... bad API ... head is spinning ...

[mithriltabby]

Access control isn’t exactly a simple topic, but Microsoft really aren’t going out of their way to make life easy for developers who have to deal with it. Why, oh why, can’t they make a simple API with straightforward functions for manipulating things, and then provide source code for standard helper functions that use the simple API, instead of having umpty-bazillion redundant functions?

Comments

[trogula.livejournal.com]

Two words: Backwards Compatibility.

The two most feared words from a winderz developer perspective. Microsoft seems to enjoy reinventing it's own wheels every couple of years, and add layer upon layer of cruft so that shitty win3.1 programs can still be run on winxp.

E-vil.

[mithriltabby]

I’m not sure it’s even that. There’s just a general disregard for encapsulation— there are functions to retrieve a SECURITY_DESCRIPTOR and read a bunch of value out of the SECURITY_DESCRIPTOR, and there are other functions for just reading the values out of the SECURITY_DESCRIPTOR. There are functions to create a particular sort of ACE and add it to the end of an ACL, and functions to add a pregenerated ACE anywhere you want in an ACL, but there’s nothing to help generate ACEs. This API needs to be pruned back like a sick rosebush.

[mithriltabby]

And, just for added fun, you free the result of ConvertStringSidToSid() with LocalFree(), but you free the result of AllocateAndInitializeSid() with FreeSid()! The inconsistency is amazing!