[vmpaul]

This came up in this thread and I thought it was a big enough question not to be buried.

In Panther, if you have apps running when you switch users using User Switching, are those apps available to the new User? There appears to be some disagreement whether or not they are.

If not, it would seem to be a major de-valuing of the whole concept, wouldn't you think?

[fitter]

Originally posted by vmpaul:
In Panther, if you have apps running when you switch users using User Switching, are those apps available to the new User?

Yes, they are available.

[vmpaul]

Originally posted by fitter:
Yes, they are available.

Including iTunes and the other users shared library?

[larkost]

Whether the apps are available depends on how the application was written. Most small applications don't put lock on any resources, and so they would never even know if you ran multiple instances.

Other Applications do need to put lock on some files, and then the question becomes: does the application put a lock on a shared file.Two examples in this case could be OmniWeb and Quark:

OmniWeb puts a lock on a few of it's preference files (history, preferences, and bookmarks), but since each of these files resides in a the user's home directory, and different users naturally have different home directories... so OmniWeb can be used by multiple logins simultaneously.

Quark however is a bad application and places its lock files in the same folder as the Application. So when two people go to open it they will compete for the same files, and one will loose.

The last case is programs that have a client-server architecture. Most of these (MySQL, etc..) will have no problems at all. But there may be some applications that have a problem with multiple clients logging in at the same time. These will fail (but non of them come to mind).

[laxthxdude]

iTunes does not run in Panther on more than 1 users account - it comes up and says that the program is already in use by another user. I tried making a copy of iTunes and putting it in a different location, but that didn't work either. That is the only app I've seen so far that has this limitation.

[Angus_D]

It launches another instance of that application. At the moment, a few apps will probably check to see if they're already running and fail if there's already another instance, no matter what user it's under, but they will undoubtedly be fixed.

So, User A will have one copy of iTunes running under their user name, with their library; User B will have another copy of iTunes running under their user name, with their library.

[sandsl]

Originally posted by laxthxdude:
iTunes does not run in Panther on more than 1 users account - it comes up and says that the program is already in use by another user. I tried making a copy of iTunes and putting it in a different location, but that didn't work either. That is the only app I've seen so far that has this limitation.

It does work across mutilple accounts simultaneously for me (Panther 7B44). Obviously Apple could have disabled this in new builds.

[eklipse]

What's with the security warning you get when you enable fast user switching?

What does enabling it do that can potentially reduce security?

[Brass]

Originally posted by vmpaul:
switch users using User Switching

Wow... say that 10 times fast!

[vmpaul]

Originally posted by Brass:
Wow... say that 10 times fast!

Ha. I was punctuation-challenged.

Not having Panther I wasn't sure of all the terms.

[Catfish_Man]

Early versions of 10.3 certainly allowed for multiple iTunes instances (the music would keep playing when you switched). The person who first posted this (if I remember the post correctly) is a friend of mine, and is running 7B53.

[mikemako]

Is it possible to return to the Welcome screen without logging out? I poked around and didn't see if this was possible. If so, does music keep playing if you return to the Welcome screen?

[laxthxdude]

iTunes keeps playing for the first user, but will not launch for the second user (actually it re-adjusts the volume based on the second user)...

You cannot open the application "iTunes" because another user has it open.

Ask the other user to quit the application, then try again.

[- - e r i k - -]

Originally posted by eklipse:
What's with the security warning you get when you enable fast user switching?

What does enabling it do that can potentially reduce security?

Not much. If a malicious hacker has physical access to your machine you're pretty much ****ed anyway.

Only share your mac with people you trust naturally

[utidjian]

Originally posted by - - e r i k - -:
Not much. If a malicious hacker has physical access to your machine you're pretty much ****ed anyway.

Only share your mac with people you trust naturally

For me it is not possible to only share my Macs with people I trust naturally. I administer several labs full of Macs in a small college. Basically we:
* Set OF passwords and lock the cases.
* Change perms on /usr/bin/ni stuff.
* Keep updated.
* Don't enable any non-secure services.
That takes care of most of the stuff.

One of the problems with fast user switching (fus) is that certain applications need access to more than just a users files. In the case of something like iTunes it needs access to the various audio devices and removeable media devices. Say one user is "rip-mix-burning" in iTunes and another user comes along and wants to check email... they just fus and check their email... no biggy. But what if that email has an audio or video attachment... how is the system to determine who has access to the speakers? Naturally if one user is burning a CD then another user can not have access to it. If one user even has a CD mounted (or DVD) then the other user should not be able to access it. I haven't tried fus yet in Panther but I will bet that a second user can not even eject a CD and put in their own under most circumstances.
Another example... what happens with the video output of the iSight when users switch?
Where does the output of a microphone device go when users switch?
Who can read/write from/to a camera, firewire drive, tape, usb drive, external CD-RW/DVD-R? Does it depend on who plugged it in or who first accessed the device or who is running the app that uses it?
As you can see (imagine?) it is more complicated than just plain old switching the entire permissions context from one user to another.

Then... what about users that are remotely logged in?

[GENERAL_SMILEY]

I'm sure it isn't possible, but can a user remote desktop into a mac on one account while another user is operating it with a different account.

Not that clear I'm afraid, but I'm tired and it is a Friday.

[Richyfp]

Looking at the problem from a hardware perspective, rather than from the file locking perspective (which can be overcome by better programming techniques), I can see that the following is true.

For the purposes of multiple users on the same machine, hardware devices may be divided into 2 categories:

• those that can be left to complete a task without the user being present (eg printer, CD-RW, RAM, hard drive, processor etc...)
• those that can only usefully be used when the user is present (eg monitor, headphones, keyboard, mouse, iSight etc...)

For devices that can only be used when the user is present, full control should be handed over to the current user of the computer. For devices that can be used without the presence of a user, control should be left with the user who first used that device.

Some devices are, of course, able to function perfectly well between users, such as the processor (through multitasking), the hard drive and RAM (through fast random access to data) and printers (through a system-wide printer queue) and these do not present a problem with fast user switching.

Devices that finish a task set by the first user while a second user is using the machine (eg burning a CD-RW) should hand control over the second user once the task is finished only if the first user has permitted it (eg by specifying that the CD-RW should be ejected once it has finished burning)

[OwlBoy]

Damn, playing 2 songs in 2 iTunes on 2 accounts at the same time was so fun

-Owl

[K++]

Originally posted by utidjian:
For me it is not possible to only share my Macs with people I trust naturally. I administer several labs full of Macs in a small college. Basically we:
* Set OF passwords and lock the cases.
* Change perms on /usr/bin/ni stuff.
* Keep updated.
* Don't enable any non-secure services.
That takes care of most of the stuff.

Thats not bad, but more can be done.

One of the problems with fast user switching (fus) is that certain applications need access to more than just a users files. In the case of something like iTunes it needs access to the various audio devices and removeable media devices. Say one user is "rip-mix-burning" in iTunes and another user comes along and wants to check email... they just fus and check their email... no biggy. But what if that email has an audio or video attachment... how is the system to determine who has access to the speakers?

This is not a linux. No one user ever has control of a hardware device in the way that Linux does it. Ever notice the fact that you still get error beeps while songs are being played in iTunes. The same reason that works is why hardware devices have no problem being used by several applications/users.

Naturally if one user is burning a CD then another user can not have access to it. If one user even has a CD mounted (or DVD) then the other user should not be able to access it. I haven't tried fus yet in Panther but I will bet that a second user can not even eject a CD and put in their own under most circumstances.

I see no reason why the next user should not be able to eject the cd drive, the restrictions you mention are too UNIX/windowsesque to ever be put on a mac system. Especially if you consider that the whole point is that its to let those that share a machine not have to log out in order to use it one at a time.

Another example... what happens with the video output of the iSight when users switch?
Where does the output of a microphone device go when users switch?
Who can read/write from/to a camera, firewire drive, tape, usb drive, external CD-RW/DVD-R? Does it depend on who plugged it in or who first accessed the device or who is running the app that uses it?
As you can see (imagine?) it is more complicated than just plain old switching the entire permissions context from one user to another.

Then... what about users that are remotely logged in?

Again stop thinking in UNIX terms, like devices, start thinking in a more mac way. For example a microphone can be used in several apps at once, some people think that this is a weakness, that Macs don't lock on devices but its one thing I really appreciate. The only issue that would really be a hurdle is one user doing a long task utilizing a piece of hardware. Merely because at the lowest level Mac OS X is UNIX this is one place where they will have to wait till its done. I would assume that only the burning a CD would keep another user from using the cd drive.

[utidjian]

Originally posted by K++:
This is not a linux. No one user ever has control of a hardware device in the way that Linux does it. Ever notice the fact that you still get error beeps while songs are being played in iTunes. The same reason that works is why hardware devices have no problem being used by several applications/users.

I have no doubt that it may have to be different than the way Linux does it.
I have never noticed error beeps in iTunes. I have never played with Mac OS X fus. I will wait until Panther is out... it will be interesting to see how Apple deals with it. Linux has had a form of fus ever since X and virtual consoles (about 10 years) as have most forms of Unix. Though it is not "fast" to set up. We use it all the time in our physics lab where there are two+ users per machine. I have heard that Xandros Linux comes with the fus already set up. I haven't played with Xandros yet.

I see no reason why the next user should not be able to eject the cd drive, the restrictions you mention are too UNIX/windowsesque to ever be put on a mac system. Especially if you consider that the whole point is that its to let those that share a machine not have to log out in order to use it one at a time.

Perhaps the first user that put in a CD doesn't want the next user to access the CD? Hopefully this will be configureable so the first user that uses the CD drive can determine if other users can read or eject that CD. Sharing the machine does not have to mean sharing data if you don't want to.

Again stop thinking in UNIX terms, like devices, start thinking in a more mac way. For example a microphone can be used in several apps at once, some people think that this is a weakness, that Macs don't lock on devices but its one thing I really appreciate. The only issue that would really be a hurdle is one user doing a long task utilizing a piece of hardware. Merely because at the lowest level Mac OS X is UNIX this is one place where they will have to wait till its done. I would assume that only the burning a CD would keep another user from using the cd drive.

It is not so much a matter of "thinking in UNIX terms" but it is a matter of thinking in security terms.
Linux can also share various devices amongst different apps at the same time. For instance I can be playing an MP3 and still hear when I get an IM. I can watch TV (and hear it) while playing a game and hear it and hear when I get an IM. However... when the machine is switched to another user the other user should have control over sound. In other words the next user should hear when an IM comes in, be able to hear iTunes/XMMS (or whatever) and not have it mixed in with the previous users applications. I am sure that most users don't want to hear their music playing alongside someone elses.
Then there are other devices such as PDAs... and perhaps this should be handled at the device level (as it is with my PalmV). One can not prevent another user from unplugging my PDA from the cradle but I don't want them to be able to sync it with their palm desktop (and probably nor would the other user). The system should also allow another user to put in their PDA and sync. This would apply to cellphones and bluetooth devices as well. Fortunately most other devices have more security than a CD disk. Perhaps there can be a mechanism in software that can lock the content of a CD yet still allow the next user to eject it and use their own CD(s). This wouldn't mean that the CD has to be writeable... just that there is a temporary system lock on a CD+user basis.
Most versions of Linux are pretty dumb when it comes to fus. All devices that a normal console user has control over are locked to the first user when they log in at the console. This works well most of the time but a different user can not sync their PDA, or hear an MP3, or hear an IM until the first user logs out and the system can then switch the permissions automatically.

Remember Mac OS X IS a version of Unix now. It is a multi-user multi-tasking AND hopefully secure platform. There may be remote users logged in to the machine that one doesn't want reading what is on a CD, accessing a PDA, a microphone, a cellphone, a Zip disk, a camera. Do you understand the scope of the problem? I believe Apple does understand it and will try to do "the right thing" by using sensible defaults and making it simple to configure. I am interested in what and how they choose to do this and what options they give the users.

BTW when you log in to your Mac OS X machine you may notice that /dev/console is "owned" by you. Try mounting some other devices and see what happens.

[ZackS]

Originally posted by mikemako:
Is it possible to return to the Welcome screen without logging out? I poked around and didn't see if this was possible. If so, does music keep playing if you return to the Welcome screen?

Yes, click "Login Window..." in the User Switch menu. Login window will pop up, you'll still be logged in, and the music will continue playing.

[moonmonkey]

Originally posted by sandsl:
It does work across mutilple accounts simultaneously for me (Panther 7B44). Obviously Apple could have disabled this in new builds.

Bingo.

[Xeo]

Originally posted by utidjian:
Though it is not "fast" to set up.

I think OS X "fast" is only "fast" because you don't have to first log out and then log back in. I would say the Linux virtual consoles counts as fast user switching.