Hacker News Reader

Comment by blub | Hacker News Reader

Vista had excellent security compared to its predecessor, but it never had this kind of sophisticated access control. In any case, within one year they fixed the annoying pop-ups and it was a solid OS, I was using it as my main OS for several years.

Apple's permissions are smarter and the constantly asking for permission does not happen in my experience on macOS. Apparently they've integrated the open file dialog with their access control, so any such dialog will automatically permit the app to access the target file/folder. The pop-ups only appear when an app wants to access specific folders in the background. This is brilliant and would stop e.g. malware which encrypts documents or nosy apps in their tracks!

View on HN

Vista started enforcing the file system conventions people were supposed to follow all along. Things like, don't write config files to the root of C: or dump temp files in C:\Windows

The prompts went away because the apps were fixed. Thanks to the pain Vista went through apps can run without Administrator rights and most apps were ready for Windows 7.

> Things like, don't write config files to the root of C: or dump temp files in C:\Windows

Now half the devs out there write config files to fucking Documents for some reason...

Because Windows hides appdata from users, but many users often want to edit configs. So the devs stick them in Documents.

Is that the reason really? dot-dirs are also hidden by default, yet it is assumed anyone looking for config files knows they lurk beyond the period.

That's a terrible reason, if true. Anyone savvy enough to want to edit config files can figure out how to enable Show Hidden Files or just browse to %APPDATA% in minutes.

I don't use my Documents folder anymore because it's too hard to find actual documents among the dozens and dozens of misplaced config folders.

Windows application developers in general have a long track record of disregard for the user’s filesystem and other visible shared resources. Let them modify the user’s start menu and they dump a folder there with their company's brand name there and fill it with crap. Let them populate the Add/Remove Programs list and they’ll fill it with all kinds of incomprehensible stuff (even MS itself is horrible here, polluting it with MSVC Runtime This, and SQL Server That...)

It should be no surprise that developers choose to dump non-documents into the user’s Documents folder.

Adobe is the only one who does this crap in macOS on my system. They put 3 folders in Applications and on top of that put some more in Utilities. I see like 7 icons just for 1 app (2 if you count the subscription manager app).

Their attitude being the monopoly is just annoying.

Also all the games that now dump save files there.

Well, that I can understand. Save files are documents, as far as I am concerned (I used to back them up Just In Case while playing).

For RNG/permadeath games like Don't Starve, the save file better be safe.

We addressed this by adding a "Folders" tab to our About box which lists configuration, plugin, and other paths relevant to the application. Users can open a folder by double-clicking on it.

~/Library is normally hidden too, but that doesn't stop NSUserDefaults from sticking things there.

> Apparently they've integrated the open file dialog with their access control, so any such dialog will automatically permit the app to access the target file/folder. The pop-ups only appear when an app wants to access specific folders in the background. This is brilliant and would stop e.g. malware which encrypts documents or nosy apps in their tracks!

This pattern is called "powerbox", an idea from object capability security. I'm sure there are plenty of other usability improvements in there if you study those ideas (more so the more important security is to your application). Applying it to the web is getting easier with Mark Miller's JS standardisation work and (also his) https://agoric.com/ and https://ocapjs.org/

I've never heard about this powerbox thing, but webpages have worked like this - being able to access only files from a file picker - for decades, so I'm sure that's where they took the idea from.

It's not surprising considering Powerbox has no API and I think this might be one of the few official mentions of it: https://developer.apple.com/library/archive/documentation/Se...

Ah! So given the language (explicitly using the word powerbox), it does seem a very good bet that whoever introduced this at Apple was at least aware of the work, and perhaps directly inspired by it.

I don't know the answer to that historical question (shaky data point: though I know Brendan Eich is a bit of a capability convert, I believe that's relatively recent thing: last decade or so?). Regardless of the answer, I'd agree if you said that the world seems filled with people reinventing capability ideas not as effectively as they could, because they don't know that that's what they're doing and so are cut off from the ideas that have developed in the small cap community over the decades.

This isn't really about files, though. Capability UI patterns are about composing all kinds of authority in a usable way. I'm sure we'd all agree that accessing files isn't the best or ultimate description of the interesting things that people do with computers now. This is an area that's waiting to be rediscovered by the rest of the world.

Of course, I don't intend to say that vista had anything that comes close to the modern day sandbox. However, it did enforce strict security policies that its predecessors didn't have. UAC and up to some point smart screen is comparable to the sandbox permissions and the notarising thing. It's an inconvenient break in compatibility, dialog flow and program design that has a lot of benefits and some downsides. Until programs adapt to the new paradigm, old programs will likely be slightly annoying to use, just like what happened in the Vista days.

I hope Apple doesn't solve the dialog problem the way Microsoft did though (by sacrificing security for usability), now we have the situation that being logged in as a local admin with UAC set to default means that any malware can gain admin privileges through UAC bypasses. You can prevent this by setting the UAC settings to max or logging in as a standard user, but then you get Vista-style annoyances again...

> You can prevent this by setting the UAC settings to max or logging in as a standard user, but then you get Vista-style annoyances again...

And I'm not even sure UAC at max level is officially a security boundary. As for the second solution, yep, and you actually could also log in as a standard user in XP (and 2000, and NT)

Now there is a fun thing about security, is that it can be sometimes counter-intuitive. A yes-no popup on a secure desktop can be way more secure than asking for a password in some cases, because the popup screen could be spoofed, and while obtaining an admin pwd is obviously valuable, obtaining a yes-no answer from the user at the console is not... (Some mitigations exists like SAK but they are not perfect, because the users can make mistakes, especially if asked for their password all the time)

I run a security program called Comodo Internet Security on Windows 7 (admin). It have a feature that blocks all new software from starting, downloading to accessing the filesystems important folders and files. It also blocks software from accessing internet. It can be a bit dialog heavy until you have set it up. It is a good software when you have configured it properly. Have never had anyone break in via internet nor any malicious software issues. Although Ive got common sense when it comes to what is safe to download but still I like Comodo (most of the time).

When the OS cant deliver you can find software that do. So why the whining about the OS security? For example the first thing I install is a proper Firewall >with advanced configuration control<.

Comodo even stopped the malicious Windows 10 update with malicious dialog design hiding how to close it and a delay timer so it can start the update without user consent. Comodo is not supposed to stop updates to but my configuration must have been why it did. And we all know that malicious updateS liked to remove personal files and software installed by the user. Im thankful for comodo. I later disabled the malicious updateS (since there were many attempts to make it run, they changed the update name several times). Nasty and malicious indeed.

Because you are an exceptional user. The average computer user will never install or be willing to work to configure any extra security software, especially something which takes that much work. To protect everyone, and to keep the flow of malware to a minimum, we need to have security for everyday users like my sister, who just wants to write up her latest site report and deal with the email that's flooding in about the next conference.

MS "fixed" Vista UAC by making it unsound and not a security boundary in 7. Now I'm not even sure it was a security boundary in Vista, but when you look at the technical way it is implemented and the additions it came and work with at the ACL level, it was probably at least initially intended to be by their designers.

If anything UAC is a good case to show how security must come with usability, otherwise you just don't get much in the end...

The end result from a technical point of view; well obviously better than nothing, but never count on it. It is actually way more useful to avoid casual mistake than for security purposes.

I disagree. I think UAC (or at least the prompt part) is actually worse than nothing. UAC has poisened a generation of users to just click yes, because security is way too big of a hassle.

We are not mainly talking about the same thing, but on the specific subjet you evocate I actually kind of agree with you, and that was in a way what i meant by stating that security must come with usability. However, I'm not sure about how you can come to your "worse than nothing" conclusion, from a security point of view. Sure if the model let the user authorize nearly anything, they have the power to do it. Sure, if this englob both bening and potentially dangerous modifications, the user can be desensitived. BUT if it still technically achieve its designed purpose, then it is better than nothing in the sense that by nothing, I meant that it would be equivalent as if "yes" was implied all the time. And I find it hard to make the case that mandatory yes all the time and complete lack of access control is better than giving the choice...

Reply on news.ycombinator.com