Chapter 3: Help for Those Lame Apps-File and Registry Virtualization

Will UAC Succeed?

As I said in the beginning of this chapter, it's been odd acting as a champion of a feature that I think that most people's initial reaction to UAC mirrors what I first experienced: ugh. "It may be good for me, but I say it's spinach, and I don't like it!" That sort of thing.

But, as I've already explained, I had a road-to-Damascus moment back in early June, when I was helping what seemed like the millionth friend, family member, or random acquaintance in removing 10-I'm not kidding, it was 10-different pieces of spyware off of her computer. Here's an intelligent person, not a dummy at all. Someone who works in a technical field other than computers, and yet she'd not only opened Pandora's box, she'd put a addition on the house to make the box's former occupants feel right at home.

I think we need UAC because while on the one hand almost everyone nowadays uses a computer, on the other hand the vast majority of them aren't technical enough to understand the dangers that networked computers face. Regular folks have a vague knowledge that they should have antivirus software and maybe a personal firewall and that Bad Things Can Happen, but they really don't understand what computer activities can potentially endanger their privacy and their property. Furthermore, almost none of them understands which of those might cause their systems to become infested with enough worms and bots to make their computer the cause of some seriously slow Internet availability for the rest of us. Now, don't misunderstand me on this: I'm not patronizing anyone who doesn't know the geeky internals of computer security, nor do I expect that the normal Internet user should become a security expert, but there is a need for the average bear to at least become aware of when he's doing things that might put him at risk. There is a serious problem out there that calls for serious medicine.

Yes, as I've said, UAC has annoyed me sometimes, although I've gotten used to it and I suspect that others can as well. But heck, for that matter, I find seat belts irritating. As a guy who got his driver's license in 1974-a mere six years after the U.S. government required seat belts on all cars-I remember driving without them and am a bit annoyed that I've got to use them. Similarly, I love getting the maximum miles per gallon out of my car-not to save a buck or two, but just out of the sheer joy of optimization: I used to own a Volkswagen Beetle that got about 50 miles to the gallon, and that seemed pretty cool. As a matter of fact, however, nowadays it's hard to match the fuel efficiency of that 1962 vehicle, given that every modern car has to carry around hundreds of pounds of bumpers, side impact beams, air bags, and extra 1986-and-later rear brake lights…and that messes with my mileage.

What's that got to do with User Account Control? Simple: all of that junk that slows down my car and makes it cost more money is there for one reason: to make me safe whether I want it or not, even though I'm a safe driver. It's logical, therefore, that as someone who understands how to operate a computer safely that I'd chafe a bit at UAC.

But, oddly and sadly enough, Microsoft doesn't make operating systems just for me; they make 'em for the average Joe and Jane. And Honda doesn't make cars just for me (even though my 67 MPG 2000 Honda Insight is pretty near what I'd design), they've got to make them for a mass market. A mass market regulated by the government. Car manufacturers put that safety stuff on their cars mainly because the government requires them to because, while the government knows full well that most people drive pretty safely, the amount of highway injuries, fatalities, and property damage years ago was unacceptable. No one's making Microsoft put UAC into their operating system, but it's clear that the risk factor in using computers is orders of magnitude worse than it was a decade ago, when NT 4.0 Workstation hit the shelves.

In other words, I've never actually needed my seat belts, thank heavens, but that doesn't mean that I won't eventually need them, and after that I suspect I'll feel more warmly toward them. Similarly, I don't think I could be gulled into installing some malware on my system, but it's possible. So having UAC flash the "warning: entering biohazard zone, please don protective gear" light may turn out to be quite welcome one day.

The number of bad guys out there is growing daily, and that's no exaggeration. UAC may help keep them at bay. (Or, as I sometimes fear, UAC prompts may become so common that we'll click them without thinking.)