Hacker News Reader

Comment by drnick1 | Hacker News Reader

Another win for the Linux security model (software installed and updated manually from vetted repos only).

Wait, you're saying a monitor can just advertise a URL over the video connection for its driver and then Windows will blindly install it, without user confirmation? I thought that LG had submitted these "drivers" (adware) to Microsoft and they approved it.

I believe you register your device with Microsoft so Windows can automatically obtain and install drivers for them when they are plugged in.

What LG sent in for installation is not a simple .inf or .sys/.dll file. They sent in a whole bag of software which does all the nasty things, and Microsoft doesn't vet or care about the software installed as the "driver" of the hardware.

This is actually a feature of the .inf by design, an AddSoftware directive. It can even link to apps from the store instead of bundling them with the driver. This is designed to install settings panels like the ones for GPUs.

https://learn.microsoft.com/en-us/windows-hardware/drivers/i...

I guess that from Microsoft's perspective, the driver itself wasn't suspicious, but it installs a questionable sidecar app they would have never vetted anyway.

Eh? No.

It's just a device attached to a computer.

But in a Plug-and-Play world, its addition is noticed by the operating system -- as has been normal for decades.

Microsoft's Windows operating system sees this new hardware ID and then goes forth to install whatever-the-fuck software it associates with that identification, presumably as a service to the user. (Did Microsoft approve it? Dunno. I'm just over hear eating popcorn.)

> Eh? No.

That's what I thought. It is vetted software, just like on Linux. Microsoft just doesn't care if it shows ads.

That's an excellent and terrific point. In this way, the dichotomy between Windows and Linux can be as if they're just two sides of the same "vetted" coin.

I think the point is that:

1. Yes Windows must have "approved" the drivers

2. Windows Update runs automatically and not (usually) manually

3. Automatic update can't even be disabled, only manually postponed a bit

At least 2 and 3 are different on virtually every Linux distro. Also, I find it very unlikely that they would accept such behavior.

To give MS the benefit of the doubt here, now that this happened and has been reported on they might decide to enforce stricter rules on manufacturers in the future. But as a Windows user you don't have a choice in case you don't like how they decide and how their decisions might change again later.

https://github.com/raphire/win11debloat

This has an option to disable downloading of auxiliary apps when a device is connected. Yes, it's a Windows Update thing.

> Prevent Windows from auto-installing device companion apps, like LG Monitor App, Alienware Command Center and more.

Neat codebase, well structured imho.

Here's the thing it does: https://github.com/Raphire/Win11Debloat/blob/master/Regfiles...

As far as I'm aware, the monitor does not transmit a URL. Windows is looking at the hardware's vendor and device IDs and using those to look up and download the "drivers" that LG has stated are for that device.

> software installed and updated manually from vetted repos only

So something most desktop Linux users don't do.

'desktop Linux' is a term used when the majority of Linux users don't support your argument.

Are you disputing that the repos are vetted or that users use them???

Virtually all desktop Linux users do. The biggest exception is AUR as its not vetted.

I would say 95%+ do just this. The Debian, Ubuntu, and even Fedora repos are very large and include all the software you could ever want. And then flathub takes the rest.

It’s really only arch with the AUR and some others where completely untrusted packages are used. This is legitimately a better model than what windows does, although Microsoft has been trying to change this with winget.

most of my machines use unnatended-upgrades

Increasingly software is distributed by "curl dodgysite.com/get.sh|sudo bash -", no different to running "install.exe" on windows

Surely Windows Update is a vetted repo as much as arch or debian

Nah, install.exe must be signed by a certificate authority or you get 10 prompts, and they do revoke certificates.

> Increasingly software is distributed by "curl dodgysite.com/get.sh|sudo bash -"

I don't think this is the norm at all. I have seen curl/bash install scripts for tools like Claude Code, but they don't use sudo, and the expectation is that you deploy them in isolated user accounts or containers.

> the expectation is that you deploy them in isolated user accounts or containers.

Why are you lying right now? This is a norm across the dev tools world for businesses to distribute dodgy curl piped to bash scripts that users install without question, popular examples: homebrew, docker, nvm, bun, deno, k3s. There is zero "expectation" given by any of these install scripts that they are isolated. Can you even find a single source online that suggests doing what you said for you to think its a commonly held expectation?

> Can you even find a single source online that suggests doing what you said for you to think its a commonly held expectation?

Isn't it common sense? Do you want coding agents to read and possibly upload somewhere the contents of your home directory?

Also, the expectation on Linux is that you install tools like Docker from the distro's repos.

== Docker ==

Docker provides a convenience script at https://get.docker.com/ to install Docker into development environments non-interactively.

== Homebrew ==

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)"

Paste that in the macOS Terminal, a Linux shell or WSL. The script explains what it will do and then pauses before it does it. Read about other installation options.

== k3s ==

K3s provides an installation script that is a convenient way to install it as a service on systemd or openrc based systems. This script is available at https://get.k3s.io. To install K3s using this method, just run:

These scripts have lines like

> abort "Need sudo access on macOS (e.g. the user ${USER} needs to be an Administrator)!"

> # --- use sudo if we are not already root ---

There is one major difference: those install under your users. I haven’t seen a windows installer that didn’t require admin. Some older Linux apps require sudo. They don’t need to do that anymore, not for a while. We have xdg standards of where to install stuff in a users home directory.

Tons of Windows apps these days install into user's AppData these days. Its common for installers to ask "Install for everyone or just me".

The last time I used Windows seriously, which was Windows 10, this was not the case. If that's changed then great. But we need to acknowledge that Windows software install is changing to become more Linux-ified. With package managers and repos out of the box.

Clearly the Linux model is more secure, and Microsoft knows it. It's a good idea for Microsoft to take inspiration here. It's only a matter of time before they do containerization too, ala Flatpak. The biggest hurdle to that is Windows doesn't have native containers and the entire container ecosystem is build around Linux.

If Microsoft wanted my advice, which they don't, I think it would cost less at this point to just make Windows a Linux distro. Wine is already better at running older Windows software than Windows. Just expand Wine a bit, add in acceleration where it doesn't already exist, and boom you're done. Nobody would even notice.

And maybe then Windows on ARM wouldn't suck so much.

> The last time I used Windows seriously, which was Windows 10, this was not the case.

Apps like Chrome and Spotify have been doing it for almost 20 years, since they made their Windows apps back in 2008. Python updated their installer to install to the user profile in 2015 with version 3.5.0. VSCode started doing it in 2018. Discord did it at launch in 2015. Zoom and Teams and Slack do it and have for a long time. Its been a pretty common pattern for a long time.

> Windows doesn't have native containers

Windows supports Windows containers natively and has supported Windows containers for a decade.

> maybe then Windows on ARM wouldn't suck so much.

Windows on Arm these days really isn't bad. It definitely sucked a lot several years ago with tons of compatibility issues (along the timeframe you said you last used it seriously), but they've made massive improvements since.

While windows has containers, I’ve never seen them seriously used and realistically nobody is leaving docker or podman. I include podman in that because Red Hat was smart and made podman almost a direct drop in.

I’m very cynical about windows. Mostly because windows is bad in almost every way software can be bad.

sudo dkpg -i FileYouDownloadedFromAnywhere.deb

Let's be real, in most cases it is:

    curl -s script.random-guy.net | sh

It is such glaring security hole that there was an old submission about filling such install script with `sleep` commands and detecting it on server side, to send different versions for downloading (and reviewing) and for actual direct execution.

I use those scripts to improve the likelyhood it'll fail to do anything useful.

I even used uname as a fuzzing tool, and that broke builds spectacularly. There's now a more reasonable uname in the sandbox for builds.

the method you describe is clearly only done by people that are irresponsible and most probably stupid.

and no, this is not how most software is installed

I agree

https://rustup.rs/

very very stupid yes, and there are some other high profile softwares encouraging this brainrot, but, still not most.

anyone doing this should really take a very very big look in the mirror

    wget https://raw.githubusercontent.com/timofurrer/russian-roulette/master/russian-roulette -O - | sudo bash

Almost never occurs as the repos contain a ton of software.

Surely you mean Linux security model (not relevant enough to be targeted by big tech)?

It's not a weakness that they targeted and exploited, it's a feature that was purposefully implemented by Microsoft.

If you're trying to say that Microsoft implemented a method of delivering specifically malware executables to every PC, I've got a bridge to sell to you.

Let's not diminish LG's part in all this.

No, what I'm saying is that Linux isn't safer simply because "it's not relevant enough to be targeted", it's safer because it doesn't offer mechanisms which could be abused to do this.

Nobody is diminishing LG's blame, LG is guilty of installing malware, and Microsoft is guilty of being grossly negligent and facilitating it. Microsoft implemented this feature knowing that it would eventually be abused for something like this, and it's bad enough to be indistinguishable from malice.

Famously, the Linux kernel does not have a stable ABI for drivers. As a result, by far the majority of drivers are in-tree, maintained by the kernel folks as part of the kernel.

The Linux approach has the downside of not having the drivers if a vendor has not been working with the kernel community before launch (or for those who haven't upgraded to a kernel that has the driver, e.g. a LTS release).

On the other hand, the driver is maintained by kernel developers, not created by the hardware developer who is not getting paid after they sell the device. This helps avoid abandoned / vulnerable drivers, or having the hardware dev search for... alternative revenue streams, as in this case.

> Another win for the Linux security model

I swear, OSs have become sports teams.

Linux's 'security model’ has plenty of holes. The very fact the kernel and much of its user-mode is written in C almost guarantees that its security model is worthless. The Linux ecosystem operates on trust and respect that can and has been easily abused by bad actors to provide supply-chain pwnage.

There have been so many zero-click local privilege escalation CVEs I've lost track.

Arch Linux AUR malware: https://lists.archlinux.org/archives/list/aur-general@lists....

AUR is an effectively unmoderated user repo. It’s not Arch Linux’s core repository, nor is it enabled by default or indeed even possible to use without manual downloads from outside the package manager.

There's still a security there though.

You have confidence you are actually downloading the same foo as everyone else. And if there were an issue there would be pushback. Not so if you get some random exe from warez.com

Yes it isn't perfect, it's still a lot better than windows land.

I think you can probably find a better example, even if less recent. The AUR is unofficial and not properly vetted in the same way as the actual Arch repos, Debian repos, etc.

> Linux's 'security model’ has plenty of holes.

Implementation bugs are not holes in the security model. Linux has plenty of those, as does Windows.

Windows security model trusts, downloads, and immediately executes arbitrary software when a new untrusted device is plugged in, without asking the user.

Reply on news.ycombinator.com