It’s official - Vista’s UAC was designed to annoy users. The idea was to piss them off enough that they’d beat on the ISV’s to make them change their software so it didn’t trigger UAC prompts anymore. So that’s at least one feature in Vista that’s a rip-roaring success then.
To be fair, it’s a bitter pill that had to be swallowed. Microsoft built OSs for decades that were concentrated on flaunting all their wares to developers with little or no protection; because you know, security just gets in the way and all those rookie developers get upset when things are difficult. It was only a matter of time before such a weak design bit them on the arse, and as anyone knows fixing a fundamental design / architecture issue is by far the most painful thing to have to do. They can blame the ISVs, but they set the tone and the philosophy in the first place and the sheep just followed, they can’t really complain about that. Mainframe developers I knew 15 years ago would shake their head in desperation when they saw the kind of architectures Microsoft were building and advocating, and here we are now with all the ‘old’ techniques finally coming back in - hypervisors, VMs, secure rings, non-privileged users. It’s really not that these things are new, it’s just that for 20 years some people thought they didn’t need them. They were wrong, and all the mainframe / Unix guys can sit back and be smug about it now.
The ‘implement now, design later’ approach is popular with Finance departments hacking together Excel/VBScript-based ‘applications’ that the IT department has to try to rescue 3 years later when the gaffer tape and string finally can’t hold it together anymore (and if you’ve had to do this too, we can cry into our beer about it together sometime), but developers should be smarter than this. Yes, agile development is important, and turnaround is important, but there’s a minimum level of design and good engineering you need to do to make sure you’re not building on sand. Microsoft has always been pretty weak in this area IMO, whether it’s the OS, code samples, the .Net ‘framework’ (too many low-level code tricks, not enough framework - which they now finally seem to be realising with MVC, Linq for Entities). This particular sand has held up for far longer than it really should have, but ultimately it’s just made the eventual transition more painful. I only hope they’ve learned from it.