Hacker News Reader

Comment by userbinator | Hacker News Reader

As a long-time Win32 programmer (over a decade), I can safely say that the vast majority of existing applications still remain (for the time being) forward-compatible.

Here's some examples:

https://www.youtube.com/watch?v=JOj-bAZBhnE

https://www.youtube.com/watch?v=mRfn4M5DXTE

https://www.youtube.com/watch?v=wqFWuNmWbHk

The reasons people hold off on "upgrading" Windows versions is not mainly because of compatibility, but other factors like unwanted UI changes and removed features, and particularly with Windows 10, the increased data-collection intrusiveness and "we own your machine" attitude:

http://www.howtogeek.com/243581/windows-10-may-delete-your-p...

View on HN

That's the problem. If Windows was more like Linux or BSD, you could take the good parts and omit the bad parts. They're doing genuinely good and - for mainstream desktop systems - innovative stuff in the kernel and surrounding subsystems, but once you reach the Windows shell, the desire to change stuff "willy-nilly" rears its head. Classic UI as found in Server 2003 or XP was great and if you wanted you could use themes, but now it's one highly questionable and user-unfriendly style after another, with the waste of screen real estate on top. Microsoft as a whole doesn't get it and the teams doing the good stuff must be in pain, seeing what's put on top of their creations as user-facing bits.

The deprecation of SHA-1 is an issue, though. Timestamps after January 1, 2016 must be SHA-256, and SHA-1 signed files will be blocked after January 1, 2017. However, Microsoft has blogged that they may block them starting this June. Pre-Win7 systems don't recognize SHA-256, so you have to dual sign the files if you want backward compatibility. Except, MSI files can't be dual signed. I'm also finding that more Win7 users than I would expect don't have the proper updates, so their systems don't recognize SHA-256.

In short, it's a mess.

You can sign with a SHA1 hash but a SHA256 certificate, and have it work on unpatched Win7 and even Vista SP2 with a hotfix installed (to fix a minor problem).

> The reasons people hold off on "upgrading" Windows versions is not mainly because of compatibility, but other factors like unwanted UI changes and removed features, and particularly with Windows 10, the increased data-collection intrusiveness and "we own your machine" attitude

Since quite a lot of people swear that they will never upgrade to Windows 10 for those reasons (esp. the data-collection, privacy, telemetry, and forced update issues), what do you think of the feasibility of a software product that blocks Microsoft from doing all those things?

This product would automatically configure Windows 10 to minimize all those intrusions, and where Microsoft does not provide an opt-out or disable setting, it would actively block the intrusive activity (like the way anti-virus software blocks certain malware actions).

Is this technically feasible? Would it violate Microsoft's terms and conditions? Is there enough of a market?

People have done that (just search for "Windows 10 disable telemetry", a few of those have made it onto HN too), it probably does violate ToS in some way, and there is certainly a huge "market" for it. Just look at all the "start menu replacements" that appeared when Win8 decided to remove that feature.

The biggest problem I see is that MS has somehow made all the pieces very tightly coupled (e.g. http://superuser.com/questions/957907/unable-to-install-font... ), and in typical fashion these days, has adopted a "you're either with us or against us - it's for your security" attitude in dealing with things like patches and other modifications.

Back in the XP and Vista days, well-meaning people would make customised versions of OS install images with a lot of these types of changes and share them. Piracy aside, that movement was mostly decimated by claims that all of them contained malware. Sure there were some, but a lot less than the FUD wants you to think, and the community of more experienced users quickly discovered and strongly called out those who tried. Maybe the "malwarez" creators have blossomed since then, I don't know; I haven't been following that scene for a while.

> the increased data-collection intrusiveness

The irony of this common complaint is that most people voicing it carry iPhones or Android phones, which are heavily instrumented to collect data by the operating system provider, the hardware manufacturer, and the carrier. Unlike a desktop PC, it knows where you are at all times because of its onboard sensors and has access the content of any communication you make with others.

(Note that even using custom OS images doesn't necessarily disable all telemetry since all smartphones run a separate OS to manage radio functions. See http://www.osnews.com/story/27416/The_second_operating_syste... for details.)

Most of the collected data is, of course, benign. Just like the data collected by Windows 10.

> Unlike a desktop PC, it knows where you are at all times

A single web-API call can return an accurate geolocation based on IP address alone for the majority of users (there are a few exceptions like VPNs or a small subset of IPs where the location is not good). If the desktop has Wifi, then geolocation becomes even more accurate as you can use known Wifi SSIDs to cross-reference. If the user has set a time-zone for their clock, then again more accurate location data.

> Most of the collected data is, of course, benign. Just like the data collected by Windows 10.

Source? Have you been able to analyze all the data Windows data-collection/"telemetry" sends up to MS?

Yes, the name "Windows as a service" was coined for a reason.

That's great! I didn't know about it. Would anyone happen to know how does it compare with the applications on Linux? Are they similarly forward compatible?

Oh, in no way, shape, or form, unless the application was statically linked, which is uncommon.

You could always run them in a container.

Closed source programs usually are, exactly for that reason. (Or at least ship all libraries they link to, up to and including the libc.)

Go also makes it relatively easy to statically compile everything, one of the reasons why it's gaining popularity.

Apart from those two it's highly uncommon: You're supposed to ship sources and compile them on the target system.

To get a sort of forward compatibility you'd need to find compatible sources for all involved userland, or ship them with your sources. The latter is sometimes used in larger projects, to work around distributions having wildly incompatible versions of whatever library you need (Samba, Firefox, LibreOffice e.g.).

To expand on copperx, they might be. Since you can have several versions of a lib installed and the kernel<->userspace interface is stable, if you can get the old versions you need for your distro, then you can run the application. At worst, you might need to compile from source (which I do realise can take a lot of time and effort).

So the kind-of proper answer to that question is, "if you want to run a popular old application on a popular current distro, there is probably a repository you can pull packages from that will allow you to do it, otherwise it's somewhat of a crapshoot".

Absolutely not, at least not on compiled form.

It's not all black though: this problem is usually offset by the fact that most Linux software is open source and can be recompiled against the new platform source.

You take some, you give some. The result is quite different but looks the same to the end user.

Reply on news.ycombinator.com