Hacker News Reader

1. Forcing people to use registry edit hacks is not an acceptable UI. There's no guarantee that those registry hacks won't stop working tomorrow. There needs to a real documented way to do it.

I have Windows 10 Pro. I used to disable Windows search doing web search with the Policy Editor (forcing me to do that was already boarderline unacceptable). Now that has stopped working, and even though I enable/disable many things in the Policy Editor, web search still happens. I will be switching to Linux.

I agree with much of what you say but I wanted to clarify one point.

> 3. I like UAC. The article claims that giving users a dialog box to permit admin access is good for malware, but the alternative is taking admin away from users altogether on their own computers. I don't think this is an acceptable tradeoff.

The UAC is about persuading legitimate developers to do the right thing. In that respect it has been successful. Many developers have learned they should not be annoying users with the admin dialog unless they really do need enhanced privileges.

The UAC has no other benefit. It's not a security barrier (malware can bypass it, or get the user to). If you're running on an admin account you are admin and all win32 programs running on your desktop have admin rights. They just need an elevated token to make use of them which, as I said, is easy enough to gain. The exception is if programs create their own sandbox to run sub-processes with limited rights.

UWP is an attempt to sandbox applications by default and thus allow the user to be admin without programs being admin by default. However its uptake has been slow.

In short, it's not the UAC that's the issue. It's Windows permission model. Microsoft is aware of this and is attempting change.

I've always been skeptical of the Windows security model as a user but I didn't think it was that porous. Thanks for setting me straight. I found these articles explaining why it's so bad:

https://tyranidslair.blogspot.com/2017/05/reading-your-way-a...

For enhanced security you can run as a "standard user" then switch users whenever you need to run something with admin privileges. And by switch users I mean literally go through the login screen to change desktop to an admin user.

Obviously this isn't ideal. I've been using this set up for awhile and mostly I can live with it but installing/updating programs is a pain. Especially if they bizarrely don't expect to be installed from a different account then the one that runs them (games can be particularly bad about this, even modern ones).

Of course there's a lot a malicious application can do even with standard user privileges (e.g. it has access to all your files and the internet). It's easier to get rid of though.

You don't have to switch to an admin user account. You can provide admin credentials when needed or right click an installer and run as admin manually (and provide the credentials then).

No. That causes a process with admin rights to run in the context of your desktop session. This is exploitable by non-admin processes running in the same session. The inter-process security in Windows is unfortunately weak when they share a desktop session.

You're assuming at that point that you're already compromised or running malware, though. If you aren't already infected with malware, this is not a problem. If the installer itself is malware, then switching to an admin account to install it obviously offers no protection.

> It's not a security barrier (malware can bypass it, or get the user to)

All it needs is the user to have one of many buggy programs installed on their computer, for example Steam. If you're doubtful of this, replace the steamservice.exe executable with one of the same name that does whatever you want (doesn't require a admin privs and can be done by any user on the machine) and then reboot - it will run as admin with no prompt. Source: https://nvd.nist.gov/vuln/detail/CVE-2015-7985

I'm not a fanboy of any OS in existence but

1. Most tech-illiterate people are afraid of using regedit and/or GPO to disable Cortana so the point is valid.

2. Disk fragmentation has become an even bigger issue since Windows 10 doesn't defragment SSD disks.

3. It's not an argument.

4. The article talks about laptops specifically and the issue is still there and it's huge even for Windows 10 which often installs Microsoft drivers which do _not_ work.

5. You must be joking about the startup tab of the task manager. Looks like you've never had this issue or you've only used SSDs in your life. Also discover Autoruns by Mark Russinovich.

6. The Windows Store app canNOT be disabled. Read carefully. Also after each major Windows update all apps are reinstalled.

There's no exaggeration - the author is an IT specialist with a lot of experience.

> Disk fragmentation has become an even bigger issue since Windows 10 doesn't defragment SSD disks

Defrag on SSDs in Windows 10 runs Trim. And it does do that automatically on a schedule if you don't change anything. Actual defragmentation on an SSD is way less useful because SSDs don't have killer seek latencies like spinning rust plates did, and it would be small-scale harmful because of write wear. And your SSD's onboard controller would likely thwart your efforts anyway, because of wear leveling.

That’s 1/2 right SSD’s do have fragmentation issues, but it’s about IOPS not latency. http://www.dbta.com/Editorial/Trends-and-Applications/Does-F...

TRIM is also important, but it’s a different issue.

That article makes claims of 25% reduction in perf with no data to back it up, then mentions fragmention leads to system instability, requiring reboots... What? Again no data given to back up these claims. It's also SAN/Enterprise-centric. Even if you lost 25% perf, you're going from 200,000 IOPs/sec to 150,000 IOPs/sec. This is still plenty fast.

There is no out of order seek penalty for SSD drives like traditional hard drives. In fact you cannot guarantee what the SSD does to your logical blocks underneath the hood (they are mapped in indirect tables). You do not want to do defrag an SSD due to adding necessary erase cycles, that is why Windows has it disabled.

That's only partly true, fragmentation can and does massively effect SSD performance both on read and write, can effect write latency, but not read latency.

(think of it in terms of an SSD being a huge pile of 4MB blocks where each block needs to be completely erased to clear out old content to get a clearer picture)

From what I understand, the blocks are just "marked" as being deleted, the TRIM command erases/wipes the content. Windows does this [TRIM], in default setup, once a month.

I'm completely tech literate and I STILL am afraid to use regedit. There are so many gotchyas, so little documentation, and many many side effects.

It would help if regedit had some confirmation dialog as opposed to the current 'direct' editing. An undo function [possibly persistent] wouldn't go amiss either.

5. I police my startup items so that's correct, I've never had this issue. But yeah I know about Autoruns; that's an option too. Are you saying that since it's not built into Windows then it shouldn't count? I don't really agree. It's not like other popular OSes have such tools built in either. And Autoruns is even first-party since Sysinternals was acquired by Microsoft.

6. Yes it can. My current Windows 10 system has been installed since March. I disabled the store immediately and no update since then has restored Windows Store or any Store app. You can uninstall the Store (https://github.com/Disassembler0/Win10-Initial-Setup-Script/...) or just disable access/updates through group policy (https://i.imgur.com/ZRxbwNt.png).

5. It's not about policing - it's about knowing what's being launched on startup and at least being able to disable items one by one to understand the root cause of your slow boots (and even that doesn't always help since some slow downs are caused by bad/misbehaving drivers). The startup tab in the task manager is absolutely insufficient as it shows pretty much nothing.

6. Random scripts from the Net to "improve" Windows 10? What could possibly go wrong? ;-)

And you're kinda neglecting the elephant in the room: you cannot uninstall apps in Windows 10 at all without using Power Shell. For some reasons Microsoft decided not to include the apps anywhere in GUI, e.g. in Windows Components which if I remember correctly were/was created exactly for this purpose.

In short the apps and how cryptically they are handled is one of the worst "features" of Windows 10. And don't get me on how they are handled in file system: it's a huge effing mess. And how you cannot really access/edit/remove apps data even when you're an administrator.

In short, UWP is an alien technology to Windows 10. UWP should have been a new different OS altogether (and probably that was the plan).

> 1. It's not hard to disable Cortana and internet-assisted start menu search completion

Uhh, you have to go into the registry to do this. Not really easy. It should be an option in the settings, not something I need to go under the hood to do.

Also from the README for that script to disable telemetry:

> Q: Can I run the script safely?

> A: Definitely not

> It's not hard to disable Cortana

Wrong. For people who disabled Cortana, it kept re-enabling itself automatically after updates. I think that problem is mostly gone now, but it was definitely an issue all the way up till earlier this year.

> Disk fragmentation hasn't been an issue

The article has one tiny line-item about fragmentation and it was about architecture. I agree that it's not an issue for most people, but OP is making a comment about a design problem. You are mis-representing the argument by talking past it.

> I like UAC

That's a personal preference, and that's fine. I have mixed feelings about UAC.

> Windows (10) has arguably the best plug-and-play driver support

Again you might be talking past the issue. When Windows 10 first came out there were a TON of devices, including very popular printers and scanners, which had no support. It was a huge problem as the large number of news articles on the subject would indicate. It's mostly a non-issue now, but there are some devices that are still not supported. I consult for a cancer treatment facility and they have some not-terribly-obscure equipment that still doesn't have Windows 10 support. I agree that things have changed, but when the author wrote this, it was true. He should probably update the site.

> The article claims that it's difficult to figure out why your startup is so slow

The tool you mention is typical Microsoft. It blames the 3rd party and doesn't provide any info on Microsoft-internals stuff, which is where the problem is most of the time.

> The article claims that you can't disable Windows Store apps, Windows tips, and ads in the start menu. That's untrue

To the best of my knowledge, it's impossible to get a start menu without all the tips and ads without using a 3rd party Windows-10-decrapifyer/debloater kind of thing. And if that wasn't bad enough: https://mspoweruser.com/ads-in-windows-10-mail-and-calendar-... https://tech.slashdot.org/story/19/12/17/2249238/microsoft-s...

> To the best of my knowledge, it's impossible to get a start menu without all the tips and ads without using a 3rd party Windows-10-decrapifyer/debloater kind of thing.

I wonder how I did that. I never install regcleaners or similar tools. I disabled some setting and manually right-clicked and deleted a handful of tiles in the start menu. That was many Windows 10 updates ago. I have never seen anything in my Start menu that I didn't expect to be there since.

The problem is they could come back (depending on your region) and advertising settings are spread out so you may have to go through the settings disabling them all. Basically any option that's labelled as a "tip" or "suggestion" might be a license to advertise. The start menu one is:

Settings -> Personalisation -> Start -> "Show suggestions occasionally in Start".

There was also an issue with a feature update that reset some settings. Feature updates basically do a reinstall of the OS and then copy your settings back over so sometimes things get missed (accidentally or on purpose, whichever explanation you prefer). The solution is to delay feature updates for at least a week or two. By that time these issues should have been fixed. Personally I delay feature updates for 30 days.

Just right-click and unpin each item, and there start menu won't even show the panel

> Wrong. For people who disabled Cortana, it kept re-enabling itself automatically after updates. I think that problem is mostly gone now, but it was definitely an issue all the way up till earlier this year.

I'm pretty sure this only applies if you disabled it through the UWP configurator applet. I vaguely remember this happening to me once. I disabled Cortana in group policy or the registry editor and it never happened again. And you're undermining your own argument by admitting that the problem doesn't actually exist anymore anyway...

> The article has one tiny line-item about fragmentation and it was about architecture. I agree that it's not an issue for most people, but OP is making a comment about a design problem. You are mis-representing the argument by talking past it.

The article's brief mention of fragmentation issues was wrong. It doesn't get a pass just because it was a brief mention. A huge list of issues looks impressive until someone breaks it down and points out how many of the issues aren't valid.

I have no idea what you mean by "architecture" or "design problem." The article claimed that disk fragmentation is an issue, and it's not.

> When Windows 10 first came out there were a TON of devices, including very popular printers and scanners, which had no support.

This was a big issue with Vista, but much less so with 10. Even at its absolute worst, Windows 10 was vastly better than Linux for driver support on the desktop. MacOS doesn't really count because of all their first-party hardware. If there's no superior alternative I don't see a valid point against Windows here.

> when the author wrote this, it was true. He should probably update the site.

Oh... I was assuming it was just published since there's no date in parens in the HN story title. I felt like the article was being disingenuous in repeatedly mentioning old issues that have since been fixed, but if the article is older then that changes a lot.

The tricks to getting a tile-free start menu is to remove every single tile. The start menu then collapses down to a more simple list of programs. I've run with this for years, and no tiles have ever appear, or tips

> To the best of my knowledge, it's impossible to get a start menu without all the tips and ads

It's actually so easy I've forgotten how I did it, but I removed all of that stuff (including Cortana) within the first 5 or 10 minutes of booting into Win 10 for the first time about 3 years ago. I think you just right-click on it and remove it.

Much of the hate towards Win 10 is just FUD from people who didn't bother to try even basic things to customize it to their liking before claiming it can't be done. I let that get to me and held off on updating from 7 for awhile, but I've been on 10 for a few years now and it's been rock-solid and problem-free.

The biggest problem - automatic updates that take over and restart the computer without your permission, potentially bricking it - is something that I avoided by getting Pro. There is some merit to the argument that your OS shouldn't by default delete your work, run code without your permission, and possibly brick your computer unless you pay.

It is a very good OS worth the cost, and if you do pay for it then that's not a problem at all. But the fact that they take such a bludgeoning approach on the people who get it for free does still seem wrong. The reasoning behind it makes sense though (almost all users are online and need updates for security or else their compromised machines become part of the problem). And the solution, pay to control when updates occur, doesn't make sense at the technological level, but at the human level it does. Those who care enough about it to pay for that are the ones less likely to be security problems.

It is possible to disable telemetry.

Please go on. Having no officially supported way to completely turn off phoning home if we want to is one of our deal-breakers.

Exactly.

Lots of utilities which disable telemetry automatically are invasive as hell and sometimes break your Windows installation.

Check out https://github.com/Disassembler0/Win10-Initial-Setup-Script/...

Sure, but for professional use I'm not very interested in unsupported hacks that are liable to break things and/or be overridden and reverted by Microsoft in some future update. We deal with various kinds of sensitive and confidential information, and we have legal and contractual obligations to protect it, and so we need the ability to control where it goes on our terms. It's really as simple as that. If Microsoft won't give that to us, then we won't be Microsoft customers.

If it's for professional use, then you can use the official non-hacky method of disabling telemetry with the group policy editor available in Win10 Enterprise, server, and education versions.

Only if you have those editions, though, which typically no small business or independent professional does (nor home users, obviously).

Windows 10 Enterprise is, as far as I can see, essentially a different OS to Windows 10 Pro and the lower editions, presumably because Microsoft knows very well that its big corporate customers wouldn't stand for the kind of behaviour it's trying to inflict on everyone else but the big customers have enough money/lawyers/etc. to escape the trap.

The big change from earlier versions is that there used to be a mid-range Pro edition that was aimed at the smaller-scale professional market, with some of the more advanced features and without some of the restrictions, but also without the emphasis on having to centrally manage everything the way a large organisation usually wants to. In contrast, with 10, the Pro edition appears to be as broken as the Home one for professional use. I'm not really sure who the intended target audience of Windows 10 Pro is or why it exists at all.

If you are running Windows 10 home for professional use, you’re at best being negligent.

I run win 10 pro, just as I ran win7 pro before, for home use. A small business has no excuse to do otherwise.

You missed my point. Windows 7 Pro made sense in that market. Windows 10 Pro does not. You are literally relying on a system where you cannot maintain both proper control of your own resources and good support for things like security and compatibility updates.

You can do exactly that with Windows 10 Pro.

How do you turn off all phoning home and run a stable system with only security and essential compatibility updates applied if and when you choose in an officially supported way with Windows 10 Pro?

In regards to no. 3: I recently set up a new Win 10 laptop and was super impressed by the automagical driver installation.

A few days later I went on a work trip to somewhere where internet connectivity is a luxury and discovered basically all of the drivers were crap. Intel iGPU drivers didn't support QuickSync, trackpad scrolling worked in only half of my applications, the NVIDIA GPU was burning battery on idle and instead of even just using it in standard HID mode, it made my MX Master mouse switch over control of advanced features to the software, while not actually installing said software and opting to rather pop up a big ugly green dialog every 5 mintues, prompting me to install Logitech's garbage software utility.