http://www.osnews.com/story/9435/The_State_of_Windows_Security Exploring the Future of Computing en-us Copyright 2001-2009, David Adams adam+nospam@osnews.com Tue, 07 Jul 2009 01:41:47 GMT http://www.osnews.com/images/osnews.gif http://www.osnews.com http://osnews.com/thread? http://osnews.com/thread? Avoid it wherever possible - say I as I type this at windows box (Hey, at least it's not mine) Tue, 18 Jan 2005 07:10:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Yeah, a bit more of security consciousness among the average Windows users would not be a bad thing. However, while this user, for example, thinks it's inconvenient to instruct a personal firewall to permit (or deny) programs access to the internet, I would say it's a quite long shot to make the masses care about personal computing security. Tue, 18 Jan 2005 07:53:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Windoze-boxes are fine as long as they are not connected to any network nor contain any important information Tue, 18 Jan 2005 08:13:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Actually, there many, and some very large corpoartions, that Do NOT use
any form of "limited user"; one of them very well known in the IT/WWW
Industry that "defaults" all winXP desktops to Admin. accounts. Despite
a recent 3rd partyish audit & strong advice to develop a customized
sec_policy (I mean the msc snap-in templates are right there!) for
their desktop clients, the CEO/CIOs were more interested in tightening
Intranet Gateway security & deploying employee monitoring software
<aka keyloggers et al>!
One step in the right direction would be (taking a
Unix<??>Linux/BSD approach) to require a general user account be
created upon install & then have that account boot by default. But!
<don flameproof tin hat> that would destroy & disrupt "The
Glory of the anybody can do this! Experience!" Not to mention another
"aspect" for Redmond to have faction to have to "probably' deal with
disgruntled users<aka product_support>.
Now with MS doing something that (so far) appears as genuine concern
for thier Massive avg User & Global Corporate base; IOWs fixing a
long problem of THEIR design they would never admit to; by
incorporating anti-spy-virus-malware into their OS, and possibly
"add-on" applications. The only problem there is; they'll probably make
you pay extra in some form or another.
But, there is still an ever urgent need to ed/re-educate users on the
possible devastating consequences of running as roo..., er
ah...Administrator. Often is it found, that most home users (and even
corporate MCSE/As I've encontered!) didn't necessarily Ignore, so much
as weren't Aware of potential risks & preventitive measures.
WW's Tue, 18 Jan 2005 08:14:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? OK, so next time I read "the rules first" and not use NVU. Tue, 18 Jan 2005 08:18:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? After the shock I got from the "Linux isn't free" article, I must say that this is a very well written piece.

It really hits the nail on the head, by squarely putting the blame on user mentality. I have to confess. I too was a Windows-single-user. After my switch to Linux I learned the value of multi-user(as talked about in this article) and now not even my Windows XP box is single-user.

Unfortunately, Windows will still be the main OS used for some time, and most people will thus still be using it as a single user. The way to combat this, I think, is to not only advocate Linux, but also the virtues of multiple users.

Just my 2cents worth Tue, 18 Jan 2005 08:20:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Thats the first line of defense, good well thought out code that impelements security as a holistic concept not an add on. Also fixing those Integer Overflows / Buffer Overflows / XSS asap is a must. Without these things, preaching security to your end users will be an act of futility. Tue, 18 Jan 2005 08:22:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? That is very true. The only problem is that with Windows we won't easily see a complete recoding. So we have to apply the next line of defence, namely preaching good security practices to the end-user. Tue, 18 Jan 2005 08:40:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? The only problem is that with Windows we won't easily see a complete recoding.

It doesn't _need_ a "complete recoding". Tue, 18 Jan 2005 09:13:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Users can't handle the problems with software which was written without considering whether or not someone works as admin, power user or just plain user. It's a pain in the b()tt to test and fix every application you use in the restricted user environment. Software makers should write apps better suited for restricted use and Windows should have promoted the security model in the first place. SP2 does a good job annoying users, because of DEP, System Restore and Windows Security Center. Nothing will save you if any of these fail. The features they represent do not educate the user, but tells them to do this and that, and they work mostly by themselves and aren't transparant. Tue, 18 Jan 2005 09:14:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? ... in practice. Not a troll, but I really wish software writers would write their apps so you can install them with non-admin user! Most of the apps unfortunately need to install as administrator, which basically sucks. Some apps fortunately support installing to your own account, which is good... Going to better direction.

(And no, Linux apps do not need to have root to install - I compile all of my own software to ~/sandbox/) Tue, 18 Jan 2005 09:15:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? OK. I'll give you that one, but what is the chances that Microsoft will change something that is quite hard-coded into the OS. Hell, they don't even want to remove IE. Tue, 18 Jan 2005 09:32:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? the only useful and safe windows machine is when its swticthed off and not plugged into the wall... Tue, 18 Jan 2005 09:43:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Impossible to run Windows as Non-admin in practice.

Actually it's pretty easy. I've been doing it for going on 9 years now. I suggest investigating the "Run As" facility. Tue, 18 Jan 2005 09:46:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I'll give you that one, but what is the chances that Microsoft will change something that is quite hard-coded into the OS.

What needs to be changed ?

Hell, they don't even want to remove IE.

Mainly because:
a) there's no reason to
b) most customers want it
c) most developers want it Tue, 18 Jan 2005 09:49:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? they dont want it... they're forced to use it because of diff dirty tricks microsoft has used over the years....

if they had a choice...... and if they had the knowledge ... they would have dumped IE... and Windows a long time ago .... !!!! Tue, 18 Jan 2005 09:56:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? It is a very bad thing that enabling more secure operation
requires reinstalation. I don't know about that, because
I am not windows user, but that has been written in the article.

DG Tue, 18 Jan 2005 09:56:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? IE:

a) there's no reason to

Not for Microsoft, but what about the smaller browsers that get smothered by IE?

b) most customers want it

I don't want it. Do you want it? The thing is, the customer don't ask for it, they just get it. It's kinda like shoving something down someone's throat.

c) most developers want it

No comment. I'm not in the dev game.

Eugenia: Sorry for going a little off topic. Tue, 18 Jan 2005 10:04:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Who is at fault? People, I know that the article says that bashing MS is of no benefit. However constructive critism is of something of vaule. In this breif paragraph, I will attempt to add something of use/value.

1) Single user design. Ok, the heritage is there. However, even after NT, MS and developers have not truely encouraged permissions and access rights to applications. This is why, several apps require admins to install (obvious) and configure (user level settings) IE: Winamp.

2)User Education. At present, user level education is non-existant. This has to change to a degree.

In essence, the fault goes back to:
1) MS
2) Applications developers
3) Users

Its not one group, its all groups that have made errors. Sorry, but this is just my humble opinion. Tue, 18 Jan 2005 10:18:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I'll give you that one, but what is the chances that Microsoft will change something that is quite hard-coded into the OS.

What needs to be changed ?

Hell, they don't even want to remove IE.

Mainly because:
a) there's no reason to
b) most customers want it
c) most developers want it
____________________________________________________________

Reasons to remove it:
1) Competition
2) No, most customers don't even know that their are alternatives.
3) Developers want a standard. And since IE is on every machine, it is almost considered a standard, only by pure volume.

Standards are a must, as well as being open. Why? Think about this whole wacky internet thing:
1) HTTP/HTTPS
2) TCP/IP
3) HTML
4) SMTP

Open Standards all users to communicate regardles of product and therefore ensures some sort of competition. Please note, Open Standards does not refer to having source code being released.

And no Dr. Smithy, I do not wish to use IE on my system, period. And I know several users who do feel the same way. Tue, 18 Jan 2005 10:26:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? And from Slashdot today:

http://it.slashdot.org/it/05/01/18/0218242.shtml?tid=172&tid=10...

Linux Getting Harder To Crack

AlanS2002 points out today's article from Iain Thomson on vnu.net, which says that "Linux systems are getting tougher for hackers to crack, security experts have reported today," summarizing "A study conducted by the Honeynet Project has found that it takes about 3 months before a unpatched Linux machine will be owned, compared with about 72 hours in the past. According to a report on the study default installations are now more secure with less services enabled by default, added to this is newer versions of software such as OpenSSH being more secure. Interestingly Solaris 8 and 9 did not fare so well."


Bye bye windows and Solaris zealots Tue, 18 Jan 2005 10:57:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Great article, allbeit a bit short. I expected some sort of review on WindowsXP with the limited user account .

However, the author does have a point. Privileges and security measures such as the root/admin-normal user divide are implemented and working-- it's just that most software makers don't really give a damn and build their apps for admin.

However, I still think for most end-users the whole admin-user divide is pretty useless; a virus with limited privileges can still wipe out a person's /home or whatever directory, containing all his photos and music etc. I think that for the end-user his personal info is way more important than system software. A broken OS can be re-installed. Lost photos cannot. Tue, 18 Jan 2005 11:09:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? "it takes about 3 months before a unpatched Linux machine will be owned, compared with about 72 hours in the past"

--------------------------------------------------------------
This has to be one of the most brain dead things ever said. Tue, 18 Jan 2005 11:11:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I was recently told that practically everyone at Microsoft has local administrator rights on their PC. So there's little incentive there for testing that application code can be run as a limited user. It would be great if this changed, and also if Microsoft certified applications that would work correctly in an unprivileged environment.

In my organisation, we try to restrict privileges to users. But there have to be exceptions for those who need specific applications - we simply don't have the resource to re-engineer those apps, if it's even possible. So it's not too surprising that some corporations allow local admin rights - it can appear cheaper to put defences elsewhere than to fix the problem. Tue, 18 Jan 2005 11:19:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Two major omissions here are:
a) the general market
b) the individual user
The general market hasn't cared fig #1 for security until the last couple of years. Ripping MicroSoft's head off for giving the people what they want makes as much sense as decapitating Anheuser-Busch.
The individual user is still largely uneducated about the wee technical details that the IT people take for granted. There is simply a lot to know. I would sure like to know how to shut my WinXP box down without the HP laserjet driver causing an 'application not responding' dialog. I just figured out the other day that sychronizing my PalmOS device requires manually starting the HotSynch application with administrator privileges.
I view these changes as a good thing but I'm tweaked that there isn't a tutorial on how to manage these applications more cleanly. Tue, 18 Jan 2005 11:32:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Use Windows XP as a "Power User", and use Run As for any installations etc.

We have 4000+ people in our organisation running as power user. The only people who require "admin access" are those who either a) develop applications, or b) use toshiba laptop power utilities! Tue, 18 Jan 2005 11:40:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? In the past, in the age of DOS and its predecessors, computers were actually quite difficult to use. They required the user to generally know what they wanted to do and also to know how they could get their computer to do it.

Nowadays computers are easy enough for any schmuck to use and yet most users don't even know how to do quite simple things.

Some people think that future computers will individually do less and hence be less vulnerable to malware (we'll just have more gadgets for specific tasks). I'm more inclined to believe that it will gradually become more and more difficult to create malware as operating systems and applications become more polished and less permissive. That seems to be the current trend, although malware is definitely evolving faster.

I aint holding my breath for either solution though.

The unprivileged user is not a complete panacea either. Even the unprivileged user can be used to send spammail, connect to other machines, delete files, run a keylogger etc. If they can install software (even just for themselves) or even just run software then there can be problems (not to mention privilege escalation in windows is apparently a feature)

Extra Settings for each individual program is a pain to setup and maintain. I used to use bash/tcsh aliases, a complicated fvwm setup and all sorts of hot keys until I got sick of setting them up on each and every machine I used.

I think some solutions come down to fixing the problems of malware. A lot of malware relies on doing things that shouldn't be possible. Does IE need a feature to fill the screen with popups. Does Windows really to need to hide what applications are run on startup/login. Why can you write office macros that install themself in every document on the system. Why can custom software intercept keystrokes meant for another application. How does malware mess with search results from google, or redirect certain domains to competitors.

Spam isn't caused by weak security at the workstation level. It's almost a fait acompli of a very permissive SMTP standard. Surely this isn't just software bugs, most malware relies in overly permissive computing practices in every quarter. On what planet were things like ActiveX, scripts or external images in email ever thought of as a desirable feature.

Changes to limit or remove this sort of thing will unfortunately take a long time as we narrow down what we actually want computers to do and what we don't.

End Rant Tue, 18 Jan 2005 11:41:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? MS has produced a fatally insecure series of windows products. It is not just the foolishness with the user accounts, but many other things. ActiveX. Open network shares. Browser helper objects. The registy quagmire. Not delivering a new, more secure windows version despite the great need. Delivering patches and updates that are badly tested and cause trouble. Steve Ballmer. Did I miss anything?

The only solution: Switch! I do not tell you to switch to Linux or Apple. Use Amiga if you like it. Just get away from Windows. Microsoft will only see the light if they lose market share in the double-digit range. Tue, 18 Jan 2005 11:44:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Microsoft needs to let go of the single user mentality and adapt THEIR EULA to fit a multiuser environment. The EULA and the restrictions placed on the OS is the only reason XP and 2000 act the way they do. If they would simply accept and endorse the fact that a desktop/workstation should allow multiusers logged on at the same time, with out interrupption or interfearence to the other users, that would make all well.

If MS were to give heads up to developers now, that they indeed were going to do that, it would give those devs the time needed to adjust their "habbits" accourdingly.

All in all, I think XP is a great OS, and with proper manangment it can be just as secure as Linux ( I am a FOSS advocate/consultant and full time MS System Admin). For example last year in our Windows only environment we had two computers that were hit viruses (We have 110+ computers)no unauthorized access, and a realativly few computers with spyware. No one has Administrative rights except for my boss and I. Security can be done on Windows, you just have to be smart about it. Tue, 18 Jan 2005 12:06:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I have nothing bad to say about this article. Wait, I'm sure I can think of something. Ummm. Microsoft could make a restricted user account the default and make an inconvenience popup that says something along the lines of "this application has tried to write to 'c:program files', but you do not have permission to write to that directory" and then give you the option to stop the program, deny access to the program, or run the program as another user for that particular operation. That way Microsoft isn't stopping these badly behaving apps from functioning, it's just making them annoying. As such developers will very quickly fix their mistakes. Tue, 18 Jan 2005 12:19:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Install Mac OS X. You will have an root account that is disabled by default.
You may act as an admin (with the sudo or prompt bix for your password).
When installing application, you have two cases :
- simple drag and drop of the application to your hard disk
- using an installer that prompt for admin right.

Once the app is on disk, is will work for normal user. My dad (70 year old) is using a iBook without any problems. He did not read a single book about Mac OS X.

That's it : switch to a better OS/GUI. Tue, 18 Jan 2005 13:39:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Maybe you didn't read the entire article, but I wouldn't exactly call it a "win" for Linux (pay attention to the second sentence):

"But there was bad news for Solaris users, with three out of the four honeypots running Solaris 8 or 9 hacked within three weeks. However, a fourth has been online for six months without being compromised."

I think this has more to do with what is running on the machine as opposed to what OS is on the box in question. As more people deploy Honeypots, malicious users are now probably taking more care in selecting their targets. For example people are scanning the subnet my home Internet connection is on for 443, a lot! If the target is appealing, someone will attack it.

Another way of looking at this article is maybe Solaris is better than Linux based on the last sentence. Six months without being compromized, from the same article that is twice the amount of time that the "best" Linux box stood. Tue, 18 Jan 2005 13:49:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I think people make too much of a big deal in regards to running as Administrator. In reality, it's possible to run as Administrator and still have a very secure system, so it's really a non-issue if you know what you're doing. If you don't know what you're doing, then go out and buy buy one of those Mac Minis, instead of making unintelligent comments like 'The only way to secure Windows is to turn it off', or whatever. Tue, 18 Jan 2005 14:03:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? After my kids had gotten my Windows XP box infected, I tried setting up the new system with limited accounts.

Every single game I installed had to have their permissions on their program directories changed. I tried RunAs to install as administrator, but it installed it for the administrator and not the account I was under. I tried upping the account to admin for the install, but then it failed when running the game.

The real killer came when I found that the spyware monitoring software I had purchased (SpySweeper) would not work if you were NOT running as admin. Every spyware parogram I could find had this same limitation.

I wish that more developers would learn how to write system drivers. Most do not have to be that difficult to write - they can be exe's that just run a little differently. The big mind change is that you put your UI in a different program and communicate with the driver as a separate process (named pipes are what I tend to use). The real hard part of drivers is debugging - OutputDebugString is about your only friend. Antivirus developers have this one down cold.

Anyway, after trying this for about a month and a half I had to give it up as currently too difficult to maintain (fear of spyware programs alone made me move people back to admin accounts). Tue, 18 Jan 2005 14:16:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I'm a Slackware and Mac OS X user, so actually I have very few tolerance around Windows when things tend to just not work properly.

Anyway, a while ago I had to format my parents Windows box. As I installed apps, drivers, etc to get the box running I then connected to windowsupdate to get the latest updates. Huge mistake. I had yet to install anti-virus software and firewall. In a matter of few minutes the system was completly unresponsive and it took me three-times more to set the hole thing up. What I should have done was format again. It would have saved me a lot of time and trouble.

But, anyway, Windows security is not so bad... if you have the latest updates, anti-virus and firewall (and maybe spyware/adware removal soft) running and DON'T use IE; works like a charm - for my parents. I say, no thank you. Tue, 18 Jan 2005 14:39:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I had much the same experience, running mostly audio software.
Weird little bugs would turn up, like plugins not saving settings, some CD writing software not working, and some dongles refusing to authorise.

I'm sure I could have sorted it by manually setting all the permissions, but I have no idea which files/directories as the errors were not very informative.

Still, even on Linux it's only recently that an LSM module has enabled me not to run most audio apps as root anyway. Tue, 18 Jan 2005 14:46:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? After scanning the Honeynet Project report that you where refering to the interesting thing was not that Linux and UNIX was more secure, but that it was also less often targeted. The honeynets are left easy to get into but still nobody particually wanted to get into them. It's nothing to do with install base of potential targets for the authors of the scripts that script kiddies use (the people that honeynets are really there to get data on), as for servers UNIX and Linux are very common. It seems that the people with the skill to really write compromises for Linux simply don't want to, or prefer to keep there software to themselves rather than letting everyone have it. Tue, 18 Jan 2005 15:03:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? [i]XP, and created a limited user for my day-to-day activities. This was indeed a drastic switch from the administrative privileges I was use to. Even changing the date and time required logging in as administrator. However, using the "Run As" feature, I am able to install most software simply by right-clicking the setup program, choosing "Run As," and typing my password to launch the installation as administrator.[i]

You can practically install anything in your home folder,even as a limited user.Enforcing a environment a la Ubuntu were you practically are forced to use sudo wouldn't work for the vast majority of MS users.Instead a nice script attached to a nice knob with title 'enhance security" and a good explanation while the script runs and makes runas the default way of installing/running apps wouldn't be so bad.Would be nice also when MS would create a substitute for active-x.Javascript shouldn't be necessary at all.IE and Outlook could run in a chrooted environment by default monitored by a adware/virus-scanner.Some startup,runonce regkeys should be nonwritable per default setting for the limited user unless the root user has given a approval etc.. As default an absolute minimum of services should be running.Those who want to use a certain app or feature know what they want and should be able to overule the suggested /needed services automatically given by the system. Tue, 18 Jan 2005 15:05:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Actually, it all starts with educated users.

Debian security was penetrated a while back (I believe it was this summer.) Due to a password given to someone who shouldn't have had access.

Your code can be flawless, but if your users don't take security seriously or just don't know how to protect themselves your code is no better than anyone elses.

The sandbox approach where there's one root account and everyone else operates as a user is a good start, MS caught on and does something similar with WinXP.

The problem with both of these approaches is they tend to be
a) completely ignored, where people will just login as the administrator or root account to browse the web and send e-mail,

b) it annoys end-users who try to install their "easy-to-use" USB or Firewire external harddrive or dvd burner and find that they can't access it, or can't write to it, or can't read from it due to preset restrictions,

c) Someone competitent has to set the box up for them and will end up supporting that box.

The nicest approach i've seen for root account management is in Knoppix 3.7 where there isn't even an option to login as root or to use 'sudo' -- you have to go to Root Terminal under Knoppix. If someone tries to gain entry but can't figure out the root password, it's logged.

I wonder how many people out there use their password as "password" or when they are forced to change passwords they use "password1" then revert back to "password2" every other month, instead of, say, vX46cRy78dt as an example (not my pw.)


Many homes are setup EXACTLY this way:
Broadband Internet->
Cable Modem->
Wireless Router-> setup for Infrastructure Mode.
1) Ethernet connected PC (printer/scanner connected here)
2) Wireless connected laptop(s) (roaming)
3) Wireless connected pda or similar device.

I've seen many setups and every single one had:
1) No WPA set, or a VERY simple key with the minimum letters / numbers required,

2) Password on router set to 'admin' with no login name (thanks Linksys)

3) The router's aren't set to only read the MAC ID's they expect and reject all others (Whenever possible).

I realize that their are tools like air snort, kismet and the like, so if someone wants to read your traffic they can. But SOME security precautions are better than being wide open. Keeping people away from your property is a different problem than preventing a remote attack from a bored highschool kid in Poland.

The windows firewall appears to only protect individual computers from remote attack. Once you set the computers up for a network, you have to turn off the Windows Firewall, plain, sp1, sp2 or otherwise. This is pretty terrible since it would be nice to configure the firewall to allow KNOWN network MAC ID's to access files / printers / etc that the network admin wants to allow. Security then falls onto the router's firewall and whatever safety precautions I've mentioned above.

Ease of use is at many times going in the opposite direction of security. The Knoppix approach is the best combining of the two I've seen in terms of security and user-friendliness.

All of the bugs / exploits are a serious problem -- and for the most part can and will be patched, but I don't think they're half as risky as uninformed users operating with no security at all.

-d Tue, 18 Jan 2005 15:22:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Ok question if there was NO IE by default how are you planning to download your little Firefox? FTP? oh wait no the standard ftp is IE... or dos.. so i guess your going to dos to download it and for a new user i could just IMAGINE them trying to get a browser not knowing how to use dos... hell most new computer users barely know how to use IE. Tue, 18 Jan 2005 15:26:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? My machine is a Pentium III@800 w/ 192MB RAM, so I didn't install XP SP2 because it got too slow. But I took other measures:

-Limited user;
-Spybot w/ resident, Spyware Guard, AVG;
-Ad-aware; Spyware Blaster;
-Kerio Personal Firewall, Privoxy;
-Mozilla, Thunderbird, Gaim;

Kerio is denying incoming packets and allowing outgoing packets only for known ports.

I created a sudo.bat in c:windows.

SUDO.BAT
======
@echo off
runas /user:administrator %1

Usage: sudo "cmd" -> runs CMD as administrator

Then I removed Administrator from the Welcome Screen leaving only limited users there (normally XP hides Administrator but forces you to have another account with admin priviledges):

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonSpecialAccountsUserList

Create DWORD "Administrator" and set to "0".

Now I need to Ctrl+Alt+Del twice to get off Welcome Screen and be able to log as Administrator.

http://www.microsoft.com/windowsxp/using/setup/learnmore/tips/knox1...


As for the rest of the software: choose wisely. Don't expect that every piece of software works as limited user. Microsoft pretty much given up on this and created the "Power User" profile, which is almost an Administrator.

Even photo organizers like Picasa need admin priviledges:
http://www.picasa.com/support/kb_category.php?CategoryID=8#102

But there are others that don't. Start choosing software that works for limited users and developers will follow. Right now I avoid running all kind of software that needs admin priviledges.


Bruno Tue, 18 Jan 2005 15:43:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Works for me, but I almost only use windows to play games (which about half of need to be root). I occasionally browse the web (with IE, no install room for firefox). Tue, 18 Jan 2005 15:57:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Windows XP Home only has to user levels, Administrator and Limited. Why Microsoft disabled the Power User option is a mystery to me. This is an area where dumbing down the system went too far.

My experience with RunAs has been good and bad. Most third party applications work with it but some Microsoft programs do not, such as Windows Explorer.

Games seem to be more problematic. But it seems things are looking brighter in this area too.

If Microsoft wants to tout easy of use computing they should try to fix or try to help fix the user level problem. Tue, 18 Jan 2005 16:06:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Microsoft could bundle Firefox with Windows.
Sure, it would dent their pride, but Microsoft want to make the user experience better, and the operating system more secure don't they? Tue, 18 Jan 2005 16:36:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? At work, our PC's user accounts run as "Limited users". Some software won't work. How we get around that is to grant Full Control to whatever folder the software is installed in. Also, if that doesn't make the program run right, we grant Full Control to the application in the registry.

This is not practical for the average user but it works great at least 75% of the time in our corporate setting. It also works great for my parents who don't do much other than email on thier pc too. Tue, 18 Jan 2005 16:49:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Power users are there in XP but you have to dig for them. Right click My Computer, manage, open up local users and groups, open up users (or groups), right click properties on a user, click member of, add, advanced, scroll down and find Power users. Why this way instead of the shorter path like Windows2000? Don't know. But power users are there. Tue, 18 Jan 2005 16:54:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? And you?
I think a healthy Os sould eat potato each day to have strengh and honor, like a Klingon.
And do you know? Bill Gates is going to marry Bob Tue, 18 Jan 2005 17:00:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? The steps you outline do not appear to function the same in Windows XP Professional. I can get as far as the Advanced button, but there is no scrolling or "Power user" category to be found beyond that.

The only options appear to be Administrator and Limited User. Tue, 18 Jan 2005 17:27:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? A very lively discussion. I have been a Windows XP user for a while. My machine first off has not broken down because of SP2 nor has it slowed down. Nor do I have viruses or malware on my machine. I think the key is to be an educated user. Take the tool you are given and maximize the heck out of it in terms of optimization and usability. I love th idea of Linux as an OS but I like the ease of XP. I love Mac OS X because it seems to have the best of both worlds but it is only available for Power processors and not X86's. I dont think XP is a security hazard any more than the other Oses I previously mentioned. I read a report from Secunia that says how many security bugs have been discovered and so on. Seems XP is right there with the other OSes. THe only problem I see with XP is the bloat source base. So with that much bloat if the security issues are at least numberwise the same as the other Os out there, then if MS dcided to wisen up, it could keep its marketshare no problem. Tue, 18 Jan 2005 17:34:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Here is my experience of installing MS Office 2000 and running at as a limited user.

On an XP SP2 box, under an administrator account I installed Office 2000 and all updates for it from officeupdate.com All Office applications were opening just fine. Then I logged in as a limited user and launched Word. It started installing something (probably some user-specific bs), then threw an error message, but after that actually opened. I closed it and tried opening again, same result. I then changed the account type from limited to administrator, launch Word allowing it to do its thing and then changed the account type back to limited. After that Word started working normally under the limited account.

What can be expected of 3rd party software developers when MS' own applications can't properly handle a limited account? I wonder if this was fixed in OfficeXP and 2003? Tue, 18 Jan 2005 17:39:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? YOU DELETED MY MARVELLOOOOUUUUUUUS POST.
Me is angry
me will tuer tout everybody
Windows is like schnout in a bol de toilet Tue, 18 Jan 2005 17:50:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? oups you do not effacer my post, me is sorrry, me love you like me like potato Tue, 18 Jan 2005 17:52:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I don't want to start a Mac OS X vs. XP debate here, but there are a few things that should be noted.

In order to get around the old problems of OS 9 and earlier, Apple simply allowed it to run as "Classic". The same way they enabled the Power PC line to run programs for the older 68,000 series of machines.

Longhorn is supposed to solve the security problems of XP and earlier. One of the reasons it's so late, no doubt, is because that's an almost impossible task. Given the fact that Windows was made insecure by design, it depends on that insecurity to function.

How does one eliminate the lack of security without making life almost impossible? Come out with a new system that is written from scratch that doesn't have those holes, and allow old software to run under the old system. Some of the older stuff won't work, but most of those tasks should be now done under the new systems improved security system anyway. After a while old programs will be upgraded to run properly under the new OS, and the old one can be discarded.

Is it a perfect way? No, of course not. But replacing it all at once with something that attempts to pretend that everything can go on in the same way will fail. MS has to write very convoluted code to enable programs that rely on lax, or no, security to function easily under a system that has tight security. How do you do that? You have to make the program think that security is lax when it isn't. A security abstraction layer. I shudder at the thought.

This isn't the fault of the user. I disagree with several posters there. MS sold their systems with the idea that after DOS, and even 3.1, you no longer had to think to use their OS and software. They attempted to emulate the Mac so well that they tried to go even further than Apple had gone.

If, instead, they had loosened up, EXCEPT, where security was concerned, they still would have had a system that much easier to use than DOS or 3.1, but required the occasional password or other security feature to be enabled. Users would never have complained. Instead, they deliberately eliminated almost all security for most users, and ignored it, DESPITE the fact that for over ten or fifteen years now they have been warned about it. They keep coming out with new systems lat continue to lower the amount of security, little as it is.

This is an MS choice. Make it easier, and blame security problems on someone else.

Longhorn, whatever it will eventually be, should be a complete break with the past. Those who say that security is not so tough, and supply numerous sites to get software to enhance, are missing the point. It's not so tough for that .5% who write in here maybe. But it's the other 99.5% who matter in all this, and for them, it is tough, and it shouldn't be. Tue, 18 Jan 2005 18:43:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Preface : This is not intended to be a *really* secure solution.

Suppose you got a Windows box where many apps are already installed and some apps won't run as Non-Admin. Suppose somebody asks you tom

The most dangerous applications are those which access the internet.

So why not run these applications with a less privileged user account ? That's the fastest and most simple solution.

So just write some batch files for the Webbrowser, the eMail application etc. which uses RunAs. It's possible to script the RunAs command by using the SANUR utility provided on http://www.commandline.co.uk/sanur_unsupported/index.html.




Afterword : A *SECURE* solution would incorporate this :

- Install Windows and setup a Non-Admin account for daily use
- Install Firefox, Thunderbird and OpenOffice
- Disable access to IExplore.exe and msinm.exe (Outlook Express) via NTFS ACLs
- *ADVISE* the user to use the RunAs-contextmenu item if a newly installed app fails to run without Admin rights. Or, even better : Give him a hint for an application which doesn't even _need_ admin rights .... Tue, 18 Jan 2005 18:43:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I don't know if this has been mentioned here already but it would help immensely if any action that required ADMIN privies would prompt the user to login as admin the SAME way linux does this.

It does this mostly for installs already, but other mundane tasks are devoid of this action. That's why many users remain as admins when they login. Tue, 18 Jan 2005 19:08:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I am the only one using my computer. Why do I have to set up multiple accounts, which cannot access each other's data, just to set up a secure system? Systems that require such, and that inlcudes every system I know, are fundamentally flawed, period. Multiple accounts are an accepted band-aid, not a solution. I can perfectly understand why most users are not willing to deal with such a mess. Tue, 18 Jan 2005 19:46:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Here's' what I've experienced:

1) Windows up until XP SP2 has been an insecure OS

It was designed for use by single users, even though facilities existed for defining multiple users on the same machine.

2) In order to bring far-reaching security to Windows, 2 things had to be done; either break compatibility with earlier products to provide security or rewrite the OS from the ground up with a security layer built in.

Microsoft chose to add security into an existing OS because the development costs at this point to redo Windows from the ground up would be enormous. Also, development for existing applications (Office, MS Devel Tools, etc.) would have to be redone, adding additional costs.

3) Most software written since the days of 3.1 have been written with FULL access to folders, with no restrictions.

4) The RunAs feature has had limited if varied success. Many apps (both 3rd party and Microsoft apps) don't run correctly in limited user mode, and the Power User Group isn't apparent in XP home edition or XP Pro editions not logged into a domain.

5) Computer manufacturers (Dell, HP, Toshiba...) ship their systems out by default with an admin login to both home and business customers.


PC makers, developers and Microsoft are the one's keeping this vein of security going.

PC makers won't lock their systems down for fear of more support calls from people trying to add software/drivers, remove software or use software, so they ship the systems open.

Developers code their applications under admin rights, making the product unusuable under a limited access account.

Microsoft, understanding their OS wasn't designed for security in mind, slaps a security layer that renders apps unable to run and doesn't develop RunAs to what it should be, because of said legacy OS problems.

PC makers, developers and Microsoft themselves keep this going. Security will get better if all three recognize this.


PS. None of the apps I run for my users will run correctly under the RunAs feature. It's useless to me. Tue, 18 Jan 2005 19:47:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? It's interesting to read the posts from users that cant run Windows as anything as admin. Just because you haven't figured it out doesn't mean it can be done. Where I work our SOE was NT4 with every user as a general user. Seemed to work OK for us. Now we're using XP with users set as general users. Again we can support 400 users who don't have a problem not being admins. I log on to my home machines as a standard user most of the time. So to those of you that can't configure your Windows machines so you can't be admins all I'll say is I'm available for hire. Just because you can't do something properly doesn't mean it's broke. Tue, 18 Jan 2005 21:28:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? By the way. What apps won't run as non admin? I'm not being sarcastic. My home machines have everything and anything installed and my work machines need me to run apps with admin priviledges (for domain rights) so I use the run as and I don't have a problem. Tue, 18 Jan 2005 21:31:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Not for Microsoft, but what about the smaller browsers that get smothered by IE?

Not Microsoft's problem, or responsibility, nor a customer concern. You'll notice most people today aren't wailing in the streets because they no longer have to purchase (in addition to their OS) things like disk defraggers, compression utilities, media players, graphical shells and a whole host of other features that are now a standard part of an OS.

I don't want it.

You're not most customers.

Do you want it?

Quite frankly I don't care. Nothing stops me using Firefox. It doesn't use up any appreciable chunk of my system resources sitting idly on the disk.

I care about as much about IE as I do about notepad, calculator, WMP or the bundled games. Which is to say, not much.

The thing is, the customer don't ask for it, they just get it.

Yep, just like notepad, calculator, WMP, the GUI, a disk defragger, a commandline shell, a filesystem, a bunch of hardware drivers and a myriad other things included in the OS package.

It's kinda like shoving something down someone's throat.

Sure, just like getting a car with seatbelts is having them "shoved down your throat". Don't like 'em ? Don't use 'em. Tue, 18 Jan 2005 22:39:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Reasons to remove it:
1) Competition

Handily disproved by Firefox, Opera, Mozilla, Netscape - not to mention browsers on other platforms.

Also no concern of Microsoft or their customers.

2) No, most customers don't even know that their are alternatives.

That's irrelevant. Customers want to be able to access the web by default. That's what IE gives them.

Customers want to be able to use their hardware by default as well. Interestingly enough, there doesn't seem to be any outrage about the driver library Windows ships with.

3) Developers want a standard. And since IE is on every machine, it is almost considered a standard, only by pure volume.

Exactly, exceptby "standard" they don't mean an open, industry certified, IIIE, ISO, open source, government decreed, god-blessed "standard", they mean something that they can rely on being present on every machine that will run their software.

And no Dr. Smithy, I do not wish to use IE on my system, period. And I know several users who do feel the same way.

So don't. Problem solved.

Do you get similarly hot under the collar about notepad ? How about the CPU scheduler ? Tue, 18 Jan 2005 22:42:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I was recently told that practically everyone at Microsoft has local administrator rights on their PC.

That person was probably referring to an article that was talking about a specific Microsoft department, not the entire organisation. I sincerely doubt the reception staff have Administrator privileges on their PCs.

Additionally, having "Administrator privileges" is a very different thing to "running as Administrator all the time".

But there have to be exceptions for those who need specific applications - we simply don't have the resource to re-engineer those apps, if it's even possible.

This is not sufficient justification for allowing users to run as an Administrator *all the time*. Tue, 18 Jan 2005 22:44:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Every single game I installed had to have their permissions on their program directories changed. I tried RunAs to install as administrator, but it installed it for the administrator and not the account I was under. I tried upping the account to admin for the install, but then it failed when running the game.

All it's doing is putting the program group into the Administrator's Start Menu instead of the "All Users" Start Menu. This is easy to fix (although it is developer error).

The real killer came when I found that the spyware monitoring software I had purchased (SpySweeper) would not work if you were NOT running as admin. Every spyware parogram I could find had this same limitation.

The reasons behind this should (hopefully) be obvious.

Anyway, after trying this for about a month and a half I had to give it up as currently too difficult to maintain (fear of spyware programs alone made me move people back to admin accounts).

If people are using regular accounts they've got little to fear from spyware in the first place. It can't install itself if the user doesn't have permission to install it...

Then there's the whole thing about just not using IE. Tue, 18 Jan 2005 22:49:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? 1) Windows up until XP SP2 has been an insecure OS

FFS. People go on about SP2 like it was some massive change in Windows. It wasn't. Really. It basically just tweaked a couple of default settings and replaced a bunch of system tools and libraries with versions compiled to protect from things like buffer overflows. *There were no fundamental changes made*.

It was designed for use by single users, even though facilities existed for defining multiple users on the same machine.

NT (ie: XP) was designed as a multiuser OS from day one.

2) In order to bring far-reaching security to Windows, 2 things had to be done; either break compatibility with earlier products to provide security or rewrite the OS from the ground up with a security layer built in.

Microsoft chose to add security into an existing OS because the development costs at this point to redo Windows from the ground up would be enormous.

Untrue. Their new OS, designed from the ground up to be multiuser and secure, was NT. Security wasn't "added on" to it afterwards.

Also, development for existing applications (Office, MS Devel Tools, etc.) would have to be redone, adding additional costs.

Also untrue. The changes needed in applications are relatively simple. All they really need to do is not try and write to parts of the filesystem and registry for per-user tasks that have suitable alternatives specified in the user's own writable disk and registry areas.

3) Most software written since the days of 3.1 have been written with FULL access to folders, with no restrictions.

And long before that, as well. This is despite NT having been around since 1993 and the guidelines for writing multiuser-compatible applications existing for the same sort of timeframe.

4) The RunAs feature has had limited if varied success. Many apps (both 3rd party and Microsoft apps) don't run correctly in limited user mode, and the Power User Group isn't apparent in XP home edition or XP Pro editions not logged into a domain.

"Power Users" does not exist in XP Home and this is certainly an omission. It does, however, exist in all versions of XP Pro, as well as Windows 2000.

"Run As" works quite well. IME it works far more often than it doesn't.

Microsoft, understanding their OS wasn't designed for security in mind, slaps a security layer that renders apps unable to run and doesn't develop RunAs to what it should be, because of said legacy OS problems.

The "security layer" of NT is in no way, shape or form "slapped on". It's integral to the design of the entire OS and present in basically every single operation the OS performs.

None of the apps I run for my users will run correctly under the RunAs feature. It's useless to me.

Which apps are these ? Detail how they aren't working. Tue, 18 Jan 2005 22:51:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? What's the reasoning behind IE having a separate set of security setting for each user and allowing even limited users to change those settings??? Shouldn't there be one set of security setting setup by an administrator?

Another thing that annoys me is that a limited user cannot open the date/time applet. I understand that a limited user should not be able to change system time, but I think that the applet should still open, only with Apply and Ok buttons disabled and Cancel button enabled. I ofter use the applet to see, for example, what date last Thursday was. Wed, 19 Jan 2005 05:05:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? well there is no alternative to windows, linux is too much hassle, been using slack but got tired of it Wed, 19 Jan 2005 09:37:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Slackware is not the only Linux OS as your seem to imply. How about Debian, Fedora, Suse, Mandrake to name a few? Thought they share their origins for the kernel, the packages are entirely different. Wed, 19 Jan 2005 10:40:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? tried fedora, suse and the recent mandrake 10.1, although im impressed with mandrake 10.1, its sill lacking in the bluetooth area, and I can't seem to get LAMP working, am developing in XP right now, haven't got any problems with it except the blaster worm Wed, 19 Jan 2005 11:39:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I have been using the limited user to login and RunAs service since Win2K. But if you are careful enough you'll find that the "RunAs" is not the same as "login in as administartor" -- many windoze registry operations are different if you choose "RunAs" instead of do it after login as administrator. (By the way the windoze registry is the stupidest thing from Micro$oft in my opinion). Also someone has mentioned that you can use "RunAs" to run Windows Explorer as Administrator. To summary, "RunAs" makes thing a bit better, but it is far from enough compared with Linux "sudo" facility. Sometimes you have to login as administrator. Wed, 19 Jan 2005 11:43:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? you can use "RunAs" to run Windows Explorer as Administrator


I obviously meant can *not*.

Aslo it is problematic to use "RunAs" ro run IE as administrator, if possible. Wed, 19 Jan 2005 11:46:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? Its a disgraceful state that windows has become.

I can't fathom why people subject themselves to a computing quagmire such as Windows. Wed, 19 Jan 2005 12:11:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? because it works and i get my job done Wed, 19 Jan 2005 14:22:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I see that I am once again in conversation with drsmithy

Comments inline.

1) Windows up until XP SP2 has been an insecure OS

>>>FFS. People go on about SP2 like it was some massive change in Windows. It wasn't. Really. It basically just tweaked a couple of default settings and replaced a bunch of system tools and libraries with versions compiled to protect from things like buffer overflows. *There were no fundamental changes made*.

52 applications acknowledged by Microsoft as having problems running after SP2 sounds like fundamental changes have been made. Core changes to the kernel; probably not. But changes nonetheless that compromise usefulness.


It was designed for use by single users, even though facilities existed for defining multiple users on the same machine.

>>>NT (ie: XP) was designed as a multiuser OS from day one.

You and I will keep going round and round on this.

NT is not a multi-user operating system. A TRUE multi-user operating system allows multiple users to run the same executable on the same machine at the same time. NT did not support multiple users; it supports multiple profiles, and separates multiple links and executables, based on profiles but does not let you run both profiles on the same machine at the same time. (With the exception of Terminal Server)

This is why Unix and Linux are true multiuser operating systems; 2 users can run simultaneously on the same machine and run the same executable at the same time.

Your definition is and will continue to be incorrect.

In previous posts, I have compiled information from known, reliable sources my quoted information, which have proven my statement to be credible, whereas you have provided no information to substantiate your opinion on this definition. Your statement lacks credibility; mine does not. Your opinion without sources is baseless.

2) In order to bring far-reaching security to Windows, 2 things had to be done; either break compatibility with earlier products to provide security or rewrite the OS from the ground up with a security layer built in.

Microsoft chose to add security into an existing OS because the development costs at this point to redo Windows from the ground up would be enormous.

>>>Untrue. Their new OS, designed from the ground up to be multiuser and secure, was NT. Security wasn't "added on" to it afterwards.

Read on:

From the OS/2 history site:

By late 1990, Microsoft had intensified its disagreements with IBM to the point where IBM decided that it would have to take some overt action to ensure that OS/2 development continued at a reasonable pace. IBM, therefore, took over complete development responsibility for OS/2 1.x, even though it was in its dying days, and OS/2 2.00. Microsoft would continue development on Windows and OS/2 3.00. Shortly after this split, Microsoft renamed OS/2 V3 to Windows NT


This wasn't original code from Microsoft; it was shared code from IBM for OS/2.

Your information is inaccurate.

NT4:

No firewall
No blocked ports
No dll protection.

No security.

Yes, you had ACL's and file/folder security built in, but NT didn't have a general security layer to protect the OS from network and or security intrusions.

Also, development for existing applications (Office, MS Devel Tools, etc.) would have to be redone, adding additional costs.

>>>Also untrue. The changes needed in applications are relatively simple. All they really need to do is not try and write to parts of the filesystem and registry for per-user tasks that have suitable alternatives specified in the user's own writable disk and registry areas.

Sounds like a fundamental change in development to me. Which I believe was one of my 3 target areas I specified needed to be changed.

3) Most software written since the days of 3.1 have been written with FULL access to folders, with no restrictions.

>>>And long before that, as well. This is despite NT having been around since 1993 and the guidelines for writing multiuser-compatible applications existing for the same sort of timeframe.

No OS security layer either. No protection against intrusion

BTW Muli-Profile, not multi-user. You keep using this term over again and it is categorically incorrect.


4) The RunAs feature has had limited if varied success. Many apps (both 3rd party and Microsoft apps) don't run correctly in limited user mode, and the Power User Group isn't apparent in XP home edition or XP Pro editions not logged into a domain.

"Power Users" does not exist in XP Home and this is certainly an omission. It does, however, exist in all versions of XP Pro, as well as Windows 2000.

In XP Pro, the Power User function is not listed as a choice without going to classic mode, choosing for Administrator Tools, then Computer Management. I've only seen Power User with Domain connected machines; I haven't seen it with non-domain ones.( I will concede though that it may exist; I haven't seen it myself) Do you really expect an user that has Pro (which many home offices use Pro, not Home) to go hunting for that? I don't.



>>>"Run As" works quite well. IME it works far more often than it doesn't.

Subjectively, that may be true. However, my applications (accounting, ERP, FPGA, compilers, etc.) will not run in any other mode.

Microsoft, understanding their OS wasn't designed for security in mind, slaps a security layer that renders apps unable to run and doesn't develop RunAs to what it should be, because of said legacy OS problems.

>>>The "security layer" of NT is in no way, shape or form "slapped on". It's integral to the design of the entire OS and present in basically every single operation the OS performs.

ACL's yes. OS system level security no. There isn't an effective OS security layer. System files are out in the open, ports are effectively turned on, and until XP SP2, no firewall or other means of intrusion detection.


None of the apps I run for my users will run correctly under the RunAs feature. It's useless to me.

>>>Which apps are these ? Detail how they aren't working.

"You must run this application with a administrator account. Please close the application and try again" is the most common thing I see.

I think that's pretty plain and simple; not a lot of interpretation on that one. Wed, 19 Jan 2005 16:00:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? The reason you can't run Windows Explorer using RunAs is because it is already running all the time--evidenced by the Windows taskbar. A workaround is to launch Internet Explorer viewing the harddrive, instead of a webpage. I use this and it works extremely well, although there are a few very minor differences from a regular Windows Explorer window. Here's how I do it:

1) Create a shortcut/link to the following:
"C:Program FilesInternet Exploreriexplore.exe" -new -e C:

2) In the shortcut's properties, click "Advanced".

3) Choose "Run with different credentials".

Now you will be prompted for a password when running this link. Also, launching any programs using this window will also be run as administrator, so don't leave this window open when you are done with it. Wed, 19 Jan 2005 16:07:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I have been using the limited user to login and RunAs service since Win2K. But if you are careful enough you'll find that the "RunAs" is not the same as "login in as administartor" -- many windoze registry operations are different if you choose "RunAs" instead of do it after login as administrator.

They certainly _shouldn't_ be...

Also someone has mentioned that you can [not] use "RunAs" to run Windows Explorer as Administrator.

You can, it just takes a bit of lateral thinking. You need to start IE as Administrator (which is simple) and then chuck a drive letter (or similar) into the URL path. You're then running (regular) Explorer. Thu, 20 Jan 2005 00:38:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? 52 applications acknowledged by Microsoft as having problems running after SP2 sounds like fundamental changes have been made.

Rubbish. I could break thousands of applications on Windows (or unix) just by changing a few file permissions.

52 apps wouldn't even make up a rouding error in all the apps that run on Windows XP.

No fundamental changes have been made. Unless you've got a *very* generous idea of what constitutes "fundamental". Although I see from further down you have, so to you a firewall defaulting from "on" to "off" probably _does_ qualify as a "fundamental change" in the OS.

NT is not a multi-user operating system. A TRUE multi-user operating system allows multiple users to run the same executable on the same machine at the same time.

NT can do this. Has always been able to. Even ignoring Terminal Server, which additionally allows multiple, simultameous *physical* users, you can demonstrate the OS's capability simply by using "Run As" to fire up two instances of the same application as different users.

When I imagine you *mean* - but not what you're saying - is that you can't have two interactive GUI users at the same time, with some versions of NT. This is a licensing issue, not a technical one. For example, during the SP2 beta some of the licensing restrictions were not enforced and it was possible to have multiple remote desktop users off an XP machine.

NT did not support multiple users; it supports multiple profiles, and separates multiple links and executables, based on profiles but does not let you run both profiles on the same machine at the same time. (With the exception of Terminal Server)

Terminal Server is NT. Stop trying to pretend licensing restrictions are technical restrictions.

This is why Unix and Linux are true multiuser operating systems; 2 users can run simultaneously on the same machine and run the same executable at the same time.

As they can on NT. A "user" is not necessarily an "interactive GUI user".

Your definition is and will continue to be incorrect.

My definition is the one used by Operating System researchers and developers. Yours is the one used by anti-Windows zealots. You can make *DOS* and *Windows 3.x* conform to your definition of "multiuser" with third party tools, but that in no way makes DOS a multiuser OS.

The "user" part of "multiuser" does *not* - and never has - meant actual, physical people.

In previous posts, I have compiled information from known, reliable sources my quoted information, which have proven my statement to be credible, whereas you have provided no information to substantiate your opinion on this definition. Your statement lacks credibility; mine does not. Your opinion without sources is baseless.

I challenge you to find a single source that defines "multiuser" as "able to handle multiple interactive GUI sessions to physical users". Incidentally, by your definition, unix isn't multiuser either unless the users are all running GUI apps.

By late 1990, Microsoft had intensified its disagreements with IBM to the point where IBM decided that it would have to take some overt action to ensure that OS/2 development continued at a reasonable pace. IBM, therefore, took over complete development responsibility for OS/2 1.x, even though it was in its dying days, and OS/2 2.00. Microsoft would continue development on Windows and OS/2 3.00. Shortly after this split, Microsoft renamed OS/2 V3 to Windows NT

Note that the OS/2 2.1 and OS/2 NT codebases were *completely separate*. OS/2 NT was *not* a descendent of OS/2 1.x and 2.x, it was a from-scratch project started by Microsoft.

This wasn't original code from Microsoft; it was shared code from IBM for OS/2.

Actually it was original code from Microsoft. Only Microsoft engineers and developers (Dave Cutler's team) worked on NT.

Your information is inaccurate.

My information is correct. You are deducing false conclusions from insufficient information.

No firewall
No blocked ports
No dll protection.

No security.

Solaris 2.5 didn't do any of that either. Did it have "no security" ? Has security been "slapped on" to Solaris since then ?

Hell, a fresh FreeBSD 5.3 install doesn't do any of that *todaY* - how does it fit into your "security" worldview ?

Yes, you had ACL's and file/folder security built in, but NT didn't have a general security layer to protect the OS from network and or security intrusions.

Yes, it did (and does) and that "security layer" goes a hell of a lot deeper than file ACLs.

You need to pick up a few books on NT's design. Try some univeristy textbooks, nearly all of them use NT as one of the case studies.

Sounds like a fundamental change in development to me.

You have *very* strange idea of what a "fundamental change" is.

No OS security layer either. No protection against intrusion

False.

BTW Muli-Profile, not multi-user. You keep using this term over again and it is categorically incorrect.

No matter how much you repeat it, you cannot change the fact NT is, and always has been, multiuser.

Do you really expect an user that has Pro (which many home offices use Pro, not Home) to go hunting for that? I don't.

I would, actually, assuming they wanted to find it in the first place.

Regardless, XP Pro has the "Power Users" group.

Microsoft, understanding their OS wasn't designed for security in mind, slaps a security layer that renders apps unable to run and doesn't develop RunAs to what it should be, because of said legacy OS problems.

You have no idea what you are talking about.

OS system level security no.

False.

There isn't an effective OS security layer.

There is.

System files are out in the open, [...]

False. They are protected by file permissions, just as they are on other OSes like unix.

[...] ports are effectively turned on, [...]

False. Only true if something is listening on them (unsurprisingly, just like every other OS).

[...] and until XP SP2, no firewall or other means of intrusion detection.

False. XP had a firewall since RTM. Win2k also had port filtering, as did NT4. NT 3.x probably did as well, but that's going way back and I don't recall.

All SP2 did was turn the firewall on by default, bug you if it wasn't turned on and fix a couple of implementation bugs (like the interface becoming active before the firewall rules being put in place).

"You must run this application with a administrator account. Please close the application and try again" is the most common thing I see.

Which applications ? How are you trying to launch them as an alternate user ? Thu, 20 Jan 2005 01:27:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? I'm seeing a de-evolvement here.

This isn't good. For sake of this topic, I'm going to agree that we disagree and leave it at that. Discourse is enlightening, and intellectually interesting, but this is going beyond discourse and becoming counter-productive. Mod me down if this is inappropriate. Thu, 20 Jan 2005 06:03:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? It's not a matter of "disagreement", it's a matter of you being completely and utterly _wrong_ in most of your assertions and conclusions (NT's security, NT's design, NT's history, XP's features, default file permissions, to name a few). Thu, 20 Jan 2005 21:34:00 GMT donotreply@osnews.com (Anonymous) Comments http://osnews.com/thread? http://osnews.com/thread? it'simply not going to happen M$ is all about security!!!(financial that is) or should I say job security.... Wed, 26 Jan 2005 18:45:00 GMT donotreply@osnews.com (Anonymous) Comments