 | ||||
|
|
|
||
|
• Image Gallery |
|
||
|
||||
With Mac OS X, if I need to make a change to a system setting or install software in a location that I don't have read/write access to, I have to authenticate to perform that action. For example, I want to change my IP address for my wireless connection, and my system is set up to require authentication to do such things. With the details expanded, I have a fair bit of information. First, I have to know the password of an administrator user for that machine. If I don't, then even physical access isn't enough; I can't unlock that preference pane. Second, I know the right it wants me to authorize: system.preferences (although I may not know what that means, it's there at least), and I know which application is requesting that right.
 |
 |
|
OS X In OS X, users need to authenticate to change system settings. (click image for larger view) view image gallery |
|
If I attempt to perform the equivalent action in Vista, I don't actually have to "authenticate" anything. There's no need for a password. Anyone sitting at this computer can take this action. What you see for UAC as an administrator is basically a dialog that says, "You want to do this?" I don't get any information about what I'm asked to approve -- all I get is a really long GUID-type number that's of no use whatsoever.
|
Vista In Vista, users need to "approve," rather than "authenticate," changes. (click image for larger view) view image gallery |
|
 |
|
The other thing is, until I deal with this dialog or it goes away on its own, I cannot do anything else in Vista. The Mac OS X version won't let me interact with System Preferences until I handle the authentication request, but I can at least keep working in other programs.
That illustrates the three worst aspects of UAC and why I think it's going to be called "User Annoyance Control." You get what is essentially an "OK/Cancel" dialog that most users will hit "OK" for without thinking, you may or may not get useful information as to what is going on, and you get locked out of your system until you deal with this. I have a problem with seeing how annoying people is enhancing security. When I say "annoyance" I really mean "infuriate," because you get UAC dialogs all over the place, and you're never sure when or why you're going to get them.
For example, when I installed Adobe Reader 8 in Vista, I had to deal with UAC twice. The first UAC dialog box was in response to launching the setup file, something I had done with a manual double-click. I could understand authentication if it had been launched by another unauthenticated process, but a manual double-click? Now, since we're running an installer, there is some justification in authentication, but for one thing, that's not what we're doing here, we're just approving, and for another, what if I want to install this into my home directory? What if I want to install this into a place I have full access to? Requiring UAC approval for every install either means the installation process is rather inflexible, or that every installation changes system-level data regardless of need. Neither idea is terribly comforting. However, the second dialog box let me finish the installation.
|
Vista (click image for larger view) |
|
Vista (click image for larger view) |
|
|
Vista Installer user-account-control approval dialog. |
|
Second Vista user-account-control installation approval dialog. |
|
|
view image gallery |
|
||
I've seen worse. If you use Vista under Parallels on Mac OS X, the Parallels tools installs something like eight drivers. You have to UAC every ... single ... one. But even when I've taken actions where Vista is telling me "You will have to authenticate," I still only have to click the correct button in a dialog. That's not authenticating anything, it's just approving. There's no way that UAC is going to enhance security, in fact, it's probably going to have the opposite effect, because people are going to just hit OK/Continue even more automatically than they do now. If, as everyone knows, Apple and Microsoft borrow/steal from each other liberally, I really wish Microsoft would have done a better job with regard to UAC. Adding "Annoyance +20" to the OS is not the right answer here.
