hi,
1- put the Install Rules button somewhere in the setting not on main window. Too easy to click it by error then it reload all the vendors we have deleted.
2- make the small handle in the alerts (the one that allow to display the privileges, etc...) more visible , it is actually too small , people with bad sight will miss it.
Thanks for your suggestions. Install Rules button relocation is planned on the next release. Issue with small slider icon is added to our TODO list.
not urgent because mostly aesthetic feature:
- offer the choice of the isolation border's color.
- add "Setting" link in tray icon options.
- add "Program" link in tray icon options.
- replace "expert/normal/light/training/disabled" in tray icon by just "Levels" which when mouse-overed open a submenu offering the different levels; will reduce height of the main menu.
- as i said in another thread ( https://forum.re-crypt.com/index.php?topic=2088.0) replace "Normal" and "Light terms".
Light: to "sandbox only" , "sandbox mode" , "isolation" , would be simpler to grasp its concept for beginners.
Normal: to "HIPS", "HIPS mode",etc... (this one may not need rewording)
It's a good idea to rename some protection levels. I suggest to rename Light mode firstly as most of the users don't know what does HIPS mean.
Quote from: schelkunov on April 18, 2016, 11:00:54 AM
I suggest to rename Light mode firstly as most of the users don't know what does HIPS mean.
correct
sometimes, the alert when launching a new apps doesn't appears at the foreground of the desktop, and stay hidden behind an opened window; i clicked 4 times on the apps thinking it didn't execute before realizing the alert was not in the foreground.
Quote from: umbrapolaris on April 18, 2016, 11:23:15 AM
sometimes, the alert when launching a new apps doesn't appears at the foreground of the desktop, and stay hidden behind an opened window; i clicked 4 times on the apps thinking it didn't execute before realizing the alert was not in the foreground.
It seems you clicked on some other window before alert appeared. One of the solutions is you can set "Alerts Always on Top" checkbox in settings.
Small point. In the help file (and elsewhere in settings) rename Windows Protection /"Rename windows prefix and Rename windows postfix" to "Rename windows prefix and Rename windows suffix".
You suggest to change "postfix" to "suffix"? There are no native english-speakers in ReCrypt team. I googled for differences and didn't find any critical. Suffix is more widespread, but we wanted to emphasize that there is PREfix and there is POSTfix. Am I missing something?
Postfix = suffix = ending. They are the same.
In English, customary use is suffix.
Postfix or suffix is proper, but postfix is rarely used.
Since postfix = suffix, I don't see any reason to fix it.
never heard about postfix lol :p
Quote from: HJLBX on May 24, 2016, 05:47:32 PM
Postfix = suffix = ending. They are the same.
In English, customary use is suffix.
Postfix or suffix is proper, but postfix is rarely used.
Since postfix = suffix, I don't see any reason to fix it.
I've just checked in the Concise Oxford dictionary and there is no such word as postfix. The correct word
is suffix!
Would it be worth considering an 'Install Mode' like NVT ERP, for installing new software - or would that be too much of a compromise of ReHIPS?
Quote from: paulderdash on June 02, 2016, 10:42:52 AM
Would it be worth considering an 'Install Mode' like NVT ERP, for installing new software - or would that be too much of a compromise of ReHIPS?
It has a learning mode. What will the difference be from learning to install?
You're right - none! :)
Quote from: paulderdash on June 02, 2016, 10:42:52 AM
Would it be worth considering an 'Install Mode' like NVT ERP, for installing new software - or would that be too much of a compromise of ReHIPS?
An "Install Mode" - like SpyShelter and NVT ERP where they will auto-create rules was submitted as a feature request already.
I think ReCrypt is considering it.
We've got Install Mode suggestion in our TODO list. But truth to tell, I haven't looked into yet, how it's implemented in other software so it could be familiar to users, so I can't say anything about it now.
A small cosmetic/usability suggestion:
On the context menu, the legend "Protection Mode:" has gray fonts. I'd like it instead with bold letters or different color:
(http://i.imgur.com/Wl97txg.png)
Quote from: Mr.X on June 04, 2016, 09:00:35 PM
A small cosmetic/usability suggestion:
On the context menu, the legend "Protection Mode:" has gray fonts. I'd like it instead with bold letters or different color:
(http://i.imgur.com/Wl97txg.png)
Thanks for your suggestion. We'll think about it.
I need to stop blocked programs popups every time they want to run. Kind of annoying. Thanks.
Just remove unwanted checks in Settings, Logs tab from Pop-Up column.
Could I make a suggestion regarding when you set ReHips - Protection mode to Disabled. I think there should be a pop up warning regarding disabling protection something like "Are you sure you wish to disable protection" with the options to confirm/OK and cancel.
Also may I add another suggestion when you open ReHIPS Control Center and tick on Settings>Program tab I naturally try to tick on the word SYSTEM or "USERNAME" to expand, instead of the small arrows placed before the text. I've attached the screenshot regarding this issue.
Thank you
Quote from: fixer on June 13, 2016, 09:22:12 PM
Just remove unwanted checks in Settings, Logs tab from Pop-Up column.
Got it. Thanks.
Quote from: Noverco on June 13, 2016, 10:25:15 PM
Could I make a suggestion regarding when you set ReHips - Protection mode to Disabled. I think there should be a pop up warning regarding disabling protection something like "Are you sure you wish to disable protection" with the options to confirm/OK and cancel.
Also may I add another suggestion when you open ReHIPS Control Center and tick on Settings>Program tab I naturally try to tick on the word SYSTEM or "USERNAME" to expand, instead of the small arrows placed before the text. I've attached the screenshot regarding this issue.
Thank you
Thanks for your suggestions. We will think about warning message before disabling protection.
Classic tree component doesn't expand with single mouse click, only with double click. At the same time we already bound double click on tree element to edit and we don't want to mix them.
Thank you fixer, I appreciate your consideration regarding my suggestion - warning the user when disabling protection. Thanks for your reason regarding not mixing clicking of the tree(root) and edit of a tree element.
When replacing a command line (eg :- Norton Security) with a wildcard to prevent repeated Alerts from ReHIPS.
I had to manually delete the related command lines for NS, which are no longer necessary.
As a suggestion could ReHIPs auto clean up the unnecessary command lines which are replaced with wildcard?
Thank you aDVll for suggesting I post this here, hope it is ok to quote you.
Quote from aDVll "No it doesn't but this is a great suggestion. It should check which commands become irrelevant when you make a command line with * and ask you if you want to delete them"
Quote from fixer
"ReHIPS GUI for security purposes requires administrator account (doesn't matter elevated to the real admin or using limited token) to connect to the Service and control it. The Service checks if the connecting process was started by a user from Administrator group. If not, it disconnects. This was done for security purposes to restrict other non-admin users to control ReHIPS.
Recently there were some changes in this policy. Service now supports connections from both administrators and users from the whitelist. But GUI part doesn't support it yet though, will be implemented later. But if you can't wait, you can edit the xml database manually"
As a suggestion when the implementation of autostarting in SUA is available in a future version of ReHIPS, when ReHIPS GUI is lauched in an admin account have the option with in the ReHIPS GUI to allow SUA access to the ReHIPS GUI without triggering UAC (this option greyed out when in SUA account). Could in the form of :-
Do you wish SUA access to ReHIPS GUI (skip UAC) yes or no (ticking either yes or no)
If ticked the yes option then a list of SUA's which are available on the pc.
List of Standard User accounts
username 1 Yes No (tick yes - skip UAC and allow autostart of ReHIPS GUI or tick no which when ReHIPS GUI lauched triggers UAC for admin password when launched)
username 2 Yes No (as above)
I think this may or may not help with the "security purposes to restrict other non-admin users to control ReHIPS"
ReHIPS GUI won't require admin to run. At first it'll be just a list of standard users who are allowed to control ReHIPS, they'll have full access just like admins. Later maybe some fine grained control will be added like this user is allowed to do this, but denied to do that.
Thank you fixer, nice to have an insight into how access to ReHIPs GUI will develop.
Just a suggestion:
can you make a division in Trusted Vendors and/or Trusted Command Lines that would show what command lines are added by RulesPack and added by the user through decision or the learning mode? I'm not sure if this would be relevant, but it would help users to easily navigate through Trusted Vendors and Trusted Command Lines, and help for troubleshooting purposes.
We think about replacing RulesPack (it installs initial predefined rules) with RulesManager. It allows to import, export and edit initial rules and settings in any way. Thus if user gains control over initial rules, there will be no point in marking some rules or trusted entities as user-edited as initial rules themselves can already be user-edited. Besides adding trusted entities won't break anything, so I don't think it'll require troubleshooting. Removing them may break (this is putting it too strongly, it won't actually break, just may cause alerts), but no trusted entity is automatically removed. We'll think about your suggestion, but at the moment I don't think it's worth the effort.
Quote from: fixer on June 24, 2016, 12:53:28 PM
We think about replacing RulesPack (it installs initial predefined rules) with RulesManager. It allows to import, export and edit initial rules and settings in any way. Thus if user gains control over initial rules, there will be no point in marking some rules or trusted entities as user-edited as initial rules themselves can already be user-edited. Besides adding trusted entities won't break anything, so I don't think it'll require troubleshooting. Removing them may break (this is putting it too strongly, it won't actually break, just may cause alerts), but no trusted entity is automatically removed. We'll think about your suggestion, but at the moment I don't think it's worth the effort.
That's more like it, fixer! ;)
Nevermind my suggestion. Yours should be better. ;)
Can you guys consider moving lockdown mode in gui taskbar icon so we can access it easier? Thanks.
Quote from: aDVll on July 30, 2016, 10:12:12 AM
Can you guys consider moving lockdown mode in gui taskbar icon so we can access it easier? Thanks.
Hi aDVll, I agree with you, I think that would be a great idea, I hope this gets implemented :)
EDIT: Interestingly, I am always in lockdown mode, but if I have a program which is blocked in lockdown mode I just right click on ReHips Taskbar icon> select learning mode then launch the blocked program and the reselect Expert mode.
I checked that under ReHips GUI>Settings>Protection, that lock-down mode is still ticked.
I am sure, if not maybe fixer may correct me, that with this method you are still in lockdown mode.
Hi everyone, I have blocked certain vulnerable processes from executing in ReHips GUI>Settings>Programs>SYSTEM>Un-bound programs(blocked) and also with Admin account. But my standard user account did not appear at the time under GUI>Settings>Programs as I have just recently installed on main pc I did not login to my standard user account since installing Rehips.
I have now logged into my standard account and it has appeared under GUI>Settings>Programs.
Is there anyway I can copy my blocked vulnerable processes from either SYSTEM or Admin account under GUI>Settings>Programs or do I have to re enter/block them again for my standard user account?
Quote from: Noverco on July 30, 2016, 03:45:25 PM
Is there anyway I can copy my blocked vulnerable processes from either SYSTEM or Admin account under GUI>Settings>Programs or do I have to re enter/block them again for my standard user account?
Unfortunately now you have to block programs again. But for future versions we're considering making RulesManager public that enables user to make his/her own rules and then install them for all users (including SYSTEM).
Quote from: Noverco on July 30, 2016, 03:15:24 PM
I am sure, if not maybe fixer may correct me, that with this method you are still in lockdown mode.
Lockdown mode is intended to be something like silent mode. If any alert would appear without lockdown, in lockdown it will be blocked. So in Expert mode pretty much everything unknown and changed is blocked. But Learning mode doesn't show alerts, it learns and allows new programs, so lockdown is kinda useless in Learning.
Quote from: fixer on July 30, 2016, 06:11:47 PM
Unfortunately now you have to block programs again. But for future versions we're considering making RulesManager public that enables user to make his/her own rules and then install them for all users (including SYSTEM).
Thank you fixer, I will re block vulnerable processes in my standard user account, RulesManager sounds very interesting indeed :)
Quote from: fixer on July 30, 2016, 06:11:47 PM
Lockdown mode is intended to be something like silent mode. If any alert would appear without lockdown, in lockdown it will be blocked. So in Expert mode pretty much everything unknown and changed is blocked. But Learning mode doesn't show alerts, it learns and allows new programs, so lockdown is kinda useless in Learning.
Thanks fixer, I agree lockdown mode is useless in learning mode. Sorry for the confusion. So if I forgotten to allow a program to launch and gets block in lockdown mode, I then right click on rehips taskbar icon and select learning mode and i am able to then launch successfully the program which was blocked in lockdown mode.
If I then switch back to expert mode, do I have to untick lockdown mode in ReHips GUI>Settings>Protection, that lock-down mode is still ticked. and re-tick lockdown in order to re-enable lockdown mode. Does that make any sense?
So why can I switch to learning mode when in GUI>Settings>Protection, that lock-down mode is still ticked(enabled)?
Shouldn't Rehips automatically disable (untick lockdown mode in GUI>Settings>Protection) when the user changes to a different mode?
Lockdown option was designed to enable ReHIPS operation completely without user intervention: without any alerts, questions, etc. This makes possible headless mode when ReHIPS operates without GUI at all. So we made any mode (Expert, Learning, etc.) support this option without disabling/enabling it automatically as it may create complicated dependencies and questions like I haven't touched this checkbox, why has it changed.
Quote from: fixer on July 30, 2016, 08:07:56 PM
Lockdown option was designed to enable ReHIPS operation completely without user intervention: without any alerts, questions, etc. This makes possible headless mode when ReHIPS operates without GUI at all. So we made any mode (Expert, Learning, etc.) support this option without disabling/enabling it automatically as it may create complicated dependencies and questions like I haven't touched this checkbox, why has it changed.
Thank you fixer, once again for your assistance and explanation. I see yes that could certainly be an issue ;)
I think the default log line limit needs to be changed because it's too low. In a few hours you passed that. I know we still have logs in event viewer but i guess it would help new users.
Quote from: aDVll on August 09, 2016, 01:24:29 PM
I think the default log line limit needs to be changed because it's too low. In a few hours you passed that. I know we still have logs in event viewer but i guess it would help new users.
Thanks for your suggestion. We will think about it along with https://forum.re-crypt.com/index.php?topic=2030.0.
Quote from: crasher on August 09, 2016, 11:34:21 PM
Quote from: aDVll on August 09, 2016, 01:24:29 PM
I think the default log line limit needs to be changed because it's too low. In a few hours you passed that. I know we still have logs in event viewer but i guess it would help new users.
Thanks for your suggestion. We will think about it along with https://forum.re-crypt.com/index.php?topic=2030.0.
Oh you are correct. HJLBX was faster but i somehow missed that topic. Thanks for the link.
for programs that open by default on separate desktop, it should offer the user a choice for "same desktop (reduced security)"
EDIT: the option already exists, but should be made more obvious.
idea is like this: first time such a program runs, the user sees a little superimposed window saying: "continue with separate desktop, or use same desktop (reduced security)?"
Thanks for your suggestion, we'll think about it.