Hacker News Reader

Comment by mikewarot | Hacker News Reader

Why does anyone run an operating system that grants ambient authority to executables?

This is analogous to a power grid stripped of all fuses and circuit breakers to make it easier to design toasters.

We've studied this problem since 1972[1]. Solutions were found (but the Internet Archive is down, so I can't be sure [2] points to the right files now).

[1] https://csrc.nist.rip/publications/history/ande72.pdf

[2] https://web.archive.org/web/20120919111301/http://www.albany...

View on HN

People had drawn and quartered Microsoft because of simple access elevation prompts (UAC) in Vista, let alone a granular permissions system. It had to be dumbed down significantly over the years to be widely accepted.

People have been doing the same for Apple when it tried to bring explicit app permissions to MacOS. https://tidbits.com/2024/08/12/macos-15-sequoias-excessive-p...

What Apple are doing is significantly worse than UAC.

What Apple is doing is significantly better. Instead of a single popup that grants access to everything and shows before the app even opens. You can granularly accept or deny individual access to things. And the program keeps working when you decline.

Yeah, it’s annoying, but it’s the right thing in this day and age. Condoms are annoying too, but often necessary.

Okay, but permission prompts as such are not why people complained. Sure, of course you don't want apps to record your screen without permission. The problem is Apple has taken away your right to even grant this permission, for more than a week, unless they also consent (and extract a fee from the app developer). It's part of their ongoing frog-boiling campaign to remove users' freedom to run arbitrary software on Macs; this is what people object to.

You can make an argument that UAC was part of a similar strategy, but not paying for an EV certificate only results in a one-time annoyance for your users, not a continuous one. UAC is equivalent to Gatekeeper. This permissions nonsense is worse than UAC.

You can't just present the user with something that amounts to a "Press OK to continue" dialog, and call them stupid when they press OK, and call them whiney when they think it's annoying.

That's lazy design, and it doesn't work.

Money wouldn't be practical if it was always

  Do you want to give your wallet to the cashier? (Yes/No)

Computers don't have to be that stupid about it, it was someone inside Microsoft being passive aggressive instead of actually doing their job and presenting useful options at runtime, that resulted in the horror that was UAC.

We can all agree UAC and permission flags suck.

> Money wouldn't be practical if it was always ...

and yet, most ecommerce shops easily remember the credit card on file (amazon, steam, etc), and you literally can one click buy.

It's insane that the intelligence community spends billions of dollars but none of it has gone towards a usable secure desktop operating system.

Maybe it’s because having the broken systems in use sometimes (often?) benefits the intelligence community.

It only does until someone gets killed by it.

The US intelligence community cares about that? All evidence points to them not caring about who gets killed.

Getting your sources killed significantly setbacks intelligence collecting activities.

Qubes OS exists, albeit it wasn't created by the intelligence community: https://qubes-os.org.

My comment was about funding.

I would imagine these tools use exploits in the existing executables to deliver the payload, and then - if I understand correctly, use scripting/interpreted languages (Python) to run the operation.

So, even if you’d need admin confirmation to run each new binary, it wouldn’t help - because no new binaries are executed, just python with a new set of scripts.

And, correct me if I’m wrong, but preventing os from running new scripts would be virtually impossible.

It used to be you could put a file called autoplay on a USB drive and it would get executed on insertion.

AFAIK it only worked with optical drives, not pendrives. I've spent hours trying to get this functionality on my pendrives back in the day, to no avail (thankfully!). It was on Windows XP, and Windows 98 needed external drivers to even use pendrives at all, so if such an attack vector existed, it must have been on Windows 2000 or Me (i.e between XP and 98), so an arguably very short time frame (if at all!).

You could/can have the USB device appear as a CDROM

I recall Disk Knight (https://www.lucadamico.dev/papers/malware_analysis/DiskKnigh...) working on Windows XP

I don't remember the whole details, but I believe it installed an autorun.inf file on all USB drives so that inserting the drive on another PC would install it automatically.

Reply on news.ycombinator.com