SageTV and Windows 7 - UAC or not?

[mayamaniac]

hmm, makes me rethink it, probably 32bit is the better choice.

[babgvant]

Originally Posted by stuckless

Personally, I like Fuzzy's approach... or just turn it off.

I can't seem to find anything that indicates that it makes the system any more secure.... other than a security via obscurity... and in most cases, it just seems to confuse the hell of people. I'm not sure what MS wanted when the came out with UAC, but I'm can't imagine that they've gotten right.... yet. I think it would have made more sense to just not allow a regular user to write to the program files area after the application was installed, since that what this is trying to accomplish in a very over complicated, non useful, ms way.

But, using Fuzzy's idea, which i'll probably start using as well, I don't have to worry about windows magically and virtually storing my writes to some other location, other than the one that I intended.

UAC is an artifact of MS's desire to provide backwards compatibility and provide a more controlled system for accessing "protected" resources. It's not perfect by any measure, but having a restricted token w/ explicit opt in for administrative tasks is better than nothing.

Sage (and other applications) shouldn't be storing config files in the executable files store (ProgramFiles), they should be using ProgramData. If an application has issues w/ UAC it's because that application doesn't follow the rules. That said, MS is partially to blame for creating the environment where the rules could be ignored easily (default user in XP was an admin).

Personally, after installing Sage but before starting the service I change the permissions on "%ProgramFiles%\SageTV" to allow Users full control. Then start the service.

If Sage wanted to, they could include this step in the install script and save us all the trouble.

[Brent]

Originally Posted by babgvant

...Personally, after installing Sage but before starting the service I change the permissions on "%ProgramFiles%\SageTV" to allow Users full control. Then start the service.

If Sage wanted to, they could include this step in the install script and save us all the trouble.

That is a very good idea. Matter of fact I think I'll mention that in a request to SageTV devs.



Thanks to all for the advice!!! This thread shows how many different ways you can deal with it.

[aflat]

Microsoft admits that UAC isn't a real security fix, http://blogs.msdn.com/e7/archive/200...te-on-uac.aspx

Basically if your running as a non-admin user, your safe. If your an admin, and UAC is not cranked all the way up, your not safe. Yes it's extreme but any halfway decent script kiddie can get around UAC unless it is cranked all the way up. So if you're an admin, and you don't have it cranked all the way up, you mine as well turn it off.

[babgvant]

Originally Posted by aflat

Microsoft admits that UAC isn't a real security fix, http://blogs.msdn.com/e7/archive/200...te-on-uac.aspx

FWIW, that only applies to the implementation of UAC in Windows 7.

Originally Posted by aflat

Basically if your running as a non-admin user, your safe. If your an admin, and UAC is not cranked all the way up, your not safe. Yes it's extreme but any halfway decent script kiddie can get around UAC unless it is cranked all the way up. So if you're an admin, and you don't have it cranked all the way up, you mine as well turn it off.

You're never completely "safe" in any scenario running sw that you didn't write (only speaking re. malware not self inflicted bad programming ) or that is connected to a network. That said, in any scenario the biggest security hole is the user.

If you can run as a restricted user, that is the best but difficult for normal people. I did this on XP, but you need to be pretty handy w/ regmon and filemon to make it work. Running w/ UAC (cranked up all the way in 7) is a decent alternative because at the very least you get redirection so the non-rule-following applications [generally] don't crash and burn.

IMO MS shouldn't have created the middle options and excluded their own binaries from explicit elevation, but I understand why they did.