Windows installer bug: VLC.exe run with elevated privileges
When using the Windows installer on Windows 7/Vista (with UAC), and the user allows the installer to run VLC at the end of the install, VLC.exe is run with the same elevated privileges that the installer has.
This is a bug because:
-
It disables drag-drop of files onto the VLC window due to Windows restrictions on interaction with programs running with elevated privileges [a]. Many users will assume that VLC no longer supports drag-drop, there are many bug reports spanning several years in forums related to this [b][c][d]. It gives a bad first impression to the user.
-
It's a security issue. Any security related bugs in VLC could be more destructive due to the elevated privileges. Other programs opened via VLC will also inherit the elevated privileges and so on.
It seems this bug has been around for some time and was fixed (or attempted to be fixed) in 2009 [e].
If the bug cannot be fixed perhaps the option to run VLC and open the readme file could be removed from the installer.
Links:
[a] http://en.wikipedia.org/wiki/User_Interface_Privilege_Isolation
[b] http://mailman.videolan.org/pipermail/vlc/2008-November/016258.html
[c] http://forum.videolan.org/viewtopic.php?f=14&t=98648