[001spartan]

Even Windows gets this wrong at times, with several UAC bypass techniques exposed by auto-elevating binaries. Still, Microsoft has done a great deal of work with the Windows privilege model to prevent things like this, and these issues are steadily being resolved.

[gruez]

>with several UAC bypass techniques exposed by auto-elevating binaries

According to Raymond Chen, a MSFT employee:

>There really are only two [UAC] settings.

>* Always notify

>* Meh

https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94...

[mehrdadn]

https://www.networkworld.com/article/2295224/microsoft--uac-...

[orf]

Pasting a random article from 2007 with no other comment is not a great rebuttal of what they said.

A _lot_ has changed since 2007.

[mehrdadn]

I'm pretty sure the fact that it's not a security boundary has not changed since 2007. They should've probably marketed it better to clarify this, but that's not a technical issue. It was always a horrible idea to run a malicious program under your credentials relying on UAC to enforce any security. That's never changed.