Vista Securities and Protections
-
Ray Cassick wrote:
The only really secure computer is one that is not connected to anything and locked in a room... oh, and turned off.
It is also enclosed in 10 m of concrete, buried 5 km down (preferably under the Antarctic).
naw, everything surfaces again. The only safe computer is one launched into the sun... the surface of the sun has a habit of making everything safe again. :-D
_________________________ Asu no koto o ieba, tenjo de nezumi ga warau. Talk about things of tomorrow and the mice in the ceiling laugh. (Japanese Proverb) John Andrew Holmes "It is well to remember that the entire universe, with one trifling exception, is composed of others."
-
Vista implements restrictive access to the various locations in the registry and file system which it considers off limits, for various reasons. Me, as owner of the hardware, surely have a constitutional right to read or modify any entry anywhere stored on my computer (AT MY OWN PERRILL), whether it suits Vista or Not. I surely have the right to View or Modify ANY file on my harddrive, (because I Own the Hard Drive), by whatever means I see Fit. All these things were possible under XP. Vista breaches a wall here. Things can be stored on your computer under Vista that you can not find out about anymore, because the OS denies you access. :) :)
Bram van Kampen
Vista's security has been designed to protect the system from the biggest security threat. It's not a trojan, a worm, spyware or a virus. It's the idiot occupying the space between the keyboard and the door. Think about it this way, just because you own a car, should you really be allowed to break it right down to its nuts and bolts? Theoretically you could, but should you really? :rolleyes:
Deja View - the feeling that you've seen this post before.
-
Vista's security has been designed to protect the system from the biggest security threat. It's not a trojan, a worm, spyware or a virus. It's the idiot occupying the space between the keyboard and the door. Think about it this way, just because you own a car, should you really be allowed to break it right down to its nuts and bolts? Theoretically you could, but should you really? :rolleyes:
Deja View - the feeling that you've seen this post before.
Pete O'Hanlon wrote:
but should you really?
well... I was thinking of the first time I took apart a clock.... At least when I took apart the radio I kept the board intact so putting it back was a piece of cake.... but a clock? I made the mistake of taking out the gears/rods to peek at the motor inside... I never did get them to align up again.... of course that always reminds me of the three most dangerous things in the universe: 1) An engineer with a software patch. :omg: 2) A programmer with a screwdriver... :omg: :omg: 3) A user with an idea.... :omg: :wtf: :omg: :wtf:
_________________________ Asu no koto o ieba, tenjo de nezumi ga warau. Talk about things of tomorrow and the mice in the ceiling laugh. (Japanese Proverb) John Andrew Holmes "It is well to remember that the entire universe, with one trifling exception, is composed of others."
-
Pete O'Hanlon wrote:
but should you really?
well... I was thinking of the first time I took apart a clock.... At least when I took apart the radio I kept the board intact so putting it back was a piece of cake.... but a clock? I made the mistake of taking out the gears/rods to peek at the motor inside... I never did get them to align up again.... of course that always reminds me of the three most dangerous things in the universe: 1) An engineer with a software patch. :omg: 2) A programmer with a screwdriver... :omg: :omg: 3) A user with an idea.... :omg: :wtf: :omg: :wtf:
_________________________ Asu no koto o ieba, tenjo de nezumi ga warau. Talk about things of tomorrow and the mice in the ceiling laugh. (Japanese Proverb) John Andrew Holmes "It is well to remember that the entire universe, with one trifling exception, is composed of others."
El Corazon wrote:
- A user with an idea....
That's just crazy talk.
Deja View - the feeling that you've seen this post before.
-
A constitutional right. I seem to hear that phrase a lot. It's almost as popular as bashing Microsoft or praising Open Source software. I notice the writer lives in the UK. I don't know much about Constitutional Monarchy as they have there. But in the US where I live, the constitution does not specifically provide protection for one's ability to read or modify files on a computer. However, the first amendment made to the constitution does give one the right to complain about not having that right. :-D I suppose it could be argued that the ninth amendment provides some sort of right to jack around with those files, but I doubt you'd get much support from a jury in a US court, even though your right to go to court and plead your case to a jury over this issue is definitely protected by the seventh amendment. You see, it turns out that the fellas who wrote the US constitution were not very computer savvy. They actually wrote it on parchment. Now maybe if they had Vista and were not able to get to some obscure file containing proprietary code that IS protected by US and international law (but not the constitution), they might have put something about that in the constitution. But for some odd reason they were more interested in things like establishing justice, national defense, and "the Blessings of Liberty." Personally, I don't think that's such a bad thing.
_If you continue to do the same things you always did,
don't be surprised if you get the same results you always got.
_ -
I have been running Vista U64 for quite a while now, as far as I can tell I still have full access to the computer, IF you know what you are doing. All they did was reduce immediate and accidental access. It's either going to ask you if you really want to change that (UAC), or it has other admin software you need to run to access it, or configure it. Even XP stopped you from looking at program files and even C until you gave it permission to examine it. So this is no big surprise. We, as programmers, have been told for several years now to keep our hands out of the cookie jar, stop doing things that require admin rights for our users, because it puts our users at risk. As developers, we occupy a very small percentage of the overall user-base of an operating system. MS will do what they think is best (think being the operative word, there is still ongoing debate on the strong-hand approach). I know you don't want to hear it, but we are ultimately to blame for the UAC. MS offered the carrot approach for years, trying to get programmers to stop doing things that require admin rights. I didn't stop until security made me stop under XP. It was a wake up call. I just got my wake up call earlier than everyone else. I see little difference between a fully secured XP Pro workstation and Vista. The primary difference to everyone else is they have been running admin rights all the time, for all operations. The difference is we got our hand slapped. And like unrepentant children, it's the teacher's fault not ours.
_________________________ Asu no koto o ieba, tenjo de nezumi ga warau. Talk about things of tomorrow and the mice in the ceiling laugh. (Japanese Proverb) John Andrew Holmes "It is well to remember that the entire universe, with one trifling exception, is composed of others."
El Corazon wrote:
I see little difference between a fully secured XP Pro workstation and Vista.
I damn well do! The times when I need to perform an administrative function on Windows Vista, I get a nice popup confirmation dialog, which after confirming, goes ahead and does it. On Windows XP you either have to become a command-line expert or log off and back on again (if you're on a domain and can't use Fast User Switching). A lot of programs do run as administrator, but Explorer and IE can't be made to. Some programs and parts of the shell (e.g. Power Options control panel) need your account to have administrative rights to work properly. For those, MakeMeAdmin[^] can suffice, but it's a real pain to type both the local administrator password and your own password - and once you have, your network drive letters are commonly missing. Still, I'm sticking it out at work - I think it's now more than three years since I changed my account over to being a standard user. Wow. I looked it up on my blog. I switched over to standard user four years ago[^]. I may even have never been an administrator on my current work machine (purchased December 2004 - probably time for a new one!) I've been resisting Windows Vista at work because it wouldn't run eMbedded Visual C++, but someone recently suggested that it works if you set Windows 98 compatibility mode. Haven't tried that yet.
DoEvents: Generating unexpected recursion since 1991
-
If you want to modify any file on your drive you while I have to boot from another drive/install so the files are not locked on the other drive.
Need a C# Consultant? I'm available.
Happiness in intelligent people is the rarest thing I know. -- Ernest HemingwayEnnis Ray Lynch, Jr. wrote:
If you want to modify any file on your drive you while I have to boot from another drive/install so the files are not locked on the other drive.
??? What's that about, I don't want to do any of the things above! However, I Think I get your point, If Vista denies me the Ownership and Control over the computers I own, I will soon switch to Linux. :) :)
Bram van Kampen
-
Bram van Kampen wrote:
All these things were possible under XP. Vista breaches a wall here. Things can be stored on your computer under Vista that you can not find out about anymore, because the OS denies you access.
All you have to do is disable UAC[^], then you get your XP like access back, if that's what you really want.
My .NET Business Application Framework My Home Page My Younger Son & His "PET"
Hi, Thank You !!!:rose::rose: This is an Option that No One ever mentioned over the 18 months I've been trying to attack this issue. The answers I've got sofar all dealt with what I had to change in order to comply, and what I could or Could not do on my own Computer. I've had No time yet to fully consume the contents of the quoted website, but you gave the first promissing answer in 18 months. Your name will be enrolled on the Scroll of Key Contributers to Softguard, along with Mark Salsbury. BTW Why is this not an Installation Option for Vista, or So scarcely Advertised. Thanks Again, I will email you a Bottle of Wine :rose: Thanks,
Bram van Kampen
-
Xiangyang Liu ??? wrote:
All you have to do is disable UAC
I've been running Vista for about a year now. You have to make your account the same functionality as the administrator account. In other words when you go into the user accounts it should say yourname/administrator. I have never turned off my UAC(and never would) and I have full rights to everything and everywhere on my computer.
Member number three million seven hundred seventy two thousand nine hundred sixty three
Xiangyanliu ??? wrote: All you have to do is disable UAC[^], then you get your XP like access back, if that's what you really want. This was the Answer I've been looking for for the last 18 Months.
Bram van Kampen
-
Constitutional right? Gimme a break. Nobody's forcing you to use Vista.
cheers, Chris Maunder
CodeProject.com : C++ MVP
No, No One is forcing me to, but my customers can only buy Vista Pre-Installed Computers. Xiangyanliu ??? wrote: All you have to do is disable UAC[^], then you get your XP like access back, if that's what you really want. This was the Answer I've been looking for for the last 18 Months.
Bram van Kampen
-
The problem with this is that almost everyone runs as a local admin so anything that YOU can do can be done by things running under YOUR account. But I am sure that YOU know that right? Sometimes MS cannot catch a break you know? People say it is unsecured so then MS secures it then then people bitch about that. Users disabled UAC and get infected with all kinds of stuff then complain that MS allows you to disable UAC... it never ends. The only really secure computer is one that is not connected to anything and locked in a room... oh, and turned off.
Well, None of my customers are connected to the Internet. The vast majority of them have only one computer, but they don't even know that. They call it the 'Cash Register' Anyways, Xiangyanliu ??? wrote: All you have to do is disable UAC[^], then you get your XP like access back, if that's what you really want. It took 18 months on the Code Project to get this answer.
Bram van Kampen
-
Bram van Kampen wrote:
Me, as owner of the hardware, surely have a constitutional right to read or modify any entry anywhere stored on my computer (AT MY OWN PERRILL)
If you carefully read most EULA, you don't own that damn software. You only have a privilege to use it. Many EULA state you can not alter anything. changing a value in registry is not altering, but also does not give you the right of ownership either. :^)
Yusuf
No, I Do not claim to own the Software, but I do own the Hardware. Values in my Registry control My Hardware. To protect a user from inadverted change is one thing, To make them Inaccessible or unchangable is something else. Anyways, Xiangyanliu ??? wrote: All you have to do is disable UAC[^], then you get your XP like access back, if that's what you really want. It took 18 months on the Code Project to get this answer.
Bram van Kampen
-
Is Bram's message some kind of a joke? I hope so. 1) Wildly accessing any and all files isn't possible unless you run with admin rights - that has always been the case, even as far back as NT 3.1(!). Admittedly many people didn't know this due to the OS by default giving people admin rights at install time. 2) Constitution?!? What on earth? 3) Wildly modifying files isn't wise anyway! As many have pointed out, access control is done for a reason....
Mike Diack wrote:
Is Bram's message some kind of a joke? I hope so. 1) Wildly accessing any and all files isn't possible unless you run with admin rights - that has always been the case, even as far back as NT 3.1(!). Admittedly many people didn't know this due to the OS by default giving people admin rights at install time. 2) Constitution?!? What on earth? 3) Wildly modifying files isn't wise anyway! As many have pointed out, access control is done for a reason....
Well, thats's the Point. All Users on a Softguard Network have allways Admin level Access. This has never been any security risk. Constitution? well, a Basic Right for want of another word! If I own a PC, It is ultimately up to myself as owner to decide what I store on my Harddrive and where. I would also consider it a Basic right to be able to read back by whatever means required to do so, whatever is stored on the harddrive I own. The bottom line is that I have the right to be wrong on my own hardware, wise or not!
Bram van Kampen
-
I have been running Vista U64 for quite a while now, as far as I can tell I still have full access to the computer, IF you know what you are doing. All they did was reduce immediate and accidental access. It's either going to ask you if you really want to change that (UAC), or it has other admin software you need to run to access it, or configure it. Even XP stopped you from looking at program files and even C until you gave it permission to examine it. So this is no big surprise. We, as programmers, have been told for several years now to keep our hands out of the cookie jar, stop doing things that require admin rights for our users, because it puts our users at risk. As developers, we occupy a very small percentage of the overall user-base of an operating system. MS will do what they think is best (think being the operative word, there is still ongoing debate on the strong-hand approach). I know you don't want to hear it, but we are ultimately to blame for the UAC. MS offered the carrot approach for years, trying to get programmers to stop doing things that require admin rights. I didn't stop until security made me stop under XP. It was a wake up call. I just got my wake up call earlier than everyone else. I see little difference between a fully secured XP Pro workstation and Vista. The primary difference to everyone else is they have been running admin rights all the time, for all operations. The difference is we got our hand slapped. And like unrepentant children, it's the teacher's fault not ours.
_________________________ Asu no koto o ieba, tenjo de nezumi ga warau. Talk about things of tomorrow and the mice in the ceiling laugh. (Japanese Proverb) John Andrew Holmes "It is well to remember that the entire universe, with one trifling exception, is composed of others."
El Corazon wrote:
Even XP stopped you from looking at program files and even C until you gave it permission to examine it. So this is no big surprise. We, as programmers, have been told for several years now to keep our hands out of the cookie jar, stop doing things that require admin rights for our users, because it puts our users at risk. As developers, we occupy a very small percentage of the overall user-base of an operating system. MS will do what they think is best (think being the operative word, there is still ongoing debate on the strong-hand approach). I know you don't want to hear it, but we are ultimately to blame for the UAC. MS offered the carrot approach for years, trying to get programmers to stop doing things that require admin rights. I didn't stop until security made me stop under XP. It was a wake up call. I just got my wake up call earlier than everyone else.
Well, I've yet to meet a site on this side of the atlantic, where the MS security model was implemented.(i.e. a Network where not everybody is not logged in automatically as an administrator)
Bram van Kampen
-
El Corazon wrote:
I see little difference between a fully secured XP Pro workstation and Vista.
I damn well do! The times when I need to perform an administrative function on Windows Vista, I get a nice popup confirmation dialog, which after confirming, goes ahead and does it. On Windows XP you either have to become a command-line expert or log off and back on again (if you're on a domain and can't use Fast User Switching). A lot of programs do run as administrator, but Explorer and IE can't be made to. Some programs and parts of the shell (e.g. Power Options control panel) need your account to have administrative rights to work properly. For those, MakeMeAdmin[^] can suffice, but it's a real pain to type both the local administrator password and your own password - and once you have, your network drive letters are commonly missing. Still, I'm sticking it out at work - I think it's now more than three years since I changed my account over to being a standard user. Wow. I looked it up on my blog. I switched over to standard user four years ago[^]. I may even have never been an administrator on my current work machine (purchased December 2004 - probably time for a new one!) I've been resisting Windows Vista at work because it wouldn't run eMbedded Visual C++, but someone recently suggested that it works if you set Windows 98 compatibility mode. Haven't tried that yet.
DoEvents: Generating unexpected recursion since 1991
Never in my Life had that Experience, but, then again, time is Young.
Bram van Kampen
-
Xiangyanliu ??? wrote: All you have to do is disable UAC[^], then you get your XP like access back, if that's what you really want. This was the Answer I've been looking for for the last 18 Months.
Bram van Kampen
Bram van Kampen wrote:
This was the Answer I've been looking for for the last 18 Months
Why, I have all and full access with the UAC on and my computer's protected clear to the root files.
Member number three million seven hundred seventy two thousand nine hundred sixty three
-
Xiangyanliu ??? wrote: All you have to do is disable UAC[^], then you get your XP like access back, if that's what you really want. This was the Answer I've been looking for for the last 18 Months.
Bram van Kampen
Bram van Kampen wrote:
This was the Answer I've been looking for for the last 18 Months.
If that is true, either you haven't been looking very hard or you haven't been looking very wisely. I Googled the first five things that came to mind on this topic. In every case a solution was returned on the first page of results. But to be even more simple, I opened the help screen that comes with Vista. I clicked "Security and Maintenance" then clicked "What is User Account Control?" Finally I clicked "Turn User Account Control on or off." The answer was 3 clicks away. Now here's a question for you. Do you really think it is a good idea to stress the fact that it took you 18 months to find this answer that was right under your nose? You seem to be blaming CodeProject for this somehow. You might want to rethink that.
-
Bram van Kampen wrote:
This was the Answer I've been looking for for the last 18 Months.
If that is true, either you haven't been looking very hard or you haven't been looking very wisely. I Googled the first five things that came to mind on this topic. In every case a solution was returned on the first page of results. But to be even more simple, I opened the help screen that comes with Vista. I clicked "Security and Maintenance" then clicked "What is User Account Control?" Finally I clicked "Turn User Account Control on or off." The answer was 3 clicks away. Now here's a question for you. Do you really think it is a good idea to stress the fact that it took you 18 months to find this answer that was right under your nose? You seem to be blaming CodeProject for this somehow. You might want to rethink that.
Well, I have only One Vista Computer for testing purposes. The majority of our customers have single computers under win95/98/millenium. I'm merely trying to future proof my code, and Vista seemed to throw some issues. At the same time, I do not think that anyone knew that you could switch off all this crap by changing a single entry in the registry. I'm not blaming Code Project Contributors, who have been more than helpfull, And Yes, at the end of the day, it Was my fault, and humble apologies offered to those who responded. My private 'Eureka' is still discovering the reg value that controls it all. :)
Bram van Kampen
