Atlas: A Windows modification to optimize performance, privacy and usability
atlasos.net
atlasos.net
>An operating system marketed to gamers disables a host of Windows security features enticing users with promises of a smooth gaming experience which they may not realize is opening them up to potential attack.
https://learn.microsoft.com/en-us/windows-hardware/design/de...
It’s definitely a work in progress but I mostly found it disappointing when someone uses a comic from 2013 to argue against the kind of tools which have been getting built in the subsequent decade to prevent those kinds of failures. I wish we’d go further sooner but at least we’ve broken the assumption many people had in the 2000s that there was nothing you could do about it.
Practically speaking everything in the comic is still correct. The fundamental problem is that apps aren't sandboxed from each other, so once a malicious program gets on the machine it's game over. VBS tries to protect specific parts of the system, but without app sandboxing it's useless. For instance even if you use VBS to protect a service that can encrypt/decrypt on behalf of apps, all of that's useless when the system can't be assured which app is asking to decrypt the secrets.
Even in the case of windows hello, I'm not sure what VBS is trying to protect. If a malicious program is running on your system, it doesn't need to bypass the lock screen. I guess it's better for privacy because your biometrics are more protected, but it can always control the camera to capture a fresh set of images next time you sit in front of it.
On Windows, perhaps. On Apple and some Linux configurations, it hasn’t been correct for years because they implement app level sandboxing. Windows Sandbox, App Containers, etc. show that the Windows team isn’t ignoring that even though their backwards compatibility problem is much harder.
> For instance even if you use VBS to protect a service that can encrypt/decrypt on behalf of apps, all of that's useless when the system can't be assured which app is asking to decrypt the secrets.
There’s no technical reason why it can’t verify the app - indeed Chrome just started to do this to prevent infostealers from grabbing cookies – but also note that it’s still an advantage if malware can’t get the private key because that’s protected by VBS. Things like what password managers have done for years to require a handshake or rate-limit help to shift from the attacker getting everything effortlessly to only getting some things they specifically request or the first n things they try.
Much more simple project here that "debloats" Windows 11: https://github.com/Raphire/Win11Debloat
Atlas seems to be doing quite a bit like downloading archives, unzipping them, and installing executables.
I don't think they would intentionally compromise your machine, but at least they're very susceptible to supplychain attacks.
That said, there is a lot of good stuff in the scripts and registry tweaks that I wish could be made available independently.
> I wanted this to be good, but upon close inspection of the "source code" you can find various executables, archives as well as a lot of scripts that download files from various urls at runtime, not to mention the atlas themes, background, oem/bios settings, etc. which don't appear to be optional. I don't think they would intentionally compromise your machine, but at least they're very susceptible to supplychain attacks. That said, there is a lot of good stuff in the scripts and registry tweaks that I wish could be made available independently.
So Atlas guys, if you hear that, please split it into safe and potentially problematic parts so that the user can have a choice.
The best way to use Windows is just not to fuck with it. Default install, don't log in during setup, don't run any "debloat" placebo-ware and your computer will work just fine. If it gets slow or you get errors just nuke it and reinstall.
ah that brings back memories! I think the last time I even thought about that kind of thing was before installing nixos around 2016.
it's such a weird concept now!
The answer I've settled on, which has kept me slightly more happy and stable for a number of years, is Linux (primarily Pop_OS).
the copy on the site opens with "F... windows". the target demographic is running pirated games and keygens. they already disable defender.