Hacker News Reader

Comment by devwastaken | Hacker News Reader

>this feature ships with Windows 10 Pro and Enterprise. No need to download a VHD!

Swing and a miss. It's interesting how Microsoft will force their slow AV onto every win10 home edition device, yet won't give actual tools users can protect themselves with.

View on HN

Power users get Pro, typical home users think that sandboxes are children playgrounds.

I'd argue that typical home users are the people who need this feature the most.

And I would argue they are better off with Windows S mode.

Tell that to my father who still uses decades-old software. I agree with the gp, Windows Home users need this feature the most.

Folks who don't mind Windows S would already be using android/ios.

"S Mode" (as opposed to Windows S which was briefly a separate SKU) in current builds of Windows 10 (Home/Pro/Enterprise) is now arbitrarily admin activatable/deactivatable. As your father's admin (assumedly in this example) you deactivate S Mode, install all the old apps, then reactivate S Mode. Your father still gets access to the old apps, and can install new apps from the Windows Store [1] without your involvement as admin. You just have switch it out of S Mode if your father finds another old CD or floppy behind the couch to (re-)install.

[1] I don't recall if S Mode currently allows sideloading non-Store but code-signed APPX/MSIX packages. I think it is supposed to? But I think my confusion is that it may differ (at least currently) between Windows Home in S Mode and Windows Enterprise in S Mode.

I don't think you can launch non-signed apps when S Mode is on. Does not matter, if you installed them when it was off.

Most people who use Windows are not paying for Pro. That includes the 'power users'. This is a feature that has to be enabled, having it in Home does 0 damage, yet gives the ability for those who don't have Pro to protect themselves.

I've found Defender to be a definite performance hit but what's a better option? I'd rather not have the subscription costs.

Not running a tool that makes your attack surface bigger in exchange for questionable benefits?

They've put Defender into a sandbox nowadays.

https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/...

Insider only for now. But a very good move imo.

Okay, even if I take your comment about attack surface at face value, what are you suggesting? Surely not avoiding AV completely.

> Surely not avoiding AV completely.

Exactly that.

Ok, what about for the 99% of the population that that won't work for?

Well, I'm recommending it on HN, not on Facebook ;)

Use ChromeOS, Android, or iOS.

Seriously, AV is pointless software. It will false-positive often, it will false-negative slightly less often, and it will introduce a performance degradation 100% of the time regardless. It is a bad solution to the problem of malware.

You could use an AV but only run offline scans on a schedule.

Reply on news.ycombinator.com