Return Quickbooks for Refund

I was going to title this post "Microsoft Representative Says to Return Quickbooks for Refund".  Then I thought to myself:

"Oh, Jesper's going to be so mad with me for that tagline."

Sorry, Jesper.

I'd probably also upset Steve Riley, who works a lot with Jesper, and gets irritated when Microsoft reps are badly misquoted, or when writers conflate an otherwise succinct message in order to demonise Microsoft.

Jesper didn't actually say to return Quickbooks for a refund, and he wasn't specifically, directly, referring to Quickbooks when he said:

"Two related issues usually come up at about this point in the conversation. The first one is that some application requires at least Power User privilege. If that application is not an inherently administrative one it is broken. Period. Return it for a refund or a fixed version."

But, as you can see from http://www.threatcode.com, despite years of being prodded by Security MVPs and CPAs alike that Quickbooks shouldn't be an admin-only product (what system administration task does it do?  NONE!), Quickbooks remains solidly in the "Administrator or Power User" camp.  At one point, a tech support rep at the company "responsible" even claimed that this was a good thing, because it meant that only trusted people were doing your accounts.

As a developer myself, it looks strikingly similar to "we didn't want to have to do the hard work of figuring out how to share files across users without writing to files in the Program Files directory tree".

Me, I trust my accountant to do my accounts; but I don't trust my network admin to do my accounts, nor do I trust my accountant to administer my network.

So, my network admin has administrator privileges, and my accountant has the key to my filing cabinet.  I'll be upset if I find that they're sharing them.

Published Mon, Mar 13 2006 12:15 by Alun Jones
Filed under:

Comments

# re: Return Quickbooks for Refund

Ah, but we will continue to say exactly this. If program X performs no admin function but requires admin rights, then it is broken and should be returned. This is true for all values of X.

It's up to you, the people who *purchase* X, to vote with your money and buy from vendors who care about your security. We don't buy their stuff, so we have very little influence. But you do, and your influence is far greater.

Tuesday, March 14, 2006 3:07 AM by Steve Riley

# re: Return Quickbooks for Refund

Perhaps, too, I should have pointed out that Microsoft have been saying this ("don't make your non-admin program require running as admin") for over a decade.

As a programmer, I read it a long time ago in http://www.microsoft.com/technet/archive/ntwrkstn/support/trblshoot/apint95.mspx - and that appeared around the release of Windows 95.

So, yes, if you find a program that does no computer administration function, and yet requires administrator privileges (or has substantial non-administrator function, and still requires administrator privileges all the time), think to yourself "this program's assumptions were outdated over a decade ago".

Quickbooks 2006, then, by requiring 1994 technology assumptions, could more accurately be described as "Quickbooks 1994 with added chrome".

Return it to the store as old merchandise.

Tuesday, March 14, 2006 10:03 AM by Alun Jones

# re: Return Quickbooks for Refund

Quickbooks PRO 2008 runs in Windows 7 without being Admin. I use LUA + SRP and I can't enable the .dll checking option of SRS policies. Crap software for sure.

Tuesday, July 28, 2009 10:57 AM by pcunite

Leave a Comment

(required) 
(required) 
(optional)
(required) 
If you can't read this number refresh your screen
Enter the numbers above: