Hacker News Reader

Comment by kozak | Hacker News Reader

I recently unpacked an old archive from the time I was making some shareware few decades ago. Windows Defender instantly ate all keygen.exe files from it. Those keygens were my own keygens for my own software (I wrote them myself and used them to generate keys for my customers back in the day).

View on HN

Did you have catchy chiptunes and graffiti ANSI art?

I anticipated this question :)

No, it was just a plain Windows form, built from scratch using a then-popular Windows IDE. I think it was mostly triggered by the file name, maybe in combination with some crypto code inside.

> using a then-popular Windows IDE

If you're referring to Delphi, this has been a common issue for a long time.

Delphi seems to have been very popular with malware writers, and so AV companies keep flagging stuff from the standard libraries as malware.

Got so bad at one time that some tried to get a deal with the major AV players to provide a suite of very basic Delphi applications they could use for false-positive testing.

This is so sad.

NSIS installers used to get flagged as malware occasionally, too. Was very frustrating for distributing software.

What about pre-.NET VB?

Those required prerequisites in the form of the VB runtime, so AFAIK not so popular. Also more limited or difficult to use in terms of writing malware.

Delphi produced (produces?) quite small executables, which was very desirable for malware writers.

I'd add small stand-alone executables. IIRC it was also quite popular in Europe in general, due to Pascal or Delphi being used at universities etc.

In recent times your average Delphi application has gotten rather bloated, but that's mainly due to RTTI, generics and certain standard library stuff. It's still quite possible to make small executables.

This happened to me as well. Even when those keygens were in zipped files, Defender would flag them as malware and remove them automatically.

The only solution I found to this was to keep the keygens in a password protected zipped files.

Interesting ideas here: how antivirus becomes a form of censorship. Maybe that’s an extreme view but it feels like now that Microsoft supplies it’s own defender app. And like all forms of martial law beginning as a way to protect citizens!

I also noticed that with win10 when apps crash it sends the data to Microsoft—as though they can fix 3rd party apps for us. Yeesh. I think I’ll skip out on Windows 11 TYVM.

People are downvoting the above comment for some reason, but what is this Windows Defender behavior if not a form of censorship?

Judging. And it's impossible to build certain feature without judging.

A lot of people here probably don't remember what email was like in the 90s/00s, before it got bad enough that Gmail's killer feature was (what we'd now call) cloud-enabled spam filtering.

The distinction between judgement and censorship is the amount of user control. (1) Does the user know it happened? (2) Can the user override the decision?

1) no 2) no. So it seems a good idea to disable defender.

Not true. Defender alerts you when it quarantines a virus or whatever. And if you know what buttons to push, you can tell it to remove it from quarantine. You can also tell it to ignore folders if you so desire.

Not in this instance. Program was automatically uninstalled.

I didn't have time to poke through it, but options appear limited to whitelisting the app going forward, and then reinstalling yourself.

Given that Defender (apparently) directly deletes the files in question without asking, it seems you agree with the grandparent that it is, in fact, censorship.

That makes no sense.

By that logic, what are firefighters doing but censoring homes? What are koalas but a form of eucalyptus censorship? What is locking your front door but a form of censoring burglars?

No, just no. Censorship is preventing the transmission of ideas, nothing more, nothing less.

Deleting a file has nothing to do with transmission, and it's being done in response to a perceived threat, not its communicative meaning. (Like how you lock your house to protect from burglars.)

It's important not to abuse the term "censorship" -- if it means everything then it ceases to mean anything at all.

...I'm less sure of this.

If Windows Defender was deleting any file named "Animal Farm.txt", that would be a form of censorship, right? It's preventing the transmission of a piece of political literature.

Now, what if it was deleting "Animal Farm - The Video Game.exe"?

Now, what if it was deleting the keygen for "Animal Farm - The Video Game"? What if the activation server for that game had gone offline, and this keygen was now the only way to play it?

My point being, software (and especially games) can absolutely be a way of expressing ideas, and if you block the software, that seems like censorship to me. I also think that some forms of censorship are fine and even necessary—I don't particularly like stumbling across porn unprepared—but it should be optional.

If Windows Defender was deleting any file named "Animal Farm.txt", that would be a form of censorship, right? It's preventing the transmission of a piece of political literature.

I guess, in some ways, you could consider it censorship. But without evidence that its being done specifically to target certain types of speech, as opposed to a side effect from some other goal, I'm not sure it's a particularly useful label.

What is anti-virus software in general but "censorship" of people's abilities to distribute viruses to whoever they want? What is an adblocker but software that "censors" someone's ability to advertise in the most effective way possible?

No, it depends on the intent.

If the intent is to prevent the transmission of ideas, then yes it's censorship.

If the intent is to protect from harm -- totally unconnected to ideas -- then no it's not censorship.

The reason Defender deletes keygens is that they're statistically associated with malware and viruses, as any Google search will terrifyingly immediately reveal. It clearly is falling under the "protect from harm" category as it's designed to do.

But so to answer your question clearly: deleting "Animal Farm.txt" because of the ideas inside is censorship (prevents it being transmitted). The video game would similarly be censorship if based on its content. But if it's deleting all keygens, regardless of content of their associated video games, then clearly not censorship.

Isn't the stated intent of most censorship to protect from harm?

I think the distinction is pretty clear.

But if it needs to be clearer: in censorship the harm is in the ideas themselves, the perspectives they spread.

In prohibitions that are non-censorship, it doesn't have anything to do with ideas. You aren't locking your door to prevent the idea of burglars entering your house.

But nearly every instance of censorship is framed as non-political and purely to protect people from harm.

Stated intent maybe yes, but that's only optics. Censorship is just meant to preserve the powers in control, be they good or bad.

What is political censorship?

Amazon literally deleted Animal Farm off of people's Kindle readers because of copyright[1]. We are so immersed in our ideology that we don't see that copyright is ideological and political.

Would it have really been better if it was because the text of it was considered problematic?

[1]: https://www.mercurynews.com/2009/07/17/amazon-deletes-kindle...

I think you are holding far too strict a definition of the word related to "transmission". If I am prevented from reading data I want to read, because some entity has decided they don't want me to read it, how is that not censorship?

Also, where are you even getting that defintion anyway? Looking up nearly every form of the word 'censor' I can think of, nothing speaks specifically to the transmission of ideas. Rather, every definition I can find that makes sense focuses on deletion.

You could even argue that anti-virus is a form of voluntary censhorship.

> If I am prevented from reading data I want to read... how is that not censorship?

Of course it's censorship, they're preventing it from being transmitted to you. That's what I said.

> Also, where are you even getting that defintion anyway?

Literally the first sentence of the Wikipedia article [1]:

"Censorship is the suppression of speech, public communication, or other information."

Speech and communication are transmission. There's no such thing as speech or communication with only a single party involved, as generally understood.

And no -- anti-virus is not voluntary censorship because it's not censorship at all. It's protection from harm, not a shield from comunicative ideas. If anti-virus were "voluntary censorship" then locking your home from burglars would be too. And that twists the word beyond any recognizable or useful meaning.

[1] https://en.wikipedia.org/wiki/Censorship

Oxford Languages defines censorship as "the suppression or prohibition of any parts of books, films, news, etc. that are considered obscene, politically unacceptable, or a threat to security."

Mirriam-Webster defines a censor as "a person who supervises conduct and morals," adding a subdefinition as "an official who examines materials (such as publications or films) for objectionable matter." The relevant definition for "censorship" simply points at the word "censor," so it was not useful for my argument.

In any case, I think wiki is not 100% right according to the actual language authorities. MS deliberately categorizes otherwise-harmless piracy-related software as deletion-worthy, and that isn't censorship? When they clearly have a conflict of interest in that some of that software represents a direct threat to their revenue stream? C'mon dude.

> And no -- anti-virus is not voluntary censorship because it's not censorship at all. It's protection from harm, not a shield from comunicative ideas. If anti-virus were "voluntary censorship" then locking your home from burglars would be too. And that twists the word beyond any recognizable or useful meaning.

And what exactly is harm? Microsoft is making subjective judgements, which can not help but be political. Microsoft has decided that historical and obsolete keygens and ansi art are harmful. It would not surprise me if they deemed software to circumvent obsolete abandonware encryption harmful as well, since it violates the DMCA.

A better analogy would be if you let a third party security company examine the items in your home and remove what they deemed to be "harmful" to you.

Come on, whitelist the folder where you keep your keygens, and windows defender won't interfere.

"Censorship, the changing or the suppression or prohibition of speech or writing that is deemed subversive of the common good" (Britannica). Voluntarily enabling a program to filter incoming data for personal convenience and safety is the opposite of the censorship. Like following self-imposed rules and restrictions is not a lesser freedom.

For less tech savvy users wiping keygens might be a safer default approach. I am pretty sure that keygens are an attack vector.

That will work... until you plug that drive into a fresh OS. Or you reformat and forget to unplug the drive before you set up the whitelist. Or it's spotted on a network drive by another PC running Windows Defender.

The filesaä are quarantined, not removed. You can restore them on the other OS as well.

You can't transmit what you don't have.

Also, fwiw "transmission" is literally the name of torrenting software. Would your argument change if that was the package being removed instead of qbittorrent?

Most people use windows, windows comes with defender on by default, what's stopping the govt/some company from getting msft to remove programs and files they don't like?

> what's stopping the govt/some company from getting msft to remove programs and files they don't like?

Literally the capitalistic profit motive?

You know, companies generally try to avoid pissing off their customers and driving them to competitors for no good reason. If Microsoft started politically censoring users' content, that's probably the easiest thing they could do to send users away from Windows and Office over to Macs and Google Docs en masse.

That would be nice, wouldn't it? But consumers have never held msft to such a standard so far, so I wouldn't expect it to start now. Sure a small number of people trying to spread the files will care, but if it's implemented right 99.999% of users won't even know the censor exists.

Defender is deleting the app as a "potentially" unwanted application, a better analogy would be if firefighters went to every home and confiscated every "potential" source of ignition.

> By that logic, what are firefighters doing but censoring homes?

Not inherently, but a disparity in which fires get prevented and put out and with which priority might constitute censorship, just as a disparity in which types of programs are identified as malware might. Many historical examples for the former instantly come to mind, from one library in alexandria to a sexual research institute in nazi germany. Not to imply that this is comparable to those in magnitude of course.

(On second thought, that also applies to systems of explicit censorship, where all media has to be approved but media that exhalts the government line has a higher chance of being approved than media that does not comment. As well as our system of implicit censorship, where every film company has to make money, but a movie produced with approval and material support of the US military has a significantly higher chance of being financially viable.)

That's sort of like arguing a hotdog is a sandwich. It isn't simply because if someone asked for a sandwich and you gave them a hotdog they'd say you gave them the wrong thing—even though technically a sandwich can simply be meat between some bread.

With the convenient excuse that Windows Defender is a separate app that is not part of Windows, of course.

This is incredibly hyperbolic. If you don't like Defender's default behavior (which is sane for the 99.999% of users who are not devs), turn it off or use a different OS.

Is it? I've personally seen it label keygen type files (with no malware whatsoever) as dangerous more times than I can count. It's false and misleading and I don't see why they couldn't pull the same shit with anything else.

Windows is a consumer/business product. For the vast, vast majority of its customers, keygen files are going to be malware.

It would only be censorship if you didn't have a choice to avoid Defender, and you obviously do, or if Microsoft had some sort of political interest in suppressing files named keygen.exe.

'For the vast, vast majority of its customers, keygen files are going to be malware.'

That's just not true though. They have the ability to detect malware. What they are doing is blindly labeling anything reslembling a keygen as malware , for no valid reason. This also doesn't just apply to Defender.

> What they are doing is blindly labeling anything reslembling a keygen as malware

First of all, that's not true. You can test it: create an empty file and name it keygen.exe. It won't get deleted.

The code inside the file has some similarly to one of the hundreds of thousands of malware used to train Defender, and there's a false positive.

None of that matters, though, because you can just not use it if it causes problems for you.

Found the Windows Defender dev

The problem is that "the hundreds of thousands of malware used to train Defender" include keygen files that do not have any malicious behavior and just generate keys, mixing them together with actually malicious keygens that e.g. try to install some rootkits. It's not a false positive mistake, it's a whole class of intentionally misleading false positives, censoring a type of not-malware that is not wanted by Microsoft but potentially desired by users.

I really hate windows defender. It's as aggressive as Apple and a constant struggle to shut up.

But on the bright side install any other AV (including free malwarebytes) and it will switch off.

You should probably research how the crash reporting works, but the gist of it is (iirc) companies can register their software with Microsoft and get these crash reports sent to them.

The problem is that if you’re using a 3rd party app that IS NOT registered, it still sends the crash info to Microsoft.

Re crash data: MS actually provides crash data to 3rd party providers who set things up correctly. So if you have a desktop app you don't need to roll your own crash collecting system if Winqual [0] is enough. Apps that roll their own (like chrome and 100s of other crashpad based apps) usually disable MS error reporting for their executables.

Also MS does ship shims for popular 3rd party apps that don't fix themselves, for better or worse...

[0] https://en.wikipedia.org/wiki/Winqual

The problem is that if you’re using a 3rd party app that IS NOT registered, it still sends the crash info to Microsoft.

They should create some better apps to manage/configure that stuff. All I see as a user is when any app crashes it gets sent to Microsoft.

Yeah, because MS sometimes fixes or shims those too, if they are too popular (or fixes bugs in their own API if those led to the crashes).

Of all the questionable telemetry this one is actually useful...

> "Microsoft—as though they can fix 3rd party apps for us.."

They can, and have done for decades. The classic famous one is retold by Joel Spolsky as "[...] a bug in SimCity where he read memory that he had just freed. Yep. It worked fine on Windows 3.x, because the memory never went anywhere. Here’s the amazing part: On beta versions of Windows 95, SimCity wasn’t working in testing. Microsoft tracked down the bug and added specific code to Windows 95 that looks for SimCity. If it finds SimCity running, it runs the memory allocator in a special mode that doesn’t free memory right away. That’s the kind of obsession with backward compatibility that made people willing to upgrade to Windows 95". One from Raymond Chen is a program which hacked its way through the control panel printers menu and Microsoft had to detect that, put a dummy menu for it to use, then trigger what it was trying to achieve. Since then application compatibility has become its own subsystem in Windows which developers, enterprises and Microsoft can use to create compatibility shims to make programs keep working even if their makers have gone out of business.

https://news.ycombinator.com/item?id=2281932

https://devblogs.microsoft.com/oldnewthing/20060109-27/?p=32...

https://docs.microsoft.com/en-us/previous-versions/windows/i...

> "Interesting ideas here: how antivirus becomes a form of censorship. Maybe that’s an extreme view but it feels like now that Microsoft supplies it’s own defender app"

Why didn't it feel like that for all the other antivirus false positives from McAfee, Symantec, Norton, F-Secure, Panda, et al over the years?

And how is Microsoft (not a government) or Defender (optional) anything to do with martial law?

lowering the quality of the discussion admittedly, but in the most generous possible tone of voice, I ask, why does "thunderbong" have password protected zip files of game-cracking exe files ? because of smoking weed and piratin games thats why !

and, should the wealthiest corporations on earth be in charge of making sure that thunderbong does not get to make game cheats at home ?? of course NOT

on the other hand, as a software developer in the 90s, I went to Hong Kong, and saw first hand stalls of 100% pirated movies, games, OS and apps.. lots of it, with professional COPIED artwork and packaging .. as a content creator this was really disturbing.. people told me that there are no software development jobs (then) only hardware companies, for this exact reason

Summarize- commerce takes place in a market, and theft is a real, constant problem, both at the commercial level (Hong Kong) and personal level (Thunderbong). Yet, society must have some stable relief valves for overzealous, rich Sheriff types, and overreaching rich merchant types, to prevent rifling through the rights, privacy and headspace of Thunderbong, and the legitimate customer THEY might become, while dealing with commercial pirates who are just basically stealing.

I am a Westerner, and I have to say, I am more concerned that Thunderbong have a safe life, than I am about the profits of Merchant and turf of Sheriff.

Few days ago it flagged a test binary from Ghidra: https://github.com/NationalSecurityAgency/ghidra/issues/3160

> I also noticed that with win10 when apps crash it sends the data to Microsoft—as though they can fix 3rd party apps for us

I don't develop software for any Microsoft platforms, but on the platform I develop for it's actually common for the vendor to break something in their API, so that crashes in 3rd party apps are actually due to a regression in the platform frameworks. Analyzing third-party crash reports could guide them in catching those cases.

In the Windows defender settings, I believe under history actions or something similar (I don't have a PC running defender at hand) you can release and whitelist files it has placed in quarantine.

Yes that's why you have to unzip them on a Mac or Linux PC first. It does the same for Windows Loader by Daz and similar activation cracks for Windows 7/10.

...or you just disable Windows Defender.

Which you can’t do permanently anymore.

You can permanently disable it with policies.

https://www.windowscentral.com/how-permanently-disable-windo...

You can still delete its required files with NSudo so it can't run.

You can also just whitelist it. It's how I maintain my LTSC variant

Another option is using a folder you've added to defenders exclude list: https://support.microsoft.com/en-us/windows/add-an-exclusion...

Not to condone it's stupid behavior, but I believe it put them in Quarantine. They keep moving the setting location around but I believe the menu option to located them is called "Protection History" where you can see what action was taken and undo it.

Out of curiosity, which shareware programs were you developing back in the day?

Gives a new meaning to “software is eating the world”

Wow. Any idea why?

Many virusscanners do this, arguably because as an employer you would want to block your employees from running them.

I'd also be curious what happens if you rename them to {not-keygen}.exe

I'd hope it wouldn't make a difference, but my experience with IT security thinking makes me bet the other way.

It sadly doesn't make a difference. I have about a dozen keygens on my machine and they get quarantined unless they're zipped behind a password or zipped into a 7z.

Just downloading a zip with a keygens inside, it gets removed from the zip before even unarchiving it.

Also, AFAIK by spec, the manifest of a zip file is unencrypted, even if the zip "is".

Most scanners are too brain dead to care, but I have come across a few that still quarantine if the manifest lists a file with a blacklisted extension.

Easy solution? Compress to zip, then compress that zip to another zip, with a password.

(Yes, I've spent far too long trying to get work done underneath insane corporate security policies)

Gmail will block you from sending a a password-protected ZIP with anything potentially bad in it, like an EXE, because they can see the individual file headers and central directory, like you say. Unfortunately, if you have a ZIP inside a passworded ZIP it also gets considered dangerous and blocked.

Here's a workaround: rename the .exe file to a .txt file, then put that in a password-protected zip file. Now braindead security scanners have no choice but to believe that it really is a text file.

Yeah, I once circumvented gmail's antivirus detection by sending a (perfectly legitimate) installer executable as a txt file because gmail apparently just has/had a strict "no files with certain extensions" policy. And IIRC Zendesk applies the same rule to file attachments on support tickets.

I had pitched for my team to build a tiny widget that would send attachments to virustotal, but it would have required a license for commercial use and we never had a security incident with files coming into our support center so it never became a priority.

> we never had a security incident with files coming into our support center

...that you are aware of.

While this may sound like a dumb policy, the end result is exactly what you want, a system that makes it impossible to have you download executables without you being aware.

Can confirm that ServiceNow and Outlook have the same workaround.

I renamed it into {not-keygen}.{not-exe} instead. I didn't investigate the issue in details, but I think that Microsoft expects a more enterprisey file name for a legitimate keygen. I should have called it something along the lines of CredentialManager.exe instead :)

But I wonder whether it did auto-submit these files to Microsoft together with my private keys. I'm glad that the private keys were in config files outside of the executables, and this probably saved them from being compromised.

If everybody started renaming keygens to CredentialManager.exe, would the learning algorithms the AV companies are using start to flag and delete those .exes too?

No way, right? What could go wrong?

That's fall out from the 90s. People hunted for keygen.exe for their sharewares. And some rouge sites will collect many keygens, attach backdoor program with those and then distribute from their site or over bit-torrent.

Anti-virus then would scan those files. Looks like modern ones simply delete any such named file without scanning.

And this is why the first thing I do with winblows is disable defender.

So much for that.

It serms that antiviruses today have only antifeatures. The last time i saw an antivirus detect malware was more than 10 years ago. Now the only protection against viruses is common sense, a good backup and another OS to recover what's left after the disaster strikes.

The problem is that you also need backup bank accounts and probably a backup identity after disaster strikes...

This depends on your online presence. Even if malware touches my computer it has no access to bank accounts and the amount of personal info is low. I still have to find a better email provider than yahoo or gmail for receipts.

Honestly I've been over it for years. I do real work on Linux and MacOS. Windows is for a handful of games I can't play on Linux.

Everytime I try to use windows for work I end up with issues caused by windows update that blows out chunks of my work day.

A friend that worked at an antivirus company told me they had a whole division whose task was to write viruses. This helped then to gain on competitors in the benchmarks "which antivirus detects more viruses"

Non-braindead antivirus software would look for the backdoor programs rather than the keygens themselves. Though as time goes on, I become less and less convinced that there's such a thing as non-braindead antivirus software.

Its not even braindead, just plain lazy.

Although I have to agree with your second sentence.

check if there's any trojan appended to them... or if you've used UPX to package them then they will automatically get flagged.

What’s the deal with UPX compressed executables being “dangerous”? Is there self modifying code or something?

it used to be a very common way to append trojans to existing executables. First pack them then add small payload (ones i've seen were usually ~20kb in size)

Then antiviruses took an easy way out and marked all as viruses for some reason...

Reply on news.ycombinator.com