8 ms·

So what’s interesting is MS say that UAC isn’t a security boundary. Which is some users to admin. Then they say admin to kernel (in this case) isn’t a security

So what’s interesting is MS say that UAC isn’t a security boundary. Which is some users to admin. Then they say admin to kernel (in this case) isn’t a security boundary. While also saying that driver signing enforcement is a security feature. Which is what’s being bypassed here. But they claim in this case it’s not crossing a security boundary. Please make sense.

prettyStandard 2y ago
This is a value system disagreement. I have a theory that there's basically two types of disagreements, disagreements on definitions, and disagreements on value systems. In this case Microsoft values downplaying this issue, so when that is at the top of their value system their decisions should make sense following that. Since this is just a pet theory I'm very interested to hear critiques on it. Disagreements on definition are a little bit easier, because then you can just talk about the definitions and resolve your differences there... For example let's say IDK You're trying to sort out how to design a software system, and everyone is speaking in terms of design patterns, but they haven't yet spelled out the details of what those designed patterns are, then that could probably lead to a lot of confusion if when you say A I think of A', and another person is thinking of A''.
- Buttons840 2y ago
  I like this. I first noticed this with gay marriage. Some would say "gay people should be able to do what they want and form 'civil unions' with all the tax and contractual benefits and requirements of marriage, but they shouldn't be able to get 'married'". For these people, it was all about the definition of a word. Other people opposed gay marriage because it went against their values. No matter what you wanted to call it, they were opposed to gay people living together and sharing their lives. I chose this example because it's the first time I noticed that some disagreements are about the definition of a word, and it's an especially clear example of that. It's silly how huge disagreements about a single word can become. There are also people who disguise their value disagreement as a definition disagreement. This is a form of bad faith arguing.
  - BJones12 2y ago
    I think your example is accurate. I think there's another example around trans-vocabulary: The analog of the 1st half is "I'm not going to stop you from cutting off your man bits, but don't expect me to call you a 'woman'. 'Trans woman' is ok because that's a new word, but 'woman' already has a meaning and don't try to change it." The analog of the 2nd half is "You shouldn't do that because you're a man and you need to act like one." Or perhaps it's an affront to nature or the divine.
    - whatshisface 2y ago
      Some of this may be due to a desire to transform an illicit desire for authority ("I declare that I shall not pay out a bounty") into a legitimate contest ("this bug is not a bug because I desire to clarify our communal understanding of the concept of a bug...").
    - jjjkjjkl 2y ago
      Difference between the first and second there is basically the dividing line between the gender-critical feminists and the conservatives, on this topic.
  - DrillShopper 2y ago
    > Some would say "gay people should be able to do what they want and form 'civil unions' with all the tax and contractual benefits and requirements of marriage, but they shouldn't be able to get 'married'". > Other people opposed gay marriage because it went against their values. This difference does not matter - the outcome was the same. Stop treating bigots with kid gloves.
- hggigg 2y ago
  It makes sense if Microsoft's strategy is having a flexible self-serving value system.
- layer8 2y ago
  This assumes Microsoft being a singular entity with a single set of values (or even a single set of definitions), which I believe is an incorrect premise. It’s misleading to think of organizations as if they were a single mind. (Not to speak of the fact that it’s quite common even for singular minds to have inconsistent values and beliefs.)
- rawgabbit 2y ago
  Socratic logic argues you must first agree on the meaning of terms and definitions. Next is determination of what the facts are. Lastly is logical arguments. Guess which part is the most difficult? Religious logic is like this. It presupposes a greater mystery that has been partially revealed to us. It also presupposes that our fallible logic cannot on its own understand the truth. In other words it defines faith as believing in the greater truth even if the world and every one says we are foolish to believe in such fairy tales.
  - prettyStandard 2y ago
    I think that's helpful for me and my theory. Informed by Socrates I will refine my theory. O:-) There's three forms of disagreements. 1. Disagreements on definitions 2. Disagreements on facts Kind of hard to disagree on logical implications 3. Disagreements on value systems Not to be dense, which is most difficult?
    - rawgabbit 2y ago
      Facts are the most contentious because the disingenuous will argue that’s not how they interpret term xxx. Even if you call them out for switching meaning during the argument, they will claim they had a mental lapse and say they really mean yyy.
- dataflow 2y ago
  > This is a value system disagreement. Sorry, this is not a value system disagreement. It's definitions, pure and simple. As I mentioned in my sibling comment, the definition (and thus boundary) has been pretty sharp and clear for decades: the user group. If you're a standard user, such as in the "Users" or "Guests" groups, you're behind the boundary. If you're in the "Administrators" group, you're already past it. That's all there is to it.
  - prettyStandard 2y ago
    I see what you're saying... I think the sibling comment accidentally put it better. > There are also people who disguise their value disagreement as a definition disagreement. Or maybe even more to the point: they are twisting their definitions to support their values. I think we can agree on this.
    - dataflow 2y ago
      >> There are also people who disguise their value disagreement as a definition disagreement. > Or maybe even more to the point: they are twisting their definitions to support their values. I think we can agree on this. I take it you're insinuating I'm one of these people here? Hasn't group membership been the defining security boundary in Windows for over two decades?
  - pdonis 2y ago
    > this is not a value system disagreement. Yes, it is. The issue is not that people don't understand how MS defines what is and is not a security boundary. The issue is that MS's definition is for the benefit of MS, not for the benefit of the user. That's a value system disagreement.
    - dataflow 2y ago
      > The issue is not that people don't understand how MS defines what is and is not a security boundary. That's a communication failure, not a value system disagreement. > The issue is that MS's definition is for the benefit of MS, not for the benefit of the user. That's a value system disagreement. Just because two entities differ on their values that doesn't mean everything they disagree on is their values. In this case, the fact that users and Microsoft differ on what constitutes a security boundary is 100% a definitional disagreement. Now MS obviously has had their own values and reasons for not establishing other security boundaries people would like, and that is a value system disagreement. But even if their values agreed with yours and they hated the current design just like you, the fact of the matter would still be that user account groups are the boundaries in the current design, and that would still imply this isn't crossing a security boundary, making the disagreement on that definitional.
quotemstr 2y ago
UAC in practice doesn't function as a security boundary, and to make it one would so inconvenience users that they'd just go to other OSes. Both UAC and sudo are just OS level cookie dialog boxes. Let's get rid of all three. We need to give up on the UAC/sudo/etc. style of user based privilege escalation and instead sandbox apps, not users, just like Android and iOS do.
- BSDobelix 2y ago
  >sandbox apps This is about drivers...
  - quotemstr 2y ago
    1) drivers should be apps too (Redox and others (even macOS partially) get this right) 2) driver vulnerabilities are there regardless of user setup. Making a user click a UAC button doesn't make the vulnerability disappear
    - cruffle_duffle 2y ago
      Drivers can be whatever but their effect is usually global not for a specific user or app. So when you update, say, a graphics driver you are updating a shared resource used by everything in the system. You can run that display driver in whatever security context you want be it “root” or its own constrained context but that doesn’t change the fact that other things in the system, running under their own security contexts, are feeding that driver stuff. And given there is generally only one display output, or sound output, or whatever, all things in the system have to use it for output, making it more privileged than the rest. Whatever security context a display driver runs in, that context by requirement has to be more privileged than whatever context your browser or a calculator app runs in. To make changes to that shared display driver, you need to cross some kind of security boundary and it would be nice to make sure the user is who they say they are, they are allowed to do the requested action and they are made aware of the change. Thus methods like UAC and sudo. I’m not sure how you can escape that. Removing sudo and UAC doesn’t change the fact that something wants to mess with a shared resource running with some kind of elevated privilege.
dataflow 2y ago
> Please make sense. They do make sense. You're missing something critical in the argument. > So what’s interesting is MS say that UAC isn’t a security boundary. Which is some users to admin. This is incorrect. UAC is for already-admin users; it's not "some users to admin". The security boundary exists around standard users, not admin users. This might not be what you like, which I totally get, but it does make sense. If you want a security boundary, don't create a user in the Administrators group.
- akira2501 2y ago
  > If you want a security boundary, don't create a user in the Administrators group. As a user aren't you essentially forced to this to have a usable desktop experience? I mean, sure, there is a boundary.. but it's drawn rather carelessly around the entire stack.
  - dataflow 2y ago
    Depends what you're doing?
    - akira2501 2y ago
      Using any non Microsoft software.
      - dataflow 2y ago
        Like what? Chrome? Firefox? Acrobat? Photoshop?
        tsujamin 2y ago
        I’m the only local admin on my mother’s laptop, she’s never noticed and I’ve not logged in to do anything in over 2 years.
        dataflow 2y ago
doctorpangloss 2y ago
I've learned that if you want bugs fixed in Windows, pay for professional support. Same as corporate-managed open source software. The real question is why people bother doing free security research work for Microsoft, instead of spending their intellectual energy making desktop Linux better.
ospray 2y ago
They have always had these contradictions. I think it's because they know there are lots of bypasses for all of them.

prettyStandard 2y ago

This is a value system disagreement. I have a theory that there's basically two types of disagreements, disagreements on definitions, and disagreements on value systems. In this case Microsoft values downplaying this issue, so when that is at the top of their value system their decisions should make sense following that. Since this is just a pet theory I'm very interested to hear critiques on it. Disagreements on definition are a little bit easier, because then you can just talk about the definitions and resolve your differences there... For example let's say IDK You're trying to sort out how to design a software system, and everyone is speaking in terms of design patterns, but they haven't yet spelled out the details of what those designed patterns are, then that could probably lead to a lot of confusion if when you say A I think of A', and another person is thinking of A''.

Buttons840 2y ago
I like this. I first noticed this with gay marriage. Some would say "gay people should be able to do what they want and form 'civil unions' with all the tax and contractual benefits and requirements of marriage, but they shouldn't be able to get 'married'". For these people, it was all about the definition of a word. Other people opposed gay marriage because it went against their values. No matter what you wanted to call it, they were opposed to gay people living together and sharing their lives. I chose this example because it's the first time I noticed that some disagreements are about the definition of a word, and it's an especially clear example of that. It's silly how huge disagreements about a single word can become. There are also people who disguise their value disagreement as a definition disagreement. This is a form of bad faith arguing.
- BJones12 2y ago
  I think your example is accurate. I think there's another example around trans-vocabulary: The analog of the 1st half is "I'm not going to stop you from cutting off your man bits, but don't expect me to call you a 'woman'. 'Trans woman' is ok because that's a new word, but 'woman' already has a meaning and don't try to change it." The analog of the 2nd half is "You shouldn't do that because you're a man and you need to act like one." Or perhaps it's an affront to nature or the divine.
  - whatshisface 2y ago
    Some of this may be due to a desire to transform an illicit desire for authority ("I declare that I shall not pay out a bounty") into a legitimate contest ("this bug is not a bug because I desire to clarify our communal understanding of the concept of a bug...").
  - jjjkjjkl 2y ago
    Difference between the first and second there is basically the dividing line between the gender-critical feminists and the conservatives, on this topic.
- DrillShopper 2y ago
  > Some would say "gay people should be able to do what they want and form 'civil unions' with all the tax and contractual benefits and requirements of marriage, but they shouldn't be able to get 'married'". > Other people opposed gay marriage because it went against their values. This difference does not matter - the outcome was the same. Stop treating bigots with kid gloves.
hggigg 2y ago
It makes sense if Microsoft's strategy is having a flexible self-serving value system.
layer8 2y ago
This assumes Microsoft being a singular entity with a single set of values (or even a single set of definitions), which I believe is an incorrect premise. It’s misleading to think of organizations as if they were a single mind. (Not to speak of the fact that it’s quite common even for singular minds to have inconsistent values and beliefs.)
rawgabbit 2y ago
Socratic logic argues you must first agree on the meaning of terms and definitions. Next is determination of what the facts are. Lastly is logical arguments. Guess which part is the most difficult? Religious logic is like this. It presupposes a greater mystery that has been partially revealed to us. It also presupposes that our fallible logic cannot on its own understand the truth. In other words it defines faith as believing in the greater truth even if the world and every one says we are foolish to believe in such fairy tales.
- prettyStandard 2y ago
  I think that's helpful for me and my theory. Informed by Socrates I will refine my theory. O:-) There's three forms of disagreements. 1. Disagreements on definitions 2. Disagreements on facts Kind of hard to disagree on logical implications 3. Disagreements on value systems Not to be dense, which is most difficult?
  - rawgabbit 2y ago
    Facts are the most contentious because the disingenuous will argue that’s not how they interpret term xxx. Even if you call them out for switching meaning during the argument, they will claim they had a mental lapse and say they really mean yyy.
dataflow 2y ago
> This is a value system disagreement. Sorry, this is not a value system disagreement. It's definitions, pure and simple. As I mentioned in my sibling comment, the definition (and thus boundary) has been pretty sharp and clear for decades: the user group. If you're a standard user, such as in the "Users" or "Guests" groups, you're behind the boundary. If you're in the "Administrators" group, you're already past it. That's all there is to it.
- prettyStandard 2y ago
  I see what you're saying... I think the sibling comment accidentally put it better. > There are also people who disguise their value disagreement as a definition disagreement. Or maybe even more to the point: they are twisting their definitions to support their values. I think we can agree on this.
  - dataflow 2y ago
    >> There are also people who disguise their value disagreement as a definition disagreement. > Or maybe even more to the point: they are twisting their definitions to support their values. I think we can agree on this. I take it you're insinuating I'm one of these people here? Hasn't group membership been the defining security boundary in Windows for over two decades?
- pdonis 2y ago
  > this is not a value system disagreement. Yes, it is. The issue is not that people don't understand how MS defines what is and is not a security boundary. The issue is that MS's definition is for the benefit of MS, not for the benefit of the user. That's a value system disagreement.
  - dataflow 2y ago
    > The issue is not that people don't understand how MS defines what is and is not a security boundary. That's a communication failure, not a value system disagreement. > The issue is that MS's definition is for the benefit of MS, not for the benefit of the user. That's a value system disagreement. Just because two entities differ on their values that doesn't mean everything they disagree on is their values. In this case, the fact that users and Microsoft differ on what constitutes a security boundary is 100% a definitional disagreement. Now MS obviously has had their own values and reasons for not establishing other security boundaries people would like, and that is a value system disagreement. But even if their values agreed with yours and they hated the current design just like you, the fact of the matter would still be that user account groups are the boundaries in the current design, and that would still imply this isn't crossing a security boundary, making the disagreement on that definitional.

quotemstr 2y ago

UAC in practice doesn't function as a security boundary, and to make it one would so inconvenience users that they'd just go to other OSes. Both UAC and sudo are just OS level cookie dialog boxes. Let's get rid of all three. We need to give up on the UAC/sudo/etc. style of user based privilege escalation and instead sandbox apps, not users, just like Android and iOS do.

BSDobelix 2y ago
>sandbox apps This is about drivers...
- quotemstr 2y ago
  1) drivers should be apps too (Redox and others (even macOS partially) get this right) 2) driver vulnerabilities are there regardless of user setup. Making a user click a UAC button doesn't make the vulnerability disappear
  - cruffle_duffle 2y ago
    Drivers can be whatever but their effect is usually global not for a specific user or app. So when you update, say, a graphics driver you are updating a shared resource used by everything in the system. You can run that display driver in whatever security context you want be it “root” or its own constrained context but that doesn’t change the fact that other things in the system, running under their own security contexts, are feeding that driver stuff. And given there is generally only one display output, or sound output, or whatever, all things in the system have to use it for output, making it more privileged than the rest. Whatever security context a display driver runs in, that context by requirement has to be more privileged than whatever context your browser or a calculator app runs in. To make changes to that shared display driver, you need to cross some kind of security boundary and it would be nice to make sure the user is who they say they are, they are allowed to do the requested action and they are made aware of the change. Thus methods like UAC and sudo. I’m not sure how you can escape that. Removing sudo and UAC doesn’t change the fact that something wants to mess with a shared resource running with some kind of elevated privilege.

dataflow 2y ago

> Please make sense. They do make sense. You're missing something critical in the argument. > So what’s interesting is MS say that UAC isn’t a security boundary. Which is some users to admin. This is incorrect. UAC is for already-admin users; it's not "some users to admin". The security boundary exists around standard users, not admin users. This might not be what you like, which I totally get, but it does make sense. If you want a security boundary, don't create a user in the Administrators group.

akira2501 2y ago
> If you want a security boundary, don't create a user in the Administrators group. As a user aren't you essentially forced to this to have a usable desktop experience? I mean, sure, there is a boundary.. but it's drawn rather carelessly around the entire stack.
- dataflow 2y ago
  Depends what you're doing?
  - akira2501 2y ago
    Using any non Microsoft software.
    - dataflow 2y ago
      Like what? Chrome? Firefox? Acrobat? Photoshop?
      - tsujamin 2y ago
        I’m the only local admin on my mother’s laptop, she’s never noticed and I’ve not logged in to do anything in over 2 years.
        dataflow 2y ago

doctorpangloss 2y ago

I've learned that if you want bugs fixed in Windows, pay for professional support. Same as corporate-managed open source software. The real question is why people bother doing free security research work for Microsoft, instead of spending their intellectual energy making desktop Linux better.

ospray 2y ago

They have always had these contradictions. I think it's because they know there are lots of bypasses for all of them.