Hacker News Reader

Comment by jakebasile | Hacker News Reader

I completely understand why this is the default behavior, but there should be an "I'm not a normie" switch somewhere that allows me to control my experience. The Pro edition was originally that way, but as I understand it this is no longer the case and is similarly controlling.

View on HN

>but there should be an "I'm not a normie" switch somewhere...

Which will then summarily be used by malware authors and we're back we started.

I wish I could upvote this about 30 times. For every real Windows security expert slash power user in the wild, there's about 30 pimple-encrusted besotted teenagers out there who just want to run some warez on their parent's computer and will click whatever setting, run whatever software and make whatever Registry edits are necessary to get the game their parents won't buy them up and running.

The typical home user is not a sysadmin, doesn't want to be a sysadmin and will not put in the effort to be a sysadmin. Microsoft is building Windows to be safe for them. This is a net good for all of us. And underneith it all, Windows is still Windows, which puts it miles ahead of its real competitors (Android, iOS and I guess ChromeOS) in terms of allowing users to really own their device.

This is all great, but I am not a typical home user and there is no option for me on the Windows Edition Menu. I can buy Home or Pro, that's it. Pro used to be the "I know what I'm doing" version but this is no longer the case. Enterprise let's you do whatever you want but requires far more investment and effort to run just so that I can control my computer.

Edit to reply to cwyers below me as I cannot reply further:

Do you honestly think that running your own Active Directory system, calling Microsoft Enterprise Sales, arguing with them and probably failing to buy a single Enterprise license, and ultimately buying a pack of Enterprise licenses I do not need is required of me to be "on the same Internet as you"? All I want is close to the level of control I can get on previous versions of Windows which pale in comparison to any Linux distribution. Does this mean that anyone using a Linux distro that doesn't automatically update shouldn't be allowed on your internet? Surely if your computer is always up to date you have nothing to fear?

I am unsure how you are equating me to an anti-vaxxer simply because I want to control how and when my computer updates. I don't believe I ever said I do not ever want an update, I want to know what they are and control when they are applied as is standard on every other OS I know of.

I am also not making any ideological argument to privacy. In fact, I don't care too awful much about the telemetry in Windows 10. I don't really like it but I almost exclusive use my Windows machine for gaming so there isn't much I'm scared of MS finding out about there. I simply want to control how my computer works.

That's a spurious argument. What's important is that the OS forces updates _by default_.

Sure, some of the people that turn it off overestimate their own capabilities, and that will lead to infection. But that's a very small portion of the total population, the vast majority of which will leave everything set to default.

Long story, but my Surface Pro 2 wound up with Win10 Pro. The Pro version is slightly more configurable for privacy than Home, but only the Enterprise version can completely turn off the telemetry and so on. Of course Enterprise is not easily available to end-users and it is expensive.

There are some utilities available that are supposed to improve the privacy/security of Win10 installations, e.g., [0].

My wife kept asking me if she should upgrade to Win10 and I said "don't do it". Since Win8.1 will be supported until 2023 or so, it really didn't matter. Now, thankfully, the "free upgrade" period is over and she won't be nagged to do the upgrade.

After all the years in the game, we'd think MS should know better than pulling all this crap on its users.

[0] https://github.com/10se1ucgo/DisableWinTracking

> Note: Windows Defender may report the EXE as a trojan (Win32/Pocyx.C!cl), and may therefore prevent you from extracting the EXE to anywhere on your computer. Set up an exclusion in Settings > Update & Security > Windows Defender > Exclusions by adding the folder you intend to extract the EXE to.

I swear, it seems like people are okay with the idea of everyone BUT Microsoft have access to all their personal information on their PCs. Why would anyone install software that has this kind of recklessness in the official documentation?

Not quite sure what recklessness you are referring to. If necessary, the exception is only for the one directory the EXE is in. IIRC the program isn't really installed, it just needs to run once to make changes in firewall rules, etc., that prevent MS telemetry. AFAIK it doesn't increase external access to the computer being configured.

After making modifications, the exclusion can be deleted if desired. If you have more info about risks of using the dwt utility, I'd be real interested to hear about it.

No, uh, look, running an EXE one finds hosted on GitHub, deliberately disabling the virus-checking on that EXE file and running the EXE is the reckless behavior. Even assuming that the person who made the EXE didn't mean so maliciously, any kind of a MitM attack or other way of sureptuously putting a payload in that EXE is an attack vector.

Why is it particularly worse than downloading a binary hosted anywhere else, upstream binaries being the standard way of obtaining software on Windows?

As for the virus checker, their program's raison d'etre is making registry changes. It's not difficult to imagine that being flagged by Windows Defender is unavoidable.

I think the recent situation with SourceForge, where binaries were changed to add a malware-ridden installer[1] shows why GitHub is potentially worse than trusting some other provider. I think it's a low likelihood that something like that happens with GitHub ever, much less soon, and SourceForge has reversed that action already. But it is one reason to potentially trust binaries from a third party like that less.

But that's not really the thrust of the point. It's software from an unknown provenance, and yes, that's pretty standard for Windows but it's not great and it's getting worse all the time. Virus scanners are not a great solution, but not having them are worse. Without any kind of a checksum on that page, it's impossible to verify that the binary you have is the one that you should have. (Not that it's guaranteed that you can do so if there is a checksum.) So you're already in a bad situation, and you're turning off one of the few safeguards you have.

As for registry changes getting flagged by Defender... programs that change the registry aren't rare.[2] They do not universally share this problem. I imagine it's probably a false positive and I don't know how it could be avoided, but the proposed remedy is reckless.

1) http://arstechnica.com/information-technology/2015/05/source...

2) http://windowsreport.com/windows-10-registry-cleaners/

Yes I'm strongly considering downgrading to 8.1. It's time for a fresh install anyways. I dread when that goes EOL because I'll have no where else to turn but whatever Windows is out at the time.

What you're going to do when a telemetry patch comes bundled with a security one? MS just announced they are doing updates in bulk for 7 and 8.1.

Honestly, I do not know. Telemetry isn't my biggest gripe with Windows 10, but besides that at some point the only version of Windows with security support will be Windows 10 or some descendant of it and I have no reason to believe my issues with 10 will be fixed by then.

As I said elsewhere, I'd love to be *nix only but my gaming preferences will not allow it.

I've seen some reports that DisableWinTracking is too aggressive and can cause problems. Personally, I use and recommend O&O Shutup10.

https://www.oo-software.com/en/shutup10

What good would that do? Everybody thinks they're a pro. They'd just turn it on the instant they heard of it.

I wouldn't mind if there were some convoluted steps to enable it. Something akin to turning on Android's "developer mode".

I think requiring the user to boot a Linux live CD and do some voodoo would be enough. Computer would have to self destruct if you failed the steps tho.

"Do not turn off your computer, 5, 4.."

This really is not true. The vast majority of people have zero illusions about their own basic computing skills.

They don't need illusions about their basic computing skills. They need a drive-by installer, malware, or "tips'n'tricks" guide that gets them to do this.

People don't need to understand tools and systems to use them. Hell, they'll use things for millennia without knowing how they work (quite literally).

If they're running malware with administrator rights, they're already lost by definition.

The kind of people that would leave settings like this at the default generally don't read tips n' tricks guides to tweaking windows. They simply don't care about that sort of thing. Of course _some_ do, as you would no doubt reply, but again it comes down to numbers-- that volume doesn't justify locking it down.

They aren't clueful users so they could be socially engineered to turn off updates, but once you get to that point why wouldn't you just get them to run a RAT as administrator? That is the end goal, after all. And once you own their system you can turn off updates yourself.

Lastly, we're talking about a switch in the GUI here-- it is already possible to completely disable telemetry and automatic updates on Windows 10. You just need to hack through the registry and group policy or use a third party tool to do it. Anyone who takes control of your computer can do it remotely.

My point was: create an easily bypassed system, and the black hats will come up with ways for people to easily bypass the system.

All the children aren't above average. Your average computer user -- even those who are otherwise intelligent and capable of handling Shit The World Throws Them -- isn't particularly tech savvy.

It's like anti-terrorism defenses. The terrorist has to get lucky once. The defender has to be lucky always. Microsoft here are the defender, and they're trying to keep idiots from fucking up their systems. No slander intended, it's just reality.

Disabling safety systems (which is what we're talking about) is simply one of many ways to make larger-scale compromises of the system far more easy to do.

I'm not saying that it's impossible for Microsoft to offer this, or that they shouldn't. And I'd be hugely frustrated myself if I had to deal with this stuff (I don't run Windows, and won't. Hell these days I barely use computers if I can possibly help it, other than my own. And I hate those increasingly as well.)

But dealing with the public at billion-plus user scale is hard.

That's Microsoft's argument in a nutshell, yep. I strongly disagree with it.

I play videogames, so I'm forced to use Win10. But if I wasn't, I would have switched to OSX over this.

Reply on news.ycombinator.com