Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by delta_p_delta_x | Hacker News Reader

Parent Full thread

delta_p_delta_x·

To anyone reading this: please don't use ISOs downloaded from not-official sources.

Use an autounattend.xml, the mass graves, and a WinGet JSON to customise an online image.

[1]: https://schneegans.de/windows/unattend-generator/

[2]: https://learn.microsoft.com/en-gb/windows/package-manager/wi...

View on HN

The tool linked by the parent doesn't download ISOs from non-official sources.

Do be aware that an autounattend.xml can cause Windows setup to execute arbitrary code. Their provenance matters too. It's relatively easy to encode scripts (or even binaries) into the XML to run during or after Windows setup. You can eyeball them, for sure, but I bet most people don't.

Indeed. I mention this in light of the high-profile supply-chain attacks recently across diverse platforms (Arch AUR, Shai-Hulud, etc). Any online tool that purports to modify an entire install medium should be heavily and continually scrutinised. I'm not saying the developer can't be trusted, but the infrastructure and people in general can't.

Fine, but this is Chris Titus we're talking about, not Red Star

I use uup dump myself, which downloads the components directly from MS and builds the ISO locally

Did you even read what I wrote?

I did. You said:

> to get a NEW ISO which you then install

This is not good.

You provide an official Windows 11 ISO and the tool modifies it to get the new ISO. The tool is open-source here: https://github.com/ChrisTitusTech/winutil

I don't see the issue.

LOL. The entire ISO transformer code is open source.

Not so good at reading comprehension, are we?

Reply on news.ycombinator.com