Windows 0-day was exploited by North Korea to install advanced rootkit

Dang, I'd like a copy of that script. Eml parsing, even with powershell and Exchange modules, is painful.

I still get "security updates" for Windows 7 Professional and am unsure what the lack of "support" might mean for my business.

Windows10 LTSC ftw, EOL 2032

https://old.reddit.com/r/WindowsLTSC/wiki

W10 offers extended support for everyone as long as you pay for it.

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/w...

I think a more ultimate "just in case" is downloading the ISO image file which is what you would need if you were going to burn a traditional Windows installation DVD-ROM.

The ISO file just sits in a folder like a last resort installation backup, but it can then be used to create a fresh bootable Windows installation USB stick (or DVD) any time from then on without need to access the internet after that.

Well you might want to use a program called Rufus which will more conveniently turn a Windows installation ISO into a bootable USB drive than the Media Creation Tool anyway.

Plus IIRC, Rufus would run under Windows 7, but you will need to use last year's version of Rufus, look at this page of current and past versions:

https://rufus.ie/downloads/

You will see that rufus-3.22.exe from 2023 is the newest thing that was intended to run on W7, so download that, download the W10 ISO from Microsoft, and you can then run Rufus to choose the ISO from your own filesystem that you would like to turn into a bootable USB stick.

That USB stick would then be the Windows 10 installation media like you probably wanted to begin with. It also has some recovery functions and a powerful command line on its own if you need it.

Really still functions this way not much different than the original W7 installation DVDs up to W11 so far.

Change your useragent to non Windows and MS provides download links to .ISO instead of their windows only tool.

I agree, I gave up on Windows since the deployment target for .NET services (web, etc) are now fully Linux, at least in my case. Linux is a known OS and there's thousands of experts. We can see under the covers and get a deep understanding. I highly recommend you install Linux on an older laptop and try it on your time off. As for package management, in terms of .NET its just nuget still, in terms of installing packages, there's UIs for them, but yeah you do need to sit down and read about it so you have some familiarity for when something goes wrong, which in the case of Ubuntu / Debian is only really the case if you're installing packages not maintained by them, Debian has insanely strict rules on what they consider stable, which means you get a slightly "dated" set of packages, but the confidence that your OS will not blow up out of the blue.

What pushed me over the edge to Linux was Windows Defender sends files to Microsoft for analysis, but there's no audit trail for what those files are. It could be my PII for taxes, could be highly proprietary documents for my employer / company. I have no way to know what the heck their heuristics or whatever has seemingly found suspicious and uploaded.

>I'm guessing that, whatever frustrations, Windows will be able to support the computing for my business.

Azure/.Net SRE/DevOps whatever person here. I wouldn't be that confident in that bet.

Windows Server, if you look at change log for each version, it's not a ton and IIS hasn't seen any love for a while. While Microsoft will continue to offer it, it's mostly in maintenance mode.

.Net (Core) team is clearly over Windows. I've talked to Microsoft developers on this several times, they have been extremely upfront about it. Linux is preferred operating system for running .Net. Performance is much better, testing is better and it's cheaper which is massive positive. .Net powers a ton of Azure and Linux is first choice.

Speaking of other Microsoft Technologies, SQL Server is getting worse and worse and I'm seeing more and more .Net convert to MySQL or PostGres. Proget, the king of .Net Software Packaging is moving to PostGres: https://blog.inedo.com/inedo/so-long-sql-server-thanks-for-a...

Yes, ARexx was big. A lot of popular software had an ARexx API so you could script across programs. Pretty awesome. I haven't seen anything like that since.

Aha!

If they marketed it every enthusiast/pro/gamer would buy it and it'd make their default offering look like some kind of economy version.

> Except most branches are having an extremely difficult time filling those roles

Most of the issues with recruitment tend to be less skilled MOSes like Infantry.

IOW, Intel, and Cyber MOSes are given a fast track to NCO and very good post-military careers, along with a decent entry pipeline via ROTC or Training Schools for enlistees like JCAC.

Most vendors and large tech companies (eg. GCP, MS Azure and Security, PANW, Cisco, AWS, etc) will often hire ex-Intel and Cyber trainees in lieu of a bachelors degree, so it's often a very affordable path to high paying tech jobs (Sales Engineering, Systems Engineering, Support Engineering, etc).

> bringing civilians into those roles at an O5 grade

Pardon my French, but that's bullshit. Only the newly created Cyber Warfare Officer in the Marines is at O-5 (largely due to budget and staffing issues w/ the Marines because it's competing for the same pot of money as the Navy), and they have to go through Officer Training School in VA.

Most entry level cyber roles are WO level (primarily W-1) or E1-3 if you are going to JCAC at NIOC Pensacola, and most Cybersecurity work was historically done by the Navy because Sigint was historically under the Navy, as all the IT and Cyber MOSes would get trained at NIOC Pensacola (none of this is classified btw)

IOW and Cyber are desk jobs - doing the whole shebang of military training is unnecessary, and competitors like China, Russia, etc exempt their equivalents in these MOSes from bootcamp, and they tend to require a degree or a civilian career for those same roles as well.

Also, these roles tend to require at minimum an Associates degree in Computers/Networking/IT, so plenty of grunts do upskill and get that via online programs like the AFIT, AMU, etc and then upskill after a couple years via Grants or get hired as Sales or Field Engineers at vendors.

Okay, and apart from "two advesary countries collaborating on what the rest of the world is doing", is your claim (or support of) of China being involved in this specific case based on capability, it getting caught, or just abstract vibes and speculation?

the purpose of having engineers write software is that they can transparently prove that it works reliably, and they can be professionally held accountable and learn if it fails.

You're suggesting that reliability should be improved by being obfuscating the code through transpilation or by merit of being generated by a black box (LLM).

I really suspect that simply transpiling code to rust or ada or some other "safe" language largely wouldn't improve its security. The whole point of these "safe" languages is that they encourage safer practices by design, and that in porting the code to rust you have to restructure the program to conform to the new practices (as opposed to just directly re-implementing it).

I haven't seen a LLM that is reliably capable of logic/reasoning or can even reliably answer technical questions, much less synthesize source code that isn't some trivial modification of something it has been trained on. And it's not clear that future models will necessarily be capable of doing that.

No idea what this is about but sounds like a test with extra steps