated get ALWAYS a window, even when they don't create an own one.

something like this.

 

The real problem is a whole generation of computer users and programmers who think they require elevated permissions at all times and think its "TOO HARD" to read two lines of text and understand what they are doing.

"Yes I know I am executing a program which needs to write to restricted areas" shouldn't be too hard to understand for even the lowest level user.

We assume people can read a few lines of text to not put leaded gas in their car, not smoke and put gas in a car, and understand the basics of static electricity so they don't blow themselves to kingdom come as well.

"Make sure you know what your computer is doing right now" doesn't seem that unreasonable.

 

I'm not sure what kind of window are you referring to?

It's rare if ever I run into a UAC prompt during my daily routines. Really.

Is there an epidemic of UAC prompts?

 

Where you see it most is older games or apps... and the people complaining are those who cannot wait a whole few milliseconds for their game (or application) to start.

I don't see it very often save when starting a few legacy apps from work (telephony and sound convert especially), or a game like Lineage 2.

 

While I could work round UAC, and I could look for software that doesn't trigger it, and I could modify my day to day activities so as to not trigger it, instead I can just turn it off and use my computer as I have every day for the past 15 years without any issues.

And everyone who does think it's the greatest thing since sliced bread could stop telling everybody who turns it off that they're an idiot.

 

While is understand the function of UAC and don't really have a problem with it, i WOULD indeed like to exclude some apps from it. Mainly RMclock at startup and HWmonitor which i use a LOT.

I like the fact i'll be informed when anything's changed on my system but there should be more config options

 

the one of the elevated program, obviously. while ccleaner is elevated, make it's border red. while you run an elevated command promt, make it's border red. etc. that way, you have a visual clue which apps you opened maybe hours ago can still harm your system if used wrong.

yes. it's terrible. there are THOUSANDS of popups each minute, on every vista and win7 system. it's an attack!!!

no, people are just "that's new, i don't want it, CRY LIKE A BABY!!!!". the typical thing, you know it, it's the internet world

 

rmclock, create a task that runs at startup (or at logon) with elevated privileges. done.

hwmonitor, create such a task like before, but not auto-starting. then make a shortcut to that task instead of hwmonitor. done.

 

i know changing habits is bad. i know that a lot of elder people still don't want to wear a seatbelt, as it's so much extra work to put it on each time one sits in the car.

i can just tell you one simple sentence that works very well for most. think about it:
you think you're smart by telling "i can handle it all myself, and control my system". while actually, you're stupid. handling this is a very simple task, but it's tedious, and have to be taken care 100% of the time. it's a perfect task to offload to the computer. that's what we have them for: doing stupid repetitive jobs for us. like taking care we don't do crap.
i'm smart, as i offload tasks to my computer as much as possible, and don't let that all shift over to me with manual handling.

you could be smart, too.

 

well, the main category of people who can't read that, and understand that, are the tweaker-geeks who think they have to prove to them, their friends, and the whole web, that they're smarter than their computer. as we all know, humans can handle repetitive work much better and much more precise than computers </sarcasm>

well, they can't get over their arrogance/pride to accept that they should just use it, and understand it's better for them.

we'll see how penguin will reply and tell me how i'm stupid and such to not understand how well he knows his computer and has it under control and all, proving once again how much arrogance and pride of his control he has.

well, everyone needs something to prove he's smart. turning off uac is just a stupid way to do so. but i don't think they will learn. unlike actual stupid users. they learn that quickly.

 

ehm ok...how exactly do i do this?
RMclock is set to run at startup and i've set it to "run as administrator" but that's not the same as what you're saying, right?
How do i creat a task to run at startup or manually with priviliges?

 

the magic keyword is "task planer".. lets google uac administrator startup task planer, and see what step-by-step stuff it brings..


to create a shortcut that starts an app directly in admin mode:

http://www.howtogeek.com/howto/windows-vista/create-administrator-mode-shortcuts-without-uac-prompts-in-windows-vista/

for something at logon: http://blogs.techrepublic.com.com/window-on-windows/?p=616


i use that second one to start rmclock or something similar. but i have chosen not to start it at logon, but at startup (a little more early).

tons of examples findable on the web.

i agree it's not as simple as "right-click, permanently allow as admin" or something. but it does work.

 

thanks...good enough indeed

 

yeah. i needed it for my media center, where the cpu throttling causes a whining tone. on a completely passive cooled silent ssd based media center..

so i use a cpu tool to change the idle-mode, and that is done with that task. works great.

so it's good enough for "those fixes that need something special". for every normal system, not even that should be needed, as the uac dialogs are so sparingly popping up.

 

Dave, you are on a roll today.. Next time I have a question regarding UAC, I'm coming to you buddy.

 

He's like, the UAC god, lol.

 

i want users to not just turn it off completely on the first question that arises, so i try to be able to answer all questions as truthfully and detailed as i know.. alsways there trying to help, and fighting the naysayers (sometimes more of the latter )


it's my little christmas gift to all of you today spreading knowledge like any other day, too amazing, not?

 

God forbid people from running their own personal computers the way they want to...

 

The day people can do anything and everything they want is the day chaos begins my dear

No but seriously, while Dave can sometimes seem a bit blunt about it, he's right: UAC honestly doesn't hamper people so much and it shouldn't be prompting constantly unless you actively use or install applications which do something to your system. I doubt the average user would anyhow.

 

True, but what people do to their own computers is their own business. If they want uac off, so be it. If they want to compromise their security, so be it as long as they know the cons/pros of what they are doing. It's great that he's spreading facts, but stuffing them down people's throats is not a great way to do it.

 

Well that's why I did mention the bluntness of it. Nonetheless, he's still informing(albeit in a bit of a forceful blunt way); he's not literally forcing anyone to switch UAC, but it's clear he's in disagreement with the fact that it's off.

If anything he's actually quite civil in contrast to certain people's blunt point of view on religion, social dogmas(communism, socialism, capitalism) and such hehe .

 

People running their computer how they want. This exactly how XP and earlier ran. And that's what got us to where we are now. Users got lazy, double clicking anything and everything they got.

Developers got lazy, assuming any and all their users had admin privileges by default. And with XP and earlier, there was no way to elevate processes discretely. You either had to elevate the whole friggin program instance or elevate the user's rights. This is EXACTLY what people wanted. Granulated control.

I'm curious just how we can implement customized UAC controls per program. Should it have a white list of filenames and locations? Or should there be a new NTFS flag? All seem pretty complicated when you can just turn off the prompts UAC underlyings in place.

 

I am sorry, but people NEED to know how foolish this is... (and idiotic is being nice frankly)

Most people have no idea how vulnerable they are and it is for their own good that seatbelts, condoms, moderation in all things and preventive medicine are recommended.

Truly speaking that guy with almost a whole week of playing games online with his L33t h@k3r buddies does not hold a candle to the industry computer security people who are posting here that caution and indeed even UAC are useful tools in the struggle to keep your computer free of outside influence.

Truthfully, because of how the internet works, it is in our best interest to keep these peoples' computers free of external influences. This is a shared resource and quite frankly some fool taking his own advice and running this week's trojan is indeed hurting ME!

Despite everything, you are indeed perfectly free to do otherwise, but on site like these the "recommended" policies should remain those of protecting users from their own foibles so as to educate.

If you choose not to take a lesson from the wise, then so be it.
However, I support EVERY time false information is beat down.

Turning off UAC is indeed not the act of an intelligent and knowledgeable user.

 

What's tedious about NOT having to click UAC prompts? It's less work, something I'd expect to be rather obvious to someone as "smart" as yourself.

What's arrogant about stating a fact? I've been running UAC disabled with no issues since it's inception, and Windows of various versions for years before that. I daily visit sites known to be hives of villainy and scum and my computer is clean as a whistle. Arrogant is thinking that your way is the only way and spending half of your time spamming the hell out of this forum telling people that they're using their computer incorrectly and should do it all your way.

 

Funny, hasn't the ability to turn off UAC prompts but keep the UAC underlyings always existed?

While I advocate UAC (cause it forces developers to get their heads straight), I personally don't see any harm in enabling Admin approval.

It just auto elevates for admin users only. Standard users are unaffected. All processes still receive the user token by default. Registry and file virtualization is still enabled.

 

That is what windows 7 does by default when you lower the uac settings to the lowest setting.

 

and to help people, you have to state the truth, and not what people like to hear. disabling uac is stupid, and this is the truth. that's why it got implemented: because it helps you, and everyone else. if you can't understand that, you failed to understand how important it is to not always want everything. great power comes with great responsibility, they say in spiderman. do you want to be responsible to your system 100% of the time it runs, while you just browse some fun movies on the web or something? i don't, as my system CAN DO IT ITSELF.

thus, i'm smarter: i can delegate responsibility to the one who knows best when it's in danger: the system itself.

and yes, you don't like to hear that. you don't like to accept that. that's the hard part at helping: people have to understand stuff, learn stuff, and drop old habbits. and most can't, their ego is too big.

i tried to be polite this time. but it's essentially not explainable to you, and that annoys. sorry for not being polite. i still hope that one day, you understand my reasons. you will feel ashamed then to be in the position you are right now. you and your system are a team, that best work together by shifting tasks to both. repetitive boring stuff to the pc, the actual choice to you. uac helps for that.

 

every moment you do something on the system as admin, EVERY MOMENT, you can kill your system. i've seen viruses doing it without you noticing anything.
and yes it's tedious to always take care of that, not? you just don't. that's the trick. i do. i don't want my system to off just because i couldn't be intelligent enough to step back, and say, what do i need admin for when i do create music? exactly: FOR NOTHING

yeah, and so did everyone else. and no virus ever happened. and no user ever accidentally killed some system files making the os unbootable. etc etc.

there is a REASON uac got created. the reason is obvious: people all over the world killed systems because they where admins when not needed.

 

lol. Just to clarify, I understand your reasons and have nothing against them. I think people should leave uac on (maximum setting). If you actually read my posts, all of my responses to you have nothing to do with uac itself.

This thread is pointless. There is no problem with uac. The "real" problem is with the users; some hate it while others love it.

 

What's tedious is someone being so boastful with "look at me, I am so great, I can run my system for 15 years without the sort of protection UAC offers, without getting a virus, all this while visiting nefarious websites". Wow, we are impressed. You really must be totally awesome, man. Everyone should be like you. Everyone should emulate your actions.

I have been running microcomputers for over 30 years (since 1976 to be exact), and I have taken advantage of EVERY type of protection available, long before the advent of the internet. Davepermen, was not suggesting folks do it HIS way, he was suggesting that folks should do it the way the operating system designers way. But YOU know much better than any old operating system designer, right?

Smug? Oh please, the only one being smug, is the one claiming how in control he is of his machine without using UAC and visiting, wait how did you put it... " hives of villainy and scum". Hello, pot meet kettle.

Gary

 

Designing an OS is as much about idiot proofing it as it is good design, so that's a fallacious conclusion. Do I need a warning label on my tub cleaner saying not to drink it? Of course not. Could it kill me if I drank it? Yes, but I won't be drinking it, so for me, there is no need for a warning label because I know enough already not to drink it.

My take on UAC is much the same.