Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Thor (Hammer of God) (thorhammerofgod.com)
Date: Fri Aug 28 2009 - 08:39:14 CDT
> On Thursday 27 August 2009 13:33:37 Thor (Hammer of God) wrote:
> > But that's the same on my Mac and Ubuntu distro too. The first user
> is the
> > admin. Granted, the default behavior on Mac/nix requires the admin
> > password
> That's a big difference. Entering a password counts as more of a
> Having seen my co-workers on their home machines, it's pretty clear
> that it's
> too easy to click OK without thinking. Entering a password, especially
> the prompt doesn't occur as often as the UAC prompt is a more
> action. Personally, I prefer arrangements where the administrator uses
> separate password. Not only do you need a password, but it's a
> different one.
> It's seldom used. The end user probably has to go look it up. I'm not a
> fan of sudo.
Right - which was my original point. Only if you are running as admin do you get the UAC "confirm" dialog (by default). I always run as a regular user, and must enter an admistrator username and password when I need to escalate. Even if you are running as admin, you still get the dialog, but you can certainly change that if you want to require an admin username and password. The point still stands: if you have ignorant users who won't read anything, but you insist on letting them run as admin (which is just crazy in the first place) then change the behavior of the UAC. They, of course, should be running as normal user anyway. Again, it's all in what you want. You can remove the UAC completely if you want to, but there's no feasible excuse to hold on to the "they running as admins, but won't read anything, and won't ever read anything, but we're going to let them continue to be admins even though they're stupid, but will still contend that it's the OS's fault" mindset.
If the entire argument is around the default escalation behavior being "enter a password" (which they already know) vs clicking OK because you assume entering the password is more of a deterrent, then OK, but the premise of "the people I work with are too stupid to know the difference" kind of takes away from that. And one should also note that in a domain environment, the default behavior is indeed username and password. Just thought I'd throw that in as well.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/