Linked by Thom Holwerda on Thu 24th Jul 2008 22:04 UTC
As someone who uses Windows Vista practically daily, I've always wondered where all the negativity in the media comes from. Sure, Vista isn't perfect (as if any operating system is), but I just don't see where all the complaints are coming from. It runs just fine on my old (6 years) machine, all my software and hardware is compatible, and it's stable as a rock. Microsoft has been wondering the same thing, and after a little test, they may have found out why people seem to dislike Vista so much.
Thread beginning with comment 324516
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
Member since:2007-02-27
What is so hard about UAC running an md5 against the exe file in question.
IT'S NOT POSSIBLE!
First example:
1. user executes destroy.exe: UAC prompt, user clicks on "always consent"
2. malware executes destroy.exe, no prompt because the exe is the same.
-> you're pwned!
Second example:
1. user changes a firewall rule: UAC prompt, user clicks on "always consent"
2. malware changes a firewall rule, no prompt because the firewall configurator executable is the same.
-> you're pwned!
Third example:
1. user copies a file in c:\windows using windows explorer: UAC prompt, user clicks on "always consent"
2. malware copy a trojan in c:\windows, no prompt because the copy command executable or the explorer.exe is the same.
-> you're pwned!
Edited 2008-07-25 08:31 UTC
Member since:2005-07-06
What is so hard about UAC running an md5 against the exe file in question.
IT'S NOT POSSIBLE!
First example:
1. user executes destroy.exe: UAC prompt, user clicks on "always consent"
2. malware executes destroy.exe, no prompt because the exe is the same.
-> you're pwned!
IT'S NOT POSSIBLE!
First example:
1. user executes destroy.exe: UAC prompt, user clicks on "always consent"
2. malware executes destroy.exe, no prompt because the exe is the same.
-> you're pwned!
Incorrect. End user loads it once, knows that it is an application he or she wants to use on a constant basis - heck, it could be their very own application they've written.
If you do an md5, compare the result of the stored one to the one done at the execution of the application - if malware has through some way replaced the legitimate file with something bad - the md5 comparison will fail and a warning along the lines of "exe has failed security check, file possibly compromised, excution haulted".
Second example:
1. user changes a firewall rule: UAC prompt, user clicks on "always consent"
2. malware changes a firewall rule, no prompt because the firewall configurator executable is the same.
-> you're pwned!
Third example:
1. user copies a file in c:\windows using windows explorer: UAC prompt, user clicks on "always consent"
2. malware copy a trojan in c:\windows, no prompt because the copy command executable or the explorer.exe is the same.
-> you're pwned!
1. user changes a firewall rule: UAC prompt, user clicks on "always consent"
2. malware changes a firewall rule, no prompt because the firewall configurator executable is the same.
-> you're pwned!
Third example:
1. user copies a file in c:\windows using windows explorer: UAC prompt, user clicks on "always consent"
2. malware copy a trojan in c:\windows, no prompt because the copy command executable or the explorer.exe is the same.
-> you're pwned!
If you are going to compare, don't be dishonest and quote only the first half; the issue was addressing a specific question; the specific question was a specific executable file. It didnot involve file copying, it didn't involve anything else. It involved running one piece of software and the contious asking whether its ok to run it because it isn't signed.
The issue has NOTHING to do with UAC, because it isn't UAC querying the end user. This security check exists on Windows XP to; if you choose to run something downloaded via the internet from the download window - when one clicks on 'open', one is faced with the same question.
Edited 2008-07-25 09:36 UTC
Member since:2006-12-16
News
Linked by Thom Holwerda on 05/25/13 0:45 UTC
"So in summary... Google has pulled the plug on support on a protocol they've helped popularize, after years of promising interoperability, for reasons that are dubious at best, and in a way that leaves people who don't jump to the new Hangouts app unable to talk to their contacts without any feedback that their IMs aren't getting through... And they've done that with no warning to anyone. I imagine there's a bunch of people out there wondering where some of their buddies have gone, or why their messages aren't getting responses, because this isn't documented anywhere." Google really messed this up. Such a dick move.
Linked by Thom Holwerda on 05/24/13 23:59 UTC
The Tizen Greek Community has some screenshots of a very recent build of Tizen running on a Samsung GT-i8800. It looks wholly unremarkable.
Linked by Thom Holwerda on 05/24/13 22:33 UTC
Joint statement to The Next Web from Microsoft and Google: "Microsoft and YouTube are working together to update the new YouTube for Windows Phone app to enable compliance with YouTube's API terms of service, including enabling ads, in the coming weeks. Microsoft will replace the existing YouTube app in Windows Phone Store with the previous version during this time." Good to know these children stopped acting like little pricks. Can we have full Google support in Windows 8 now, please?
Linked by Howard Fosdick on 05/24/13 21:41 UTC
Yahoo is acquiring Tumblr, the microblogging and social networking website, for $1.1 billion USD. Tumblr offers little revenue but lots of eyeballs if Yahoo can monetarize them. Now Yahoo is bidding for Hulu, the streaming video service. After years of ineffective responses while Google, Facebook, and others took large chunks of the online advertising market, Yahoo is fighting back. Can Yahoo reignite the momentum it had at the turn of the century? What do you think?
Linked by Thom Holwerda on 05/24/13 14:44 UTC
"Sources have described iOS 7 as 'black, white, and flat all over'. This refers to the dropping of heavy textures and the addition of several new black and white user interface elements." I couldn't be happier.
Linked by Thom Holwerda on 05/23/13 23:22 UTC
"Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues."
Linked by Thom Holwerda on 05/23/13 22:04 UTC
"Google is facing a new antitrust probe by the U.S. Federal Trade Commission into whether the company is using its leadership in the online display-advertising market to illegally curb competition, people familiar with the matter said." Sucks to be Google today, apparently.
Linked by Thom Holwerda on 05/23/13 22:01 UTC
"In the midst of the major press blitz surrounding its annual I/O Conference, Google dropped some unfortunate news about its instant messaging plans. In several places around the web, the company is replacing the existing 'Talk' platform with a new one called 'Hangouts' that sharply diminishes support for the open messaging protocol known as XMPP (or sometimes informally Jabber), and also removes the option to disable the archiving of all chat communications. These changes represent a switch from open protocols to proprietary ones, and a clear step backward for many users." That's why I always say: only suckers trust companies.
Linked by Thom Holwerda on 05/23/13 17:52 UTC
"The wave of departures is a sign of internal struggle, but amidst all the bad news, there is a glimmer of hope. According to an anonymous HTC executive cited by WSJ, the crucial HTC One is selling 'pretty good so far'. The executive revealed that HTC sold about five million One units since launch, a performance that is deemed encouraging. However, sales have been limited by the persisting supply issues that still plague the production of the HTC One." Finally some good news for HTC. Five million units amidst supply constraints is very impressive.
Linked by Thom Holwerda on 05/22/13 22:23 UTC
"Sony gave the PS4 50% more raw shader performance, plain and simple (768 SPs @ 800MHz vs. 1152 SPs & 800MHz). Unlike last generation, you don't need to be some sort of Jedi to extract the PS4's potential here. The Xbox One and PS4 architectures are quite similar, Sony just has more hardware under the hood. Weâll have to wait and see how this hardware delta gets exposed in games over time, but the gap is definitely there. The funny thing about game consoles is that itâs usually the lowest common denominator that determines the bulk of the experience across all platforms. On the plus side, the Xbox One should enjoy better power/thermal characteristics compared to the PlayStation 4. Even compared to the Xbox 360 we should see improvement in many use cases thanks to modern power management techniques." AnandTech does its usual in-depth thing.More News »
Sponsored Links
Member since:
2005-07-06
[q]The reason why you can't say "yes, and don't ask me again" is because the next time it comes up, it might be caused by something malicious.[/quote]
Did you read the whole request, he wants it on a per-application basis. What is so hard about UAC running an md5 against the exe file in question, store the result of that exe so that the next time it is loaded it is just a matter of a quick check against the stored md5 to see if it is the same exe - and allow the application to run?
Geeze, I thought of a solution just then that addresses the fundamental problem and the perceived security implications in under a minute. It isn't rocket science - just good old fashioned commonsense.