Untruths about UAC

If you follow my blog you may have read several posts that I've written about Vista's User Account Control (UAC). In these posts I expressed several criticisms of UAC, but overall my approach has been positive. UAC isn't perfect and it’s annoying (by design), but it is certainly a step in the right direction. Moreover, I think that Microsoft should be given credit for its willingness to take some significant punches for the sake of improved security (I believe that they expected to get clobbered, just not the extent of the clobbering).

UAC doesn’t only annoy end-users, it can also aggravate software developers. This is because things that used to be easy under previous versions of Windows can be much more difficult when UAC is enabled. The reason for this is simple: when using previous versions of Windows workstations you could often code your applications with the assumption that they will run with administrative privileges and will be able to do whatever they wanted. The problem was that malware developers could make the same assumption. With UAC this is no longer the case - applications do not have administrative privileges unless an administrator specifically and expressly gives it to them.

We at Ericom had to invest significant resources in order to properly support UAC, resources that we could have utilized to implement additional features and functionality. And yet, at the end of the process, we discovered that in many cases implementing the changes required by UAC made our products more robust and secure.

This is why I’m extremely annoyed by the misleading and inflammatory article written by the developers at NeoSmart Technologies. Basically they are complaining because UAC forced them to implement the correct architecture they should have utilized from the get-go! Separating their application into a UI component that doesn’t require administrative privileges and a service that performs the restricted operations is simply proper design. One can only hope that they've implemented appropriate security mechanisms in the communication protocol between these two components, but given the tone of the article I'm highly doubtful.

Unfortunately this has been picked up by Slashdot, which is only too happy to promote the supposed victory of the "heroic" free software developers over "evil" Microsoft. What drivel ...