![]() |
![]() |
|
December 27, 2006Disappointment in VS2005 SP1 on VistaWell, I installed SP1 of Visual Studio 2005 yesterday on my laptop running Vista, and I have to say there was one think that really disappointed me. So much so that I am not just going to blog about it... I want everyone that reads this to go AGAINST Microsoft recommendations. Here is what I mean: Thats right.... Microsoft is recommended to run Visual Studio as Administrator. NO. NO. NO. NO. NO. Don't do this!! You are on Vista. You should be running as a Standard User, and running Visual Studio as a standard user. Why? Because then you can SEE how your application will work while in least privilege mode AS you develop the software. Now, some people will complain that they need to be administrator because they need some of the tools in the IDE. A good example would be if you are writing a COM component. You cannot register the library when running as a standard user. Is there a solution? Yes. Open up a cmd window as Administrator and do it by hand. Don't like that idea? Have a post build event that runs a custom app to do it... and modify the manifest to REQUIRE the UAC elevation. This way, you elevate a separate process to do your administrative task without requiring the IDE to be run with higher privileges that you really don't need. And NOTHING prevents you from starting a second copy of VS2005SP1 elevated in those cases where you really have to debug as Administrator. But for your day to day use of VS... DON'T run elevated!!! I am really surprised and disappointed to see this dialog. I only hope Microsoft reconsiders this position in its next version. If they REQUIRE admin privs for some tools, separate them out so only they have to be run as Administrator. You should only elevate when you need to; you should try to run with least privilege throughout the entire development process so you can REALLY see the impact of the code on normal users. Well, IMNSHO anyways. Posted by SilverStr at December 27, 2006 08:28 AM | TrackBackComments
Hi Dana, Yet another case of Microsoft not having a clue about security. When Microsoft builds an OS from the ground up with security as a core component, then and only then will they start to get an idea what security is all about. Giving out recommendations like this, well, its scary. I wonder why they didn't also give the instructions on how to disable UAC in that message box! Disappointing. Posted by: HiltonT at December 28, 2006 12:24 PMDana, Visual Studio SP1 is still in beta. I'm not trying to explain away this atrocity, but please, file a bug on it! There is still time to fix it before they release it. Posted by: JJ at December 29, 2006 09:29 AMDana, like I said over on Michael Howard's blog (not sure if you're still reading the comments there), I believe that specific "Update for Windows Vista" is what addresses this problem. Once you install the update for Windows Vista, you should no longer need to run Visual Studio as an administrator. I remember that they had planned on making this Vista update part of SP1, but due to time constraints it didn't get in and that's why there's a second update. Posted by: Dean Harding at January 2, 2007 03:22 PM |
![]() ![]()
My 5 Favorite Books
Writing Secure Code
Secure Programming Cookbook Security Engineering Secure Coding Principles & Practice Inside the Security Mind ![]()
My 5 Favorite Papers
Smashing the Stack
Penetration Studies Covert Channel Analysis of Trusted Systems DoD Trusted Computer System Evaluation Criteria NSA Security Recommendation Guides ![]()
Archives
June 2008
April 2008 January 2008 December 2007 November 2007 October 2007 September 2007 August 2007 July 2007 June 2007 May 2007 April 2007 March 2007 February 2007 January 2007 December 2006 November 2006 October 2006 September 2006 August 2006 July 2006 June 2006 May 2006 April 2006 March 2006 February 2006 January 2006 December 2005 November 2005 October 2005 September 2005 August 2005 July 2005 June 2005 May 2005 April 2005 March 2005 February 2005 January 2005 December 2004 November 2004 October 2004 September 2004 August 2004 July 2004 June 2004 May 2004 April 2004 March 2004 February 2004 January 2004 December 2003 November 2003 October 2003 September 2003 August 2003 July 2003 June 2003 May 2003 April 2003 March 2003 February 2003 January 2003 December 2002 November 2002 October 2002 September 2002 August 2002 July 2002 ![]() |
|