Comment by jeroenhd | Hacker News Reader

Comment by jeroenhd | Hacker News Reader

Parent Full thread

Of course, I don't intend to say that vista had anything that comes close to the modern day sandbox. However, it did enforce strict security policies that its predecessors didn't have. UAC and up to some point smart screen is comparable to the sandbox permissions and the notarising thing. It's an inconvenient break in compatibility, dialog flow and program design that has a lot of benefits and some downsides. Until programs adapt to the new paradigm, old programs will likely be slightly annoying to use, just like what happened in the Vista days.

I hope Apple doesn't solve the dialog problem the way Microsoft did though (by sacrificing security for usability), now we have the situation that being logged in as a local admin with UAC set to default means that any malware can gain admin privileges through UAC bypasses. You can prevent this by setting the UAC settings to max or logging in as a standard user, but then you get Vista-style annoyances again...

I run a security program called Comodo Internet Security on Windows 7 (admin). It have a feature that blocks all new software from starting, downloading to accessing the filesystems important folders and files. It also blocks software from accessing internet. It can be a bit dialog heavy until you have set it up. It is a good software when you have configured it properly. Have never had anyone break in via internet nor any malicious software issues. Although Ive got common sense when it comes to what is safe to download but still I like Comodo (most of the time).

When the OS cant deliver you can find software that do. So why the whining about the OS security? For example the first thing I install is a proper Firewall >with advanced configuration control<.

Comodo even stopped the malicious Windows 10 update with malicious dialog design hiding how to close it and a delay timer so it can start the update without user consent. Comodo is not supposed to stop updates to but my configuration must have been why it did. And we all know that malicious updateS liked to remove personal files and software installed by the user. Im thankful for comodo. I later disabled the malicious updateS (since there were many attempts to make it run, they changed the update name several times). Nasty and malicious indeed.

Because you are an exceptional user. The average computer user will never install or be willing to work to configure any extra security software, especially something which takes that much work. To protect everyone, and to keep the flow of malware to a minimum, we need to have security for everyday users like my sister, who just wants to write up her latest site report and deal with the email that's flooding in about the next conference.

> You can prevent this by setting the UAC settings to max or logging in as a standard user, but then you get Vista-style annoyances again...

And I'm not even sure UAC at max level is officially a security boundary. As for the second solution, yep, and you actually could also log in as a standard user in XP (and 2000, and NT)

Now there is a fun thing about security, is that it can be sometimes counter-intuitive. A yes-no popup on a secure desktop can be way more secure than asking for a password in some cases, because the popup screen could be spoofed, and while obtaining an admin pwd is obviously valuable, obtaining a yes-no answer from the user at the console is not... (Some mitigations exists like SAK but they are not perfect, because the users can make mistakes, especially if asked for their password all the time)

Reply on news.ycombinator.com