Il laptop indiano è una bufala

Re: 2° falla del UAC di Windows 7.
Ma guarda te che ora mi tocca fare l'avvocato di Microsoft! :-)http://blogs.msdn.com/e7/archive/2009/02/05/update-on-uac.aspx"UAC is one of those features that has a broad spectrum of viewpoints with advocates staking out both ends of the spectrum as well as all points in between, and often doing so rather stridently. In this case we might represent the ends of the spectrum as security on one end and usability on the other. Of course, this is not in reality a bi-polar issue. There is a spectrum of perfectly viable design points in between. Security experts around the world have lived with this basic tension forever, and there have certainly been systems designed to be so secure that they are secure from the people who are supposed to benefit from them. A personal example I have, is that my bank recently changed the security regimen on its online banking site. It is so convoluted I am switching banks. Seriously!""The first issue to untangle is about the difference between malware making it onto a PC and being run, versus what it can do once it is running. There has been no report of a way for malware to make it onto a PC without consent. All of the feedback so far concerns the behavior of UAC once malware has found its way onto the PC and is running. Microsofts position that the reports about UAC do not constitute a vulnerability is because the reports have not shown a way for malware to get onto the machine in the first place without express consent. Some people have taken the, its not a vulnerability position to mean we arent taking the other parts of the issue seriously. Please know we take all of the feedback we receive seriously.""The second issue to untangle is about the difference in behavior between different UAC settings. In Windows 7, we have four settings for the UAC feature: Never Notify, Notify me only when programs try to make changes to my computer (without desktop dimming), Notify me only when programs try to make changes to my computer (with desktop dimming), and Always Notify. In Windows Vista there were only two choices, the equivalent of Never Notify and Always Notify. The Vista UI made it difficult for people to choose Never Notify and thus choosing between extremes in the implementation. Windows 7 offers you more choice and control over this feature, which is particularly interesting to many of you based on the feedback we have received.""The recent feedback on UAC is about the behavior of the Notify me only when programs try to make changes to my computer settings. The feedback has been clear it is not related to UAC set to Always Notify. So if anyone says something like, UAC is broken, it is easy to see they are mischaracterizing the feedback.""One important thing to know is that UAC is not a security boundary. UAC helps people be more secure, but it is not a cure all. UAC helps most by being the prompt before software is installed. This part of UAC is in full force when the Notify me only when setting is used. UAC also prompts for other system wide changes that require administrator privileges which, considered in the abstract, would seem to be an effective counter-measure to malware after it is running, but the practical experience is that its effect is limited. For example, clever malware will avoid operations that require elevation.""Before we started Windows 7 we certainly had a lot of feedback about how the Vista UAC feature displayed too many prompts. The new UAC setting is designed to be responsive to this feedback. A lot of the recent feedback has been of the form of, Ill set it to Always Notify, but regular people also need to be more secure. I am sure security conscious people feel that way, and I am glad that Windows 7 has the setting that works great for their needs. But what do these so called regular people want? How to choose the default, while honoring our secure design principles, for these people is a very interesting question.""In making our choice for the default setting for the Windows 7 beta we monitored the behavior of two groups of regular people running the M3 build. Half were set to Notify me only when and half to Always Notify. We analyzed the results and attitudes of these people to inform our choice. This study, along with our data from the Customer Experience Improvement Program, Windows Feedback Panel, user surveys, and in house usability testing, informed our choice for the beta, and informed the way we want to use telemetry from the beta to validate our final choice for the setting.""A key metric that came out of the study was the threshold of two prompts during a session. (A session is the time from power up to power down, or a day, whichever is shorter.) If people see more than two prompts in a session they feel that the prompts are irritating and interfering with their use of the computer. In comparing the two groups we found that the group with the Always Notify setting was nearly four times as likely to have sessions with more than two prompts (a 1 in 6.7 chance vs a 1 in 24 chance). We gathered the statistic for how many people in the sample had malware make it onto their machine (as measured by defender cleaning) and found there was no meaningful difference in malware infestation rates between the two groups. We will continue to collect data during the beta to see if these results hold true in a much broader study."Sono d'accordo con loro?!Ni.Pero' almeno ho letto l'articolo e le loro motivazioni.