Hacker News new | past | comments | ask | show | jobs | submit login

I absolutely agree.

How much upstream effort must occur to facilitate downstream userspace day-to-day function(s)?

[edit]

I'll perform whatever action is required to enable user functionality. That's what I'm here for.

But I don't agree/understand why the user-use of something as basic as symbolic links is dependent on an Admin having a clue.




I agree with you, it shouldn't require admin intervention. But I think the reason it annoys you, other sysadmins and developers alike is because the security model is broken in terms of UX, velocity and innovation.

From strictly a security perspective we need to lock down machines and remove admin rights because clients are a serious threat to our internal networks. But we pay out the nose in terms of productivity, employee happiness, innovation, etc. Even if Microsoft fixes all of these little things that currently require careful thought by a sysadmin before deploying that's just Microsoft. There's still plenty of poorly written software out there that requires admin rights. And that's new software, not legacy. Requiring sysadmin intervention every time someone wants to try something, especially just on a local machine is a huge drag on everyone involved.

Right now the idea is still young and as far as I know hasn't been productized yet but it looks a lot like Google's Beyond Corp[0] system of shrinking the perimeter to exclude clients, treat them as potentially hostile by default and have access to resources based on a dynamic threat assesment seems like the best way forward. Users have flexibility and freedom and the company is protected. But I think it's still out of reach for most companies. It will take projects and products to make it feasible and even then a lot of companies are still struggling to do basic "hard outside squishy interior" properly.

[0] http://research.google.com/pubs/pub43231.html


I'm assuming that this initial admin step is due to the plethora of edge cases in Windows that exist when it comes to symbolic links (old APIs being the most probable cause, but there may be issues in the current FS permissions model). If MS just enable this functionality now, with no extra steps required, in the main stream release, then they will leave themselves open to a bunch of potential security issues and nasty bugs.

Hopefully they'll act on the feedback of the insider-track release users, and those enabling developer mode in the more stable releases, and this will iron out the vast majority of problems before they just enable it by default for all users.

I know this means enterprise users and main-stream (non insider-track) users will be stuck without this functionality (obviously available in unix land for decades) for a while yet, but I'd rather MS rolled this out in a responsible manner rather than just open the flood-gates of potential malware. Symlinks may be basic, but they have been the cause of many nasty vulnerabilities in Linux over the years. Hopefully MS is just being cautious and in a year or so all Windows users will be able to create symlinks without any admin interjection at all.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: