Hacker News Reader

Comment by forrestthewoods | Hacker News Reader

This tool is great. Only problem is you have to regularly re-run it because Windows Update will revert changes.

Not saying that this is carrying anything malicious at all, but there's certainly a chance that a tool to clear out telemetry or something else critical in the bowels of the OS is sending info back to that group now or can be malicious. Just a friendly warning to be weary about these types of applications.

This would be easy to detect. It's a popular tool made by a German company. I think someone would've found out by now.

The BSI is a federal office dedicated to IT security, not a company. It's more or less the German NSA, just without the spying part. That's done by other offices.

GP is talking about https://www.oo-software.com/en/company

Oh, that makes sense. Totally went past me when I commented. Thanks for pointing that out.

Yep, which is why you disable Windows Update too. The people who work on Windows these days should probably all be fired. Out of a cannon. Into the sun.

Telling users to disable updates it's not a good recommendation.

Sure it is. Microsoft software deployment on client is a dumpster fire.

Blindly installing Windows updates these days is very dangerous and should be avoided. Your best approach for avoiding malware is to use browsers like Firefox and Chrome. Critical task workflows should be in LTSB, iOS or ChromeOS.

Microsoft’s guidance is to have around four deployment rings each for Windows and Office, and only immediately patch 10-20% of your enterprise environment and defer to avoid impacts from the quality issues that are very common as Microsoft is supporting like a half dozen Windows 10s.

See: https://docs.microsoft.com/en-us/windows/deployment/update/w...

Yep. All of the Windows machines that I actually rely on for work—the ones that I need to be able to start up and immediately use, and need to be able to trust them to keep running without interruption or regression—are completely firewalled off from the public internet, so that they are secure both from malware, and unwanted updates. The rest of my work is done on other, more obedient operating systems.

Windows 95 was capable of 49.7 days of uptime. That's pretty difficult on client versions of Windows 10 unless you take extraordinary measures.

My beef is that Microsoft created an update always culture (a good thing), but they are now “extending” the practice in ways that don’t reflect a customers best interest.

The future, which is subscription models with limited time away from activation servers, breaks your needs fundamentally.

>The future, which is subscription models with limited time away from activation servers

My future is not an OS that spies on its users. I hope I'm not in the minority.

Very much disagree. If you pay attention at all to security you'll always hear stories of that one client who hasn't done security updates in 3 months (or 3 days) and gets taken out by the inevitable "exploit Wednesday" shenanigans. On top of that if you're in an enterprise environment when you update you've already had months of home users beta testing the stuff (if you've chosen the semi-annual channel), haven't you?

From my experience as someone who has had 0 problems since beta (that weren't caused by me doing something stupid like uninstalling Windows Store) people mess with windows, usually by running a script or 2 because "omg Microsoft is spying on me!111!" then the update comes and throws them an error or 2.

Choose any other OS. Any OS at all that is sufficiently complicated as to compete with Windows (maybe as a starting point anything a tiny bit more complicated than ChromeOS). Then name a problem that's happened with Windows 10. I'll show something similar if not worse happening on the other OS you've chosen.

The problem, IMO, isn't the OS. It's the freedom the OS allows and the billions of different configurations you'll find out there. Of course any 1 update isn't going to account for all of that. Hell Apple can't even do it on iphones/imacs and they have a very tiny number of SKUs to deal with.

I respect your position here and don't intend to be on the attack. Usually that one client also lacks other compensating controls, particularly around privilege managemetn and internet access, and the lack of patching is a convenient excuse. If "exploit Wednesday" is an issue for you, something is wrong.

In any non-trivial enterprise, Windows 10 has an operational model that's being rebuilt in flight. You need to exert a level of testing every six months that previous Windows versions required every 2 years, and you have to deal with the rubix cube of servicing editions of when a random feature that you care about is twiddled or taken away in Office or Windows.

Alot of the hard work and creative engineering that gives a near-legendary and seldom mentioned track record of backward compatibility in Windows is being squashed by poor release management. End of the day, we have computers to use as tools to do things, business comes first. The philosophy within Microsoft has changed in recent years, and now there seems to be an attitude that running Windows v.now is the primary mission of every Windows PC. That's truly an unfortunate thing in my eyes that makes me sad -- Windows is an amazing platform that could be so much better.

> Very much disagree. If you pay attention at all to security you'll always hear stories of that one client who hasn't done security updates in 3 months (or 3 days) and gets taken out by the inevitable "exploit Wednesday" shenanigans.

And if you read past the headline you find out that they had numerous other problems with their security practices that were actually responsible for them being compromised, because if "keep it up to date" is the extent of your security policy then you don't have a security policy. There are always exploitable issues in an OS, sometimes updates even introduce them (remember heartbleed? or that time Debian broke key gen?).

> From my experience as someone who has had 0 problems since beta

From your experience as someone with no experience dealing with issues caused by Windows Update, got it.

> Choose any other OS. Any OS at all that is sufficiently complicated as to compete with Windows (maybe as a starting point anything a tiny bit more complicated than ChromeOS). Then name a problem that's happened with Windows 10. I'll show something similar if not worse happening on the other OS you've chosen.

This doesn't mean that Windows 10 isn't bad, it just means that everything is bad.

> The problem, IMO, isn't the OS. It's the freedom the OS allows and the billions of different configurations you'll find out there.

The problem is the OS. If you have designed your OS in such a way as to make updating it a pain in the ass that's prone to breaking things, and turning updates off also a pain in the ass, then the problem is the OS.

I agree with the sentiment that "everything is bad". Computers are still in their birthing stage and full of problems. But Windows 10 feels like an improvement over any previous version of Windows at least. Which is really all we can ask for. A little too transitional/work in progress for some, I can see that (2 control panels? madness!), but otherwise pretty smooth.

But maybe it's also because I left computer support type roles and I haven't seen the nightmares like I did with XP/2000/Vista/7. But as an end user/casual security and IT watcher I can't complain too much (yet).

And as an anecdote the only problem I've had updating was the one large change to the audio stack they did (and needed to do-it's so much better). The huge issue that arose was I needed to unmute my headphones. Other than that I seriously have not noticed any update other than maybe seeing the % when I boot up in the morning. I keep track of when the big ones come so I can run O&O after those, but I really haven't even skipped a beat due to an update.

Lucky you. Meanwhile Microsoft has delayed the October update for the third time because of all the crap they keep breaking whenever they release it. Yesterday my boss and I had a conversation about just turning Windows Update off forever for our org because it's caused more trouble than pretty much anything we could think of as a consequence of not updating. This was brought up (again) because of several of our developers having their network cards randomly and inexplicably stop working and requiring a reboot to fix after 1809.

I will say that since Vista there has been a ton of improvement on the driver model, display system, network stack, audio stack (as you mentioned), and a few other relatively low-level pieces, but pretty much everything above that has been a continual shitshow of user-hostile bullshit and overly complex interlocking crapware.

Start Menu used to just be a menuized view of a folder structure, now it's some horrid amalgamation of junk that breaks whenever the Windows Apptore database gets corrupt, which is surprisingly often considering no one here even uses Windows Appstore apps.

Older Windows versions had their bugs, sure, but on the whole they cared a lot more about the user, about not breaking their shit and making sure their updates were actually worth applying. Microsoft has made it very clear since Windows 10 that they hate the user.

> someone who has had 0 problems since beta

Well, you really must be the only one then. Or perhaps the rebooting every other week for updates, sending around privacy sensitive telemetry information to the entire world and having Cortana use the most CPU cycles of all the apps installed is not a problem for you. Some people just accept whatever buggy stuff is thrown over the fence, and that's fine, but don't say there's nothing wrong with it.

I use O&O shutup 10 to shut down cortana, telemetry, and other minor annoyances (mostly because I like video games). Maybe that's why it's been so smooth?

And rebooting every other week? You mean on a very regular and predictable monthly schedule that was around for years prior to Windows 10's release? Not really a problem in my eyes. On my personal computer I shut it down nightly because it takes roughly 5 seconds to boot a computer these days. I can't even remember the last time I was aware an update happened.

The one problem I DID have that I was about to hate on Microsoft for was a flashing taskbar. Turns out it was entirely my fault for using a 3rd party junk program.

Neither was turning a security update service into a marketing channel. But Microsoft did it anyway.

How about, "don't use an OS that spies on you"?

Is that a good recommendation?

> Yep, which is why you disable Windows Update too.

Sounds like you haven't tried this because this solution doesn't work.

It does. I'm typing this on a Windows 10 system I leave on 24x7 and can't even remember the last time I ran an update. You have to use a third party tool like ShutUp10 or perform some undocumented config changes, but it can be done.

Of course, just like the telemetry, once you do update it'll get turned back on again and you have to do it all over again.

Reply on news.ycombinator.com