My favorite Access keyboard commands - part 2

re: My favorite Access keyboard commands

ken — Thu, 22 Feb 2007 22:57:44 GMT

Sorry for the OT but it's important.

From "Macro improvements of Access 2007"

Clint:

"I'm not the security expert on our team and my views don't represent the views of Microsoft or the Access team. We might even see Suraj (our security expert drop by if he gets a chance).

I don't think you will ever see MS changing the security settings to low. There are just too many things that can go wrong. Keep in mind, the security setting effects all Office documents such as Word and Excel. I think most people that get an Excel doc will expect it to be safe. Most of the security hacks these days are social engineering hacks where you trick someone into running your software without realizing it could be dangerous. The security dialog makes people understand the application could run code.

You don't get a security dialog when you run Notepad because Notepad won't ever do anything wrong. You don't get a security dialog when you run .Net apps because you got it when you installed it.

Unfortunately, there are lots of bad people that have invested interest in doing harm to others computers. Given the bad things that have happened to Microsoft customers--the company has to take this issue very seriously"

.............................

Clint, we are developers that distribute Runtime .MDE/ADE applications to our customers.

An Access Runtime application must be (virtually) similar to a compiled .exe or .NET application.

It's a big mistake to *force* us to buy the sagekey scripts.

In my opinion the Access developer team don't know (or simply it ignores) the needs of Access/VBA developers.

Microsoft Access-Runtime-edition isn't an Office application for final users!

Bye

re: My favorite Access keyboard commands

Clint Covington — Fri, 23 Feb 2007 03:38:42 GMT

Thanks Ken,

I will pass your feedback along to the Access team. I know they are looking at different deployment options.

re: My favorite Access keyboard commands

AL — Sat, 24 Feb 2007 00:28:22 GMT

Of course, I have to agree with ken 200%. After some Google or UA investigation, it is trivial for any programmer to inactivate the security warnings, the same way that SageKey does it. This of course means that any malicious hacker can do the same thing. So really, what's the value of this, other than annoying people.

IOW, the security warnings do nothing to enhance security, but are a great embarrassment for developers and a great annoyance to end-users.

At the same time, there is not even a peep in the help files about the dangers of SQL injection to delete all of my data, and not a peep about the dangers of using SQL Server security to apply permissions that can then be used outside of the Access application. When will Access support application roles, which provide much better security and performance? (Some time ago, you or Eric said you would try to look into it, but we have not heard back.)

Please try to understand that this current approach to "security" simply does not work in practice. I suggest that the next blog post be used to solicit users' concerns and suggestions about Access security issues. You can add a poll that asks developers: "Who likes the current "security model."

Having said all that, I want to thank you gain for making this blog and keeping open the lines of communication. I, for one, really appreciate it!

re: My favorite Access keyboard commands

Clint Covington — Sun, 25 Feb 2007 07:33:59 GMT

Please keep in mind, a malicious hacker can't modify the low security settings without tricking you into running code on the system. The only way the SageKey system might be allowed to do it is because someone trusts the person installing the code.

I understand there are some frustrations with the current security model. Trusted Locations does help in many scenarios but not all. I will pass along the feedback to the people that manage those decisions.

re: My favorite Access keyboard commands

Clint Covington — Mon, 26 Feb 2007 23:19:42 GMT

I did more research on this topic--I'm not that connected to the runtime these days. It turns out--I gave you some wrong information (sorry about that). When you create the runtime MSI the runtime will add a trusted folder reg key for your data folder. This means, we will run your application without security prompts without lowering all of your Office security settings. T

Happy?

re: My favorite Access keyboard commands

AL — Wed, 28 Feb 2007 05:31:10 GMT

:-) :-) :-) :-) :-) :-) :-) :-) :-) :-) :-)

(Yes, Thank you!)