Hacker News Reader

Comment by marcodiego | Hacker News Reader

Free as in beer. I wouldn't trust such an intrusive proprietary application on my machine from a vendor who doesn't need to care about its reputation.

View on HN

I can get behind that mindset, but if you're using Windows you've already given up your ability to introspect your system. The same is true for most of macOS/iOS and large parts of the basic feature set found in Android. Most Windows programs, both freeware and paid, are closed source, that's just the way that ecosystem functions.

These companies can exist the same way Winrar can exist: give people the tool for free, wait for them to want to use it at their business and sell the subscriptions there. Businesses are much more wary if pirated software than consumers so Winrar manages to survive to this day. To me, the amount of telemetry collected from modern crapware indicates a lack of trust in the product from even the developers themselves, which in turn proves to me that the product isn't very good on some level I might not be able to see.

Just because something is free doesn't mean it's not reliable if there are business subscriptions funding the product itself. The way programs stalk their customers these days used to be rare and the O&O team seems to follow the old software shop practices rather than "modernising" and adding the very thing they try to block to their own product.

It is possible to use windows as a mere kernel. Much desktop software on a modern linux distro is portable. Even your example, winrar, can be replaced by peazip or 7zip.

I actually saw some people using mostly FLOSS on windows as a step before full migration away from it.

Had the same thought, but upon investigation I don't see the incentive for the vendor to do something shady with it.

They have a clear business model: Develop software for Windows that companies need. See their About page: https://www.oo-software.com/en/company

Hence, it is clear what benefit they draw from releasing this software for free: Marketing. They are not in the business of brokering user data or mining bitcoin covertly. This tool isn't even installed, it's "run once". To me, that's about as trustworthy as it could be.

> I don't see the incentive for the vendor to do something shady with it.

Now.

It is not a matter of having incentives. It is a matter that they can abuse and you simply have no way to check or control it.

You have no way to check if this app is sending network requests back 'home'? That doesn't seem correct at all.

For such an intrusive application there are many ways to hide it. Not saying they do it, but I see no way to check it unless looking at the source code.

Well, two possibilities that come to my mind:

- Run it in a Windows VM. The program could detect this and not phone home in this case, of course.

- Monitoring on network level (wireshark on same network, Pi-hole, router itself...). This is virtually impossible for the program to circumvent.

You could also audit the changes it made to the system (resorting to stuff like diffing disk images before/after if you really want zero trust) to verify that nothing sneaky was left after running the program once.

Is it possible to circumvent Wireshark, Procmon and the likes? Otherwise those 2 combined give pretty good insight in what an application is doing wrt I/O.

Looking at the source code is pretty useless unless you compile it yourself...

Windows will most likely consider this malware, since it is effectively piracy (removes activation checks) and it does mess with Windows Defender by disabling a bunch of phone-home stuff like malware sample submission. If you're already getting people to disable Windows Defender and/or make an exception for the exe, it's suddenly super easy to also embed some custom C&C into it, either for mass use (eg. using a Windows service to have machines participate in a ddos botnet) or for targeted use - when a specific network block downloads it, the C&C sends a different payload that quietly looks for git credentials or trade secrets and ships them off.

They technically don't have an incentive now, but if they ever get one, it'll be super easy to abuse this position to embed malware. Don't think of the threat as the current company, but someone buying them for $millions and quietly doing this years later.

It is not considered malware by Smart Screen from what I can tell. Kaspersky doesn't have any issues with it either, and I've run both the original and the ++ Version of ShutUp.

This is portable by the way, so I don't really see the point in worrying about rogue company takeovers.

Windows won't treat this like malware, because, all the other similar products out there are not treated as malware either.

because it does not run as a service/persist, it will be undone by the next big windows update anyways.

I've not done any in-depth analysis of this app, but have used it on a machine that required windows 10 at the time. My family and friends have also used it. I can say that after they use it, the DNS activity to the Microsoft tracking endpoints appears to stop and other DNS activity is reduced but I am no windows expert so I can not say for sure if 100% of telemetry is truly nullfied. The real time dependencies on the activity DNS/HTTPS endpoints does appear to be removed after usage. From a network perspective it does stop the "chattyness" of Windows 10.

> I can not say for sure if 100% of telemetry is truly nullfied.

I'll leave this here: https://ameliorated.info/

No Windows Update for you, so security is debatable.

This looks interesting. Is there something like a Vagrant build image for this so that you can easily automate the build process to pick up the updates and adjust the configuration/customization in a json or yaml file?

I prefer the script[0] instead of the hacked ISO since you can install the script in later versions of W10 using your own preferred ISO.

Only caveat: There's no way of telling what versions of W10 it's compatible with (I imagine it breaks some versions). I have an old VM with AME installed and manually enabled updates by hacking the registry. (You could also alter the .BAT script to enable updates, but you have to know what to remove).

This project is cute, but I only ever used it for an offline sandbox for running low resource games and cracked versions of Photoshop. I am scared as shit to connect this thing to the Internet. I only connect to receive updates.

[0] https://wiki.ameliorated.info/doku.php?id=documentation_20H2

> Since AME is no longer maintained

What do you mean by that? AME 21H1 was released just the other day.

> This project is cute, but I only ever used it for an offline sandbox for running low resource games and cracked versions of Photoshop.

It's perfect for VM use, but I would never use it as my main OS.

Wow only learning that now. I thought the project got abandoned

Thanks for the update!

I mean, it doesn't make much sense to replace an abusive feature with a software that has the same abusive potential.

If it was open source, then maybe there would be some reason to trust it.

It is sad that things like this are even required in the first place. I would really like to have more trust and confidence in Microsoft. To earn that trust they could provide one page with all PowerShell sub-commands and links from each command to a man/help page with real world examples so I don't have to trawl through technet and google or random github gists.

They could also give people a true option during installation to really for-really-real disable telemetry regardless of what license home, pro, enterprise, ltsc they are using.

Fragmentation is not in ms best interest, but they could actually license just the nt kernel with a bootloader capable of launching it. Then people could build nt based distros with carefully chosen packages. Just like it is done with GNU/Linux.

Maybe some one could write an application to delete as many files as possible from a pristine windows copy to turn it simply into a kernel launched by a bootloader. Is there any project that does that?

That's an appealing idea. From watching the behavior of XBox One and Windows 10, I would be really surprised if they created such a thing. It really seems more like they want people to have dumb terminals with their binaries pseudo-cached and operate more like a mainframe/cloud model.

The simplest way to test any software you're suspicious of on Windows is Sandboxie (https://sandboxie-plus.com/downloads/). Any files or registry changes are persisted to a separate location in the filesystem, so it is pretty easy to catch misbehaving software. For software like this, it will negate the utility of the software due to being in a sandboxed environment, but it will least give an idea of the registry keys and files that may be modified.

This is not convenient to do at every update. On a windows system were there is no known concept of built-in package manager it is even more complicated. I've seen windows apps that automatically update themselves.

Also, since it is very intrusive, I don't think running it into a sandbox may give good diagnostics.

If this program has to be run persistently, then it won't provide much, since a malicious program could wait X days prior to downloading a payload. It is mostly useful for looking for one time changes like registry settings and verifying that the program doesn't place a bunch of random .bat or .exe's in obscure folders.

Windows loves to silently update things, even if it ends up breaking everything, too. Especially drivers where it isn't super obvious that it was updated and something just stops working. Windows 10 is _way_ more aggressive with forcing updates than 7/8 were, automatically re-enabling Windows Update after 30 days of disabling. The easiest solution that I've found is just blocking everything at the DNS level. They can obviously use IP addresses as a workaround if they really want telemetry, but I haven't had issues after blocking a bunch of MS domains in the hosts file.

Fair enough, though O&O has been around for ages (24 years) and I don't remember hearing anything bad about them (and have used their software in the past).

Are you talking about this tool or Windows itself?

Actually it can be seen as both.

You're replacing an abusive part with another with the same potential of abuse and you can't check of modify either of them.

Confirmed abuse isn't the same as potential abuse.

You mean windows. Neither do i. Linux and VMs for the proprietary crap.

How did you get windows in there in the first place?

They're a Microsoft gold partner. Their reputation is on the line.

Their with microsoft, you mean. Considering microsoft's reputation with regard to telemetry and other abuses, I'd say it doesn't mean much.

You're happy enough to take Microsoft products, how much worse can a microsoft gold partner be?

Partners aren't with Microsoft. They're vendors and service providers that live off of scraps from the mothership. If they were to do something malicious, it would potentially cost them their business. I'm sure Microsoft itself doesn't care if under 1% of desktops use tools like this to turn off their telemetry.

Reply on news.ycombinator.com