[There's a reason that Yoda is the unofficial mascot of SBS.  Size indeed matters not.] Hey, Directions on Microsoft? Aren't you going after the party not causing the problem? - THE OFFICIAL BLOG OF THE SBS "DIVA"
Sunday, December 26, 2004 3:42 PM bradley

Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

I'm reading Directions on Microsoft's Top 10 issues that Microsoft has for challenges in 2005 and I'm pulling one paragraph out that in particular [I think] needs clarification.  In the Directions on Microsoft article they state:

“Security has always been near the top of our Top 10 list, but despite laudable efforts by Microsoft, such as a drop-everything-else code review, security is still a problem. In fact, the bad guys seem to be winning. Before anyone gets on the Internet the first time these days they need a PC already protected by the latest service packs and security patches, an antivirus program, an antispyware program, and training on how to avoid phishing exploits. Although Microsoft arguably bears little direct responsibility for these problems, the company has the most to lose if these security issues persist. Furthermore, Microsoft is in the best position of any vendor to address the problems. Some useful next moves? Make it possible to run Windows all day without requiring administrative privileges and work with other players on standards that will make it easier to authenticate the senders of e-mail.

"Security problems raise the cost of managing Windows clients, and make the perennial thin-client alternative more viable. This year, Microsoft has to deliver the improvements it promised for patching corporate PCs, and not let development of future product versions interfere with keeping current ones secure."
—Michael Cherry, Lead Analyst for Windows”

Mr. Cherry?  Office applications and Internet explorer run FINE as a user and do not need administrative privileges.  It 's my stupid APPLICATIONS that are coded stupidly that need these rights.  And even in SuSe [a Linux distribution] there are times to adjust the monitor, to apply patches, to install software that you need to Sudo [the equivalent of Administrator rights - or the Windows equivalent of RunAs].  I just recently loaded up SuSe and looked in absolute horror at this screen:

See that box that says “Keep password“?  You and I both know that your home user/end user is going to click that box and say “sure“ save my password because it's a pain to type in that really long strong password I gave the machine when I built it.  What's the insecurity [or insanity] of saving the administrator password so the next worm du jour that blasts through a SuSe box will have admin rights?  We cannot dumb down these desktops like this and keep these boxes secure!  The bad guys are winning and the sooner we all figure out that we should be fighting “them“ and not flighting the “who has the better Operating system“, the better off we will be.

Look at these applications in my office that REFUSE to run in user mode.  So I ask you?  Who's at fault?  Microsoft applications DO run in user mode.  It's my third party stuff that doesn't.  I say that it's not Microsoft that needs to make 'Windows' run as user, but rather that we get tools to help us identify how stupidly these applications are coded and then go and beat up THOSE vendors to make them either set the right permissions as they load on “just that registry key” or code better in the long run.  I don't need them to make Windows run as a “user” ...it does... I need Microsoft to give me tools to help me identify my vendors that are the dumb ones.

Ask for the right solution to the real problem, I say.

Filed under:

# re: Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

Monday, December 27, 2004 8:22 AM by bradley

Susan doesn't this strike you as an opportunity for small ISV's to provide software that solves this problem? I know you're not really a programmer but it's not hard to write software that works well as a standard or restricted user. The problem is all the developers that worked for years as administrator and the huge base of existing code that would require expensive and time-consuming re-engineering to make them standard-user-friendly. It's much less costly (in the short term anyway) to just tell the user to change their permissions.

# re: Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

Monday, December 27, 2004 11:05 AM by bradley

Have you ever gotten it right ...

I am a the IS manager at a mid-size manufacturing company, and applications that don't run properly without administrative privilege are one of the banes of my existence.

And, what really BURNS me, is that it is nothing but poor programming or poor design.

As far as these apps, add FedEx Ship Manager

# re: Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

Monday, December 27, 2004 1:25 PM by bradley

*Every* software developer should step up to the plate to provide a solution to the problem, Roger, not just ISVs.

The problem is that everyone else thinks that this is a Microsoft problem. "They should make their OS easier to run as non-admin.", just as the article pointed out. Very few people understand that it's not the OSes fault that Craptacular Poker 2004 requires extra rights because some moron developer somewhere decided that the Program Files folder was a great place to store the saved games.

We, as a community, need to start getting the word out that people shouldn't tolerate crap software anymore. We should send back any software that doesn't abide by the rules (Half-Life 2 and Doom 3 included), and demand a refund until they can do the ungodly small amount of homework to make better design decisions. We should convince businesses not to buy this crap until it's fixed - "why should I have to change the security settings in my group policy? It's *your* software that's broken!"

It's really too bad that there aren't enough of us to actually make a difference... isn't it?

# Re: Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

Monday, December 27, 2004 5:18 PM by bradley


Well, sure Mike, you're right. It should be every software developer. My point was based on the idea that small ISV's could move quicker (and start from a clean code base) to provide products that handle non-admin users correctly.

# re: Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

Monday, December 27, 2004 6:42 PM by bradley

Susan,
You just unwittingly buttressed a long-standing criticism of Microsoft, that it's too interested creating an OS that best supports only Microsoft applications.

Remember, no matter how much good information Microsoft makes available to the world, there will always be a very large number of developers who won't follow every bit of Microsoft's gospel no matter what. Reasons are varied... hardheadedness, people on low budgets (especially in the SMB space), poor teachers, people who lack talent, you name it.

And, some Dev aren't directly to blame... There are many ways to go wrong in varying degrees (should Dev have the freedom to make mistakes?) and those who build to the Java environment (or other third party environments, databases, etc) are completely dependent on the environment delivering what it promises.

Anyone who ignores the rest of the world outside of Microsoft won't understand the forces at work completely.

Not to worry though... too much for those who have the patience... since for many years now Microsoft's OS products have been undergoing an architecture renaissance, loosening the concept that the OS and the application must be tightly integrated.

Some will say "Microsoft has seen the light." Personally, I think that Microsoft isn't just emulating the competition, Microsoft is moving towards an architecture that is the best of both worlds... tight integration which enables the OS to continue to better manage resources more efficiently while <virtualizing> the application environments so that applications can think they have all the rights and permissions they need while not compromising anything else. A first generation solution that supports legacy applications can be run in virtualized environments like VirtualPC, but I look forward to the day when we leave all COM behind and dotNET is everywhere.

Tony

# re: Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

Monday, December 27, 2004 6:47 PM by bradley

# re: Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

Monday, December 27, 2004 6:47 PM by bradley

And Intuit hardly has a low budget!

# re: Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

Monday, December 27, 2004 7:04 PM by bradley

Tony,
If you're developing software for a platform, you need to understand the platform - end of discussion. I don't care how hard your head is, or if you have a $1.00 development budget, this isn't hard stuff to figure out. If you don't have the skills, you shouldn't be a professional developer.

*Don't* install to the root of the C drive.
*Don't* write to the program's home folder.
*Don't* write to HKEY_LOCAL_MACHINE.
*Don't* write to the %SystemRoot% folder.

If you can't figure these things out on your own, or if they're "too expensive" to design, you shouldn't be writing software.

Just my $0.02.

# re: Hey, Directions on Microsoft? Aren't you going after the party not causing the problem?

Tuesday, December 28, 2004 11:35 AM by bradley

Susan and Mike,
Although I personally agree with you (My company does its best to implement "Best Practices" often recommended by Microsoft when building MS apps), the facts are though that most of the world does not attempt to write software well, they write software only well enough to satisfy their customer... And if the customer is not knowledgeable, then who is going to set the standards? And, it's questionable whether MS can ever enforce QoSoftware, there's already enough of a cry over how MS controls how things work already.

The facts are that as long as it's possible to write software badly, the majority of software will be written badly and this is because

a. The customer doesn't care about technical details. If the software delivers on its stated business purpose for the cheapest price and it works in someone else's network, then there is no good reason why it shouldn't work in his.

b. Microsoft like any other software vendor has to support backwards compatibility as much as is reasonably possible (ie. workgroup environments and apps which worked in those environments) but that always involves compromise. It means you cannot enforce the best and the latest always because the best and the latest often requires a complete break from older technologies. Remember "Bad" software wasn't always considered bad, and the apps you're describing worked perfectly in an older environment.

c. Microsoft has to be sensitive to how the bean-counters age investments. If MS were to force businesses to accellerate their amortizations more than they are willing or the tax code allows, you'll see all-out rebellion.

d. The educational system everywhere is very spotty, which is why I personally value Microsoft certifications more than a 4 year degree when I evaluate skillsets although it's not a hard and fast rule I go by. For years I couldn't find anyone with a diploma without certifications who could even build a simple website the way I expected it to be done. But, I highly doubt that anyone is in a position to enforce standards... only suggest a level of competence by whatever means is available.

On that last point, I believe whether MS intended to address or not, the new initiatives making technical information available publicly which we all have seen is also having an effect in that area. Dev students today have ample resources to learn "The Microsoft Way" on their own if they have self-initiative and something to compare information if they take formal education.

Addressing Susan's post about the winlogo program, the program only has as much value as others value it... and much of the world does not want to participate for various reasons. Most find the fees unjustifiable. I even worked on a project and rejected a free (at that time) Microsoft logo because its requirements would mean that I could not install the application over the Internet easily directly to the User's device(I still think that was a very stupid requirement). And, if the public's consciousness regarding the purpose and value of the logo isn't raised, it has no value. So, for instance when was the last time someone bought a Peachtree or Intuit and looked for the Winlogo before considering a purchase (or practically any other software for that matter)?

And lastly addressing Mike's point specifically... in the world of marketing, you deliver what the customer wants. Unfortunately, whether you believe bad programming should exist or not, as long as <the public> is willing to buy bad programming for whatever reason, criticizing the Dev industry just isn't going to accomplish anything. Unless you can raise the consciousness of the people who are willing to pay for software and provide the tools they need to make sensible decisions nothing will change.

(So, IMO going after anyone who writes less than perfect code isn't going to accomplish anything... You'd be missing the point the product delivers what the Consumer may want).

Tony