derek hatchard

aggregating from ardentdev.com and derekhat.com

August 2005 - Posts

User Access Protection (UAP) in Windows Vista

One of the features I am most excited about in Windows Vista is User Access Protection (UAP). Enabling UAP tells Windows to run your session in a least privilege mode, even though you have full admin rights. To do something restricted you have to run the app in "elevated" mode (right-click, Run Elevated). Windows requires you to enter your password in order to authorize elevation. Presumably this feature is to help reduce the spread of viruses and worms by preventing them from silently doing things when a user is logged on with full rights. This is FANTASTIC! Finally there is something that will force ISVs to get their acts together and start coding with least-privilege in mind.

There must be something new in the Win32 API for an application to request elevated privileges because some programs bring up the password prompt when they start (e.g., regedit). It would be a real tragedy if software vendors modify their apps to simply request elevated privileges on startup. Perhaps Vista should require applications to declare what types of administrative tasks they intend on performing so security can be doled out more granularly. The authorization interface could include an Advanced section for more savvy users that lists the permissions the application has requested. I know I have glossed over numerous potential snags but wouldn't it be great? :)

I have been running my Vista machine with UAP enabled, which has caused a few problems. Most notable was Napster not working for streaming and downloading tunes -- actually, I think it was Windows Media Player DRM that was not working right. Napster tech support sent me a list of troubleshooting steps that included renaming the DRM folder under All Users (on XP it would be C:\Documents and Settings\All Users, on Vista Beta 1 it is C:\Users\Public). When I could not do that from Windows Explorer with UAP running, I knew I was onto the problem. I disabled UAP, renamed the folder, and suddenly all was well with Napster and/or WMP DRM. I enabled UAP again and so far everything is working fine if I run the Napster client elevated. I suspect DRM would not work properly for other users on this machine due to the ACLs I see on the new DRM folder. That does not affect me as my machine is only for me, but that would be a major problem for home users and other shared PC environments.

[Sidebar: If you are reading this blog you might not realize that in some homes people share one computer. You probably don't have shared computers at your home: every man, woman, child, and dog probably has his/her own PC. Unless, of course, you're broke, in which case you should come work for me so you can make some money to buy more computers for home... ;) ].

So far I have a few complaints with UAP:

  1. I cannot run Windows Explorer elevated
  2. I cannot elevate a process already running (this would be especially useful for installing browser plug-ins and ActiveX controls)
  3. I cannot modify Start menu shortcuts to always start with Run Elevated because I don't have permission to edit them but I cannot open Explorer with elevated privileges.

Tom Bihn "Brain Cell" or "Monolith"???

I'm off to PDC in September and will be hauling my 12 inch tablet PC around at the conference.  I used to tote my notebook around in a shoulder bag.  In the past year or so I switched to a Roots backpack that is extremely practical and a bit more interesting than your typical Targus bag.  It's nice but designed for a 15" notebook plus lots of other junk so it is pretty empty with just my tablet, power adapter, and Logitech V500 cordless travel mouse (highly recommended).  I would like to have something a little less bulky for the PDC.  A notebook sleeve with an optional shoulder strap would be perfect because I could stick it in a backpack or messenger bag for flights and just use the sleeve other times.  I have been researching the Tom Bihn Brain Cell and Monolith sleeves/cases.  The Brain Cell seems like the better choice since it has an exterior pocket to hold my power adapter (it's tiny).  But the Brain Cell closes at the top with a pretty heavy duty Velcro-like fastener (Aplix).  I've read that it is quite loud to open, which I'm thinking would be awkward if I wanted to pull out my tablet to take notes during a conference session.  The Monolith has a zipper instead of Aplix but it has no exterior pocket for a power adapter.  Even though my Centrino powered tablet has exceptional battery life, I'd rather have my power brick on hand if needed.  What I really want is a Brain Cell with a zipper instead of Aplix.  I think I will call Tom Bihn to see if such a thing exists.

Does anyone out there have other suggestions?

Font size in pixels: a terrible Web design sin

OK, confession time.  I have worked on Web apps that used CSS files that have font size defined in pixels.  Most often this has not been my choice but something that came from a graphic designer.  It drives me nuts when a graphic design is so rigid that it cannot support relative font sizes.  In fact, it offends me as a user when I cannot adjust the text so I can read it comfortably.  Such a design is, in fact, a bad design even if it is beautiful.

I have been more bothered than usual about fixed font size on the Web since I got my amazing, wonderful, amazing, beautiful, and amazingly practical Toshiba Portege M200 Tablet PC (yes, I like it a lot).  My M200 has a fantastic 12 inch screen that runs at 1400 by 1050.  I absolutely love the size and resolution, especially for developing, writing, or researching when I can really take advantage of all the screen real estate.  But quite often I come across sites where the font is extremely hard to read.  9px might look OK at 1024x768 over 15" and at 1280x1024 over 17", but it's pretty hard to read from arm's length away on my high-res 12 inch screen.  If the font is fixed, I'll move on.

I'm not the only one with this gripe.  For that matter, I'm sure there are plenty of users like my mom who would move on even with relative fonts if the initial size is too small.  With Internet Explorer on my tablet, 0.5em Arial is basically unreadable unless I enlarge the default text size.  A great many users either will not know how or will not make the effort to enlarge the font unless they are already extremely committed to looking at your content.  That does not bode well for broad audience sites, especially those looking to convert visitors into customers.

I admit that I have been guilty of not fighting hard enough against this design sin.  Unfortunately on many projects it is somewhere between improbable to impossible to get the graphic design fixed after marketing and other executives have gone through a selection and approval process, especially when an expensive outside marketing or design firm was involved.  Web developers are often not involved early enough in the process to provide parameters for the graphic design.  Or perhaps we assume that a professional graphic designer might have some inkling about basic Web usability.  Or perhaps we forget or neglect to address the issue early enough.  Or perhaps, worst of all, we don't realize there is a problem or don't care.  [Frankly I don't understand the "don't care" mentality as I take a great deal of pride in my work, but I acknowledge that there are folks out there just working to pay the mortgage.  I just don't understand it.]

The great hypocrisy underlying this post is the Web site for my .NET consulting company.  I fell in love with the graphic design and turned a blind eye to the fixed size fonts.  Later on I experimented a little bit with relative fonts but the design did not look right and everyone had billable work to do so it ended up on the back burner.  But soon all will be well.  For several months I have been hatching a plan to turn www.ardentdev.com into a developer resource site featuring blog and article contributions from my most excellent development staff, including an "ask the experts" option that will let you pose a question to my dev team.  We will do our best to answer your question in a future post or forward you on to someone who can answer it.  Bookmark the site now and check back in September for the new design and content.

Aero Glass with ATI Radeon 9800 Pro

I am running Windows Vista on a P4 3.0 GHz (hyperthreading enabled) with 2GB RAM and an ATI Radeon 9800 Pro video card (AGP, 128MB RAM if I recall correctly). I had some strange video problems initially - lots of wonkiness like strange on-screen artifacts, locking, and spontaneous rebooting. After some trial and error with drivers, etc. I noticed that the cooling fan on my video card was not plugged in!!! Gasp... Since this is a work computer, I don't really tax my video card [an employee told me I didn't deserve to have that card in my machine :) ]. It would seem that the 3D effects and such in Vista (Glass / Desktop Windows Manager) were the first things to really put my card through its paces and cause it to overheat. Or at least that's my theory. And now I'm worried that I may have damaged the card. Oh well...

Once the fan was plugged in and I gave the card some time to cool off, things were much more stable. Now the LDDM (Longhorn Display Driver Model) drivers from ATI are working great and I get all the pretty Aero Glass and assorted effects. Note: Read the "How to Install" guide for the ATI Catalyst beta driver. If the description in Device Manager says "(Microsoft Corporation)" rather than "(LDDM)", you are not using the right driver if you want to see the eye candy.

Well, I *WAS* getting all the pretty effects. I'm not sure what happened but I lost Glass today. Everything reverted to the Metal look that you get when using a WDM (Windows Driver Model) driver. Device Manager reported that I was using the LDDM driver from ATI. The Ctrl+F9 (or Ctrl+Shift+F9?) trick for enabling Glass was useless. It was very baffling. Eventually I found a little registry hack online to enable Glass that finally worked: Create a DWORD called Glass with a value of 1 under HKLM\Software\Microsoft\DWM. Note: I had to create the DWM key.

Everything I have read says that Glass is enabled automatically with a supported video card (i.e., card plus the appropriate LDDM driver). In my digging around I heard that the Radeon 9800 Pro is an extremely popular / common video card in Redmond. Cool stuff! Well, other than mine not working right...

My one complaint right now is that 5 of the 6 icons in my Quick Launch toolbar are black boxes. The only one showing correctly is Media Player. Show Desktop, IE, Outlook, Vault, and Visual Studio are all black squares. It's very frustrating as I am addicted to my Quick Launch bar.

P.S. - Big thanks to Adamga for tolerating my recent slew of Longhorn/Vista questions and troubleshooting problems.

Installing Macromedia Flash Player for IE7 on Windows Vista
I had some trouble installing Macromedia Flash Player on Windows Vista because I have UAP turned on. I did not receive a Windows Security box ("This action requires administrative rights") so the install would simply fail. So instead I downloaded the Flash Player standalone installer for Internet Explorer via a Macromedia knowledgebase technote. Once downloaded, I right-clicked on the installer and chose Run Elevated. Worked like a charm.
Running Windows Vista on my desktop
I have bravely been running Windows Vista on my desktop since last week. Fun stuff. I had some trouble initially but things are mostly good now. I will try to post as much as I can about problems I have encountered.
"Introducing Visual Basic 2005" book is now free online

In a somewhat surreal moment, I discovered via the Visual Studio 2005 Start Page that the book I coauthored for MS Press on Visual Basic 2005 is now available online for free!  Cool.  If you like it, feel free to order the dead tree version.  :)

Be sure to check out the cover picture.  I think it is a great metaphor for Visual Basic as a tool.

More Posts