From: Gary Britt 

Its said to see Russinovich lend his credibility to the spin machine at
Microsoft.  Am I the only one who thinks this?  I'm sure he's getting paid
really well and any of us would have sold out just like him, but its still
sad nonetheless.

Gary

Rich Gauszka wrote:
> "I would like to be offered a choice whether to fully trust a given
> installer executable [and run it as full administrator] or just allow it to
> add a folder in C:\Program Files and some keys under HKLM\Software and do
> nothing more."
>
> "I could do that under Windows XP, but apparently I can't under
Vista, which
> is a bit disturbing."
>
>
> http://www.itnews.com.au/newsstory.aspx?CIaNID=46057&src=site-marq
>
> Rutkowska discovered that when Vista detects that the user is running an
> installation file it kicks into full admin mode.
>
> If a user wishes to install a new program they are presented with the option
> either to allow the installer complete system privileges or not to run the
> program at all.
>
> Rutkowska wrote on her Invisible Things blog: "That means that if you
> downloaded some freeware Tetris game, you will have to run its installer as
> administrator, giving it full access to all your file system and registry,
> and allowing it to load kernel drivers! Why should a Tetris installer be
> allowed to load kernel drivers?
>
> "I would like to be offered a choice whether to fully trust a given
> installer executable [and run it as full administrator] or just allow it to
> add a folder in C:\Program Files and some keys under HKLM\Software and do
> nothing more.
>
> "I could do that under Windows XP, but apparently I can't under
Vista, which
> is a bit disturbing."
>
> A few days after her posting there was a lengthy and detailed response from
> Mark Russinovich, a Technical Fellow at Microsoft.
>
> Russinovich essentially admitted that, while the problem exists, it was a
> design choice that stemmed from the balance between security and usability.
>
> "Because elevations and integrity levels do not define a security boundary,
> potential avenues of attack, regardless of ease or scope, are not security
> bugs, " he said.
>
> In light of the huge security campaign surrounding Windows Vista in 2006,
> Rutkowska said in a follow up posting that this explanation simply is not
> good enough and that Microsoft should attempt to solve the problem rather
> than try and dismiss the issue.
>
>

--- BBBS/NT v4.01 Flag-5