7 ms·

Remove anti-privacy, anti-security, and general nuisance “features” from Win 10

82 points by luu 11y ago

therobot24 11y ago
I'm all for scripts to help set these things up fast, but never in a million years will i download some random .bat file to just click and run. Especially without documentation of each operation it's going to perform. I know i can just read the code, but i'm not skilled enough with windows to know if there's something else snuck in there or not.
- marak830 11y ago
  I agree, a little documentation would go a long way here. Id really like to read a post saying actually what it does too, it wouldbe interesting to see how effective it is.
  - MaulingMonkey 11y ago
    What exactly should be documented? The commands? The service names? The DNS records being sinkholed? The redirect-to-127.0.0.1 trick? There are blog/post links in various comments in these files, I should note. I'm not sure how documentation would help with the "might sneak something in" issue either. If anything, if you're feeling paranoid / reasonably cautious, you should ignore the documentation in favor of documentation you source yourself - if you can't trust the author to write the commands, you can't trust the author's documentation of the commands either.
    - marak830 11y ago
      Honeatly if i was running 10, id have definatly run though it, sorry poorly worded on my behalf. I should have just said id like to read a post on what he has done, any negative effects it may have and if he thinks he missed anything.
- lawnchair_larry 11y ago
  Seriously? Did you even look at it?
  - im3w1l 11y ago
    I agree that the scripts are very readable, but even if therobot24 might be able to understand them, there are many people who wont. Verifying it yourself doesn't work for the non-hacker crowd. The solution is that someone trustworthy vouches for the files.
- y0ghur7_xxx 11y ago
  > but never in a million years will i download some random .bat file to just click and run. I think that in this particular case you can trust the random bat file more than Microsofts official binary blob OS.
  - cwyers 11y ago
    Why on Earth would you think that?
- lcswi 11y ago
  Is there no 'curl http://example.com/script.sh http://example.com/script.sh | sh' equivalent for windows? It's really popular among the typical js/ruby/mongodb crowd so I guess it is safe and secure.
  - jholman 11y ago
    You might have been joking, or you might have been serious. If you were joking, my reply is for the benefit of readers other than yourself. Aside from the obvious risks of downloading and immediately executing internet code, which are indeed risks but of course we all accept them on a regular basis... ... and aside from the mildly more subtle risks that the HTTP server is doing something sinister, e.g. with browser-agent, and so you're not getting the code you think you're getting... ... even aside from these issues, curl-and-pipe-to-sh is dangerous because of its failure modes. https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
    - lcswi 11y ago
      I was sarcastic, thanks for that great link!
  - lmz 11y ago
    You're joking, but of course there is such an equivalent. See instructions on https://chocolatey.org/ https://chocolatey.org/ for an example.
  - mkup 11y ago
    There's no curl in default Windows installation, but "bitsadmin.exe /transfer" can do pretty much the same, and the shell (cmd.exe) has been around since Windows 95. So, actually, yes, but unfortunately without a pipe.
liw 11y ago
A good word for these is anti-features, introduced by Benjamin Mako Hill. https://en.wiktionary.org/wiki/anti-feature https://en.wiktionary.org/wiki/anti-feature
cautious_int 11y ago
This is a lose-lose scenario. If you don't trust a closed operating system in the first place, why would you then, after performing these steps, trust the system that it really does what it says it does. The point is that you don't know, and you can never be sure. The solution is to either trust or not, switch or stay, there is no middle path, because any middle path implies some amount of non-trust.
- lqdc13 11y ago
  i use linux for my personal things, but this is not a very good argument for most people. wouldn't you trade 1 in 100 chance of the spying affecting you for a much more usable OS? Some people i know get Non-metaphorical headaches from trying yo get computer things to work. Even people who are power users can only use Windows for games and some enterprise apps. So you either don't use a computer at all or use Windows and sometimes OSX.
  - zxcvcxz 11y ago
    IMO Linux (specifically fedora with GNOME) is a much more usable OS than either Windows or OS X. You could argue that this isn't true for the average user, but my parents have no problem with it and neither do any of my nephews and nieces. I could see some people needing office software, but the average user really can get by with LibreOffice.
- MaulingMonkey 11y ago
  > This is a lose-lose scenario. If you don't trust a closed operating system in the first place I don't trust open systems either. I don't have the time to audit them. If I did, I wouldn't trust myself to catch everything. I don't trust "enough eyes make all bugs shallow" either. Case in point: Canonical written "features" in Ubuntu, and OpenSSL bugs in general. > why would you then, after performing these steps, trust the system that it really does what it says it does. Don't trust: verify with wireshark? Alternatively, trust the people who wrote this to have run wireshark. Alternatively, "Trust but verify." I generally trust Microsoft and FOSS to not be actively malicious on their own behalf. I trust neither Microsoft nor FOSS to do their privacy due diligence, write perfect software, to be free of capitalistic or engineering pressure to add privacy harming features, nor to be free from subversion by state actors (NSA etc.) What's your superior counter-proposal, under these conditions? > The point is that you don't know, and you can never be sure. Fundamental truth of computing, not "windows 10". I can't even trust the code I write myself to be free of security or privacy issues due to my own mistakes or lack of consideration. > The solution is to either trust or not, switch or stay, there is no middle path, because any middle path implies some amount of non-trust. I reject the thesis that trust is binary. Were I to accept it, I trust nobody - everyone is vulnerable to being subverted by blackmail, intimidation, making mistakes, etc. Trust of system is also not the only factor influencing my use of a system. I trust a deeply buried cement brick more than any computer, but I can't use the web with it. I have very different trust needs for my bank servers, my workstation, my catstation, and my gaming console.
lmz 11y ago
It's good to read the scripts first. You might want to use some of the "features" this removes e.g. the Windows Store, the msftncsi.com host (network status indicator / captive portal test).
shocks 11y ago
I unfucked Windows 10 by installing Fedora instead. This is the first time in probably four years that I'm using Linux on my main desktop again, and it's been a pleasure. Things like SLI and dual monitors just work - I remember last time I had a Linux desktop these things were a nightmare. A surprising amount of my games on Steam (152 of 400) support Linux. Zero regrets so far! edit: Sorry, I didn't mean this to become a Linux bragging post. This looks like a great project! I appreciate the effort people are putting in to making W10 usable.
- thejosh 11y ago
  I'm kind of sad games work so well, because recently my time has been sunk into playing Civ 5 again!
  - shocks 11y ago
    Heh, I know that feeling! My vice atm is Cities: Skylines. I'm honestly really surprised how smooth the transition was for me. I expected it to be a bit rough - I only did the install telling myself "I'll give this a go for a week or so" - but I really can't see myself moving back any time soon. Even sleep works - and it works better than it ever did on OSX or Windows.
- WorldWideWayne 11y ago
  Windows 10 is orders of magnitude more usable than any Linux desktop that I've seen. All this does is toggle a bunch of settings for you. To make Fedora even remotely usable I had to un-Mac OS X it by installing a bunch of third party tweak tools and plugins because they took all of the major UI anti-patterns from OS X.
  - zxcvcxz 11y ago
    I completely disagree. Fedora seems to take OS X and make it much more usable and more intuitive and it cuts out the cruft. Any cursory glance of any Windows forum on the internet will show you that it is indeed not more usable than any of its competitors. I've personally set up children and elderly people with Fedora and it's orders of magnitude better than Windows in these cases seeing as it's almost impossible for the average user to mess up. Perhaps installing Fedora on your mac book was a headache, but have you ever tried to install OS X on non-apple hardware? It's worse than any other OS. If you bought Ubuntu certified hardware (as you did with Apple) you'd have no problem with Linux, so it's disingenuous to compare the two. Sorry, but Windows isn't an OS for "normal" people, it's an OS people use because they have to for some reason (games, work). It doesn't "just work" and it's not miles ahead of any other OS, and certainly not more stable. I've had my Fedora desktop up for months at a time without anything crashing, this typically can't be said for Windows in my experience.
dingdingdang 11y ago
Good effort for sure but I'm still really sketched out by the sheer amount of monitoring crapware on Windows 10: what stops MS from re-enabling all of this stuff? After all you and I will need to leave auto-updating on default in order for the OS to stay safe in Internet context. Which effectually means that MS can enable/replace all of these services at any given time. I get that trusting closed source code is always iffy but trusting closed source software that -intentionally- sets out to monitor and document your every move seems a less than optimal path to walk. Will stay on Windows 7 for now and if no better offering comes along from MS I will move to a Linux solution (or even OSX if my privacy stands a better chance of being protected than on Windows). Sad in a way cause I'm fundamentally fine with Windows from a work perspective, it gets stuff done for me.
w8rbt 11y ago
What's the difference between a sensitive/private email being composed on a smart phone or a Windows 10 laptop or desktop? It used to be that only the smartphone knew your location, what you type, who you are, who you are emailing, etc. The difference now is that desktops and laptops running Windows 10 do too. This seems to upset people, but the same people were/are OK with using smart phones. I don't get it, of course I don't use smart phones either and have no plans to use Windows 10. But when all my Android and iPhone friends complain about Windows 10, I just scratch my head and wonder these things.
- bigbugbag 11y ago
  It seems there are a few assumptions here which are not true: desktop computer (also laptops) know your location, what you type, who you are (sort of), who you are emailing, etc. and it has been so for a while but it used to be third party software, websites, governments, corpo or malware that would collect and use this data. Cell phones are tracking devices you can use to make a phone call, people using those devices doesn't mean they are ok with the surveillance that come with it. When your friends complain they're complaining that the surveillance is creeping its way back into an OS.
- brianberns 11y ago
  They are different computing environments. A desktop PC is a general-purpose standalone computer, whereas a smartphone without a network connection is of limited use. A desktop OS like Windows 10 creates a dependency on "the cloud" that many people find crippling, rather than enabling.
- metric10 11y ago
  ? The issue isn't that Windoes knows your location when you type an email, it's that it sends all this information and much more to Microsoft. If I type an email on my iPhone it doesn't get sent to Apple (unless, of course, I'm using my iCloud email account). Additionally, Apple is very clear which what they collect and what gets sent to Apple. They go through it when you set your iOS or Mac OS X device up. It's not hidden in some "advanced setup" link.
jetm9 11y ago
does this contain fixes for things explained in https://news.ycombinator.com/item?id=10053420 https://news.ycombinator.com/item?id=10053420? i think listing what it does would be cool. because after that revealation disabling everything and anything still may not be enough.
r3bl 11y ago
Is it just me, or is this like third or forth open source program posted here that does the same thing?
cwyers 11y ago
Like, this disables a lot of actual features -- the Xbox stuff, Windows Store... I get some people don't use that stuff, but it's generalizing from a local preference to a global one to call these "anti-features" and the like as some in this thread have. Features you don't use are not the same as features nobody uses. Meanwhile disabling UAC so you can run a pile of batch files off the Internet sounds like a terrible idea to me.
- nej_simon 11y ago
  The batch files are small so it's easy to verify what they do at least!
  - cwyers 11y ago
    Even if one reviews them and finds them not actively malicious (which on cursory review seems likely) there's still the question of how well they're written. If I am not mistaken, the PowerShell script to remove the bundled Metro apps (what's the deal with removing the Calculator anyway?) is littered with wildcards. The bigger point is that you shouldn't be disabling UAC anyway, and anyone who suggests it is immediately on my list of people I don't fully trust.
aluhut 11y ago
Thank you! This is what a Windows solution looks like.
deleted 11y ago
[deleted]
- MDCore 11y ago
  In the README: > Another warning: data-harvesting-services-removal.bat will be flagged as malware, since it tries to automatically alter the hosts file. You can either allow it, or add the hosts manually via the data-harvesting-hosts.txt file.
arthurfm 11y ago
The person who wrote the aforementioned batch files for Windows 10 also created "firefox-tweaks" [1]. These also contain some very dubious and/or irresponsible suggestions [2] which implies the author doesn't actually know what they are doing. [1] https://github.com/dfkt/firefox-tweaks/blob/master/firefox-tweaks.txt https://github.com/dfkt/firefox-tweaks/blob/master/firefox-t... [2] https://github.com/pbiggar/firefox-tweaks/commit/635779c79393d017a1a73dbc38e230546e724a35 https://github.com/pbiggar/firefox-tweaks/commit/635779c7939...

82 points by luu 11y ago

I'm all for scripts to help set these things up fast, but never in a million years will i download some random .bat file to just click and run. Especially without documentation of each operation it's going to perform. I know i can just read the code, but i'm not skilled enough with windows to know if there's something else snuck in there or not.

marak830 11y ago
I agree, a little documentation would go a long way here. Id really like to read a post saying actually what it does too, it wouldbe interesting to see how effective it is.
- MaulingMonkey 11y ago
  What exactly should be documented? The commands? The service names? The DNS records being sinkholed? The redirect-to-127.0.0.1 trick? There are blog/post links in various comments in these files, I should note. I'm not sure how documentation would help with the "might sneak something in" issue either. If anything, if you're feeling paranoid / reasonably cautious, you should ignore the documentation in favor of documentation you source yourself - if you can't trust the author to write the commands, you can't trust the author's documentation of the commands either.
  - marak830 11y ago
    Honeatly if i was running 10, id have definatly run though it, sorry poorly worded on my behalf. I should have just said id like to read a post on what he has done, any negative effects it may have and if he thinks he missed anything.
lawnchair_larry 11y ago
Seriously? Did you even look at it?
- im3w1l 11y ago
  I agree that the scripts are very readable, but even if therobot24 might be able to understand them, there are many people who wont. Verifying it yourself doesn't work for the non-hacker crowd. The solution is that someone trustworthy vouches for the files.
y0ghur7_xxx 11y ago
> but never in a million years will i download some random .bat file to just click and run. I think that in this particular case you can trust the random bat file more than Microsofts official binary blob OS.
- cwyers 11y ago
  Why on Earth would you think that?
lcswi 11y ago
Is there no 'curl http://example.com/script.sh http://example.com/script.sh | sh' equivalent for windows? It's really popular among the typical js/ruby/mongodb crowd so I guess it is safe and secure.
- jholman 11y ago
  You might have been joking, or you might have been serious. If you were joking, my reply is for the benefit of readers other than yourself. Aside from the obvious risks of downloading and immediately executing internet code, which are indeed risks but of course we all accept them on a regular basis... ... and aside from the mildly more subtle risks that the HTTP server is doing something sinister, e.g. with browser-agent, and so you're not getting the code you think you're getting... ... even aside from these issues, curl-and-pipe-to-sh is dangerous because of its failure modes. https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
  - lcswi 11y ago
    I was sarcastic, thanks for that great link!
- lmz 11y ago
  You're joking, but of course there is such an equivalent. See instructions on https://chocolatey.org/ https://chocolatey.org/ for an example.
- mkup 11y ago
  There's no curl in default Windows installation, but "bitsadmin.exe /transfer" can do pretty much the same, and the shell (cmd.exe) has been around since Windows 95. So, actually, yes, but unfortunately without a pipe.

liw 11y ago

A good word for these is anti-features, introduced by Benjamin Mako Hill. https://en.wiktionary.org/wiki/anti-feature https://en.wiktionary.org/wiki/anti-feature

cautious_int 11y ago

This is a lose-lose scenario. If you don't trust a closed operating system in the first place, why would you then, after performing these steps, trust the system that it really does what it says it does. The point is that you don't know, and you can never be sure. The solution is to either trust or not, switch or stay, there is no middle path, because any middle path implies some amount of non-trust.

lqdc13 11y ago
i use linux for my personal things, but this is not a very good argument for most people. wouldn't you trade 1 in 100 chance of the spying affecting you for a much more usable OS? Some people i know get Non-metaphorical headaches from trying yo get computer things to work. Even people who are power users can only use Windows for games and some enterprise apps. So you either don't use a computer at all or use Windows and sometimes OSX.
- zxcvcxz 11y ago
  IMO Linux (specifically fedora with GNOME) is a much more usable OS than either Windows or OS X. You could argue that this isn't true for the average user, but my parents have no problem with it and neither do any of my nephews and nieces. I could see some people needing office software, but the average user really can get by with LibreOffice.
MaulingMonkey 11y ago
> This is a lose-lose scenario. If you don't trust a closed operating system in the first place I don't trust open systems either. I don't have the time to audit them. If I did, I wouldn't trust myself to catch everything. I don't trust "enough eyes make all bugs shallow" either. Case in point: Canonical written "features" in Ubuntu, and OpenSSL bugs in general. > why would you then, after performing these steps, trust the system that it really does what it says it does. Don't trust: verify with wireshark? Alternatively, trust the people who wrote this to have run wireshark. Alternatively, "Trust but verify." I generally trust Microsoft and FOSS to not be actively malicious on their own behalf. I trust neither Microsoft nor FOSS to do their privacy due diligence, write perfect software, to be free of capitalistic or engineering pressure to add privacy harming features, nor to be free from subversion by state actors (NSA etc.) What's your superior counter-proposal, under these conditions? > The point is that you don't know, and you can never be sure. Fundamental truth of computing, not "windows 10". I can't even trust the code I write myself to be free of security or privacy issues due to my own mistakes or lack of consideration. > The solution is to either trust or not, switch or stay, there is no middle path, because any middle path implies some amount of non-trust. I reject the thesis that trust is binary. Were I to accept it, I trust nobody - everyone is vulnerable to being subverted by blackmail, intimidation, making mistakes, etc. Trust of system is also not the only factor influencing my use of a system. I trust a deeply buried cement brick more than any computer, but I can't use the web with it. I have very different trust needs for my bank servers, my workstation, my catstation, and my gaming console.

lmz 11y ago

It's good to read the scripts first. You might want to use some of the "features" this removes e.g. the Windows Store, the msftncsi.com host (network status indicator / captive portal test).

shocks 11y ago

I unfucked Windows 10 by installing Fedora instead. This is the first time in probably four years that I'm using Linux on my main desktop again, and it's been a pleasure. Things like SLI and dual monitors just work - I remember last time I had a Linux desktop these things were a nightmare. A surprising amount of my games on Steam (152 of 400) support Linux. Zero regrets so far! edit: Sorry, I didn't mean this to become a Linux bragging post. This looks like a great project! I appreciate the effort people are putting in to making W10 usable.

thejosh 11y ago
I'm kind of sad games work so well, because recently my time has been sunk into playing Civ 5 again!
- shocks 11y ago
  Heh, I know that feeling! My vice atm is Cities: Skylines. I'm honestly really surprised how smooth the transition was for me. I expected it to be a bit rough - I only did the install telling myself "I'll give this a go for a week or so" - but I really can't see myself moving back any time soon. Even sleep works - and it works better than it ever did on OSX or Windows.
WorldWideWayne 11y ago
Windows 10 is orders of magnitude more usable than any Linux desktop that I've seen. All this does is toggle a bunch of settings for you. To make Fedora even remotely usable I had to un-Mac OS X it by installing a bunch of third party tweak tools and plugins because they took all of the major UI anti-patterns from OS X.
- zxcvcxz 11y ago
  I completely disagree. Fedora seems to take OS X and make it much more usable and more intuitive and it cuts out the cruft. Any cursory glance of any Windows forum on the internet will show you that it is indeed not more usable than any of its competitors. I've personally set up children and elderly people with Fedora and it's orders of magnitude better than Windows in these cases seeing as it's almost impossible for the average user to mess up. Perhaps installing Fedora on your mac book was a headache, but have you ever tried to install OS X on non-apple hardware? It's worse than any other OS. If you bought Ubuntu certified hardware (as you did with Apple) you'd have no problem with Linux, so it's disingenuous to compare the two. Sorry, but Windows isn't an OS for "normal" people, it's an OS people use because they have to for some reason (games, work). It doesn't "just work" and it's not miles ahead of any other OS, and certainly not more stable. I've had my Fedora desktop up for months at a time without anything crashing, this typically can't be said for Windows in my experience.

dingdingdang 11y ago

Good effort for sure but I'm still really sketched out by the sheer amount of monitoring crapware on Windows 10: what stops MS from re-enabling all of this stuff? After all you and I will need to leave auto-updating on default in order for the OS to stay safe in Internet context. Which effectually means that MS can enable/replace all of these services at any given time. I get that trusting closed source code is always iffy but trusting closed source software that -intentionally- sets out to monitor and document your every move seems a less than optimal path to walk. Will stay on Windows 7 for now and if no better offering comes along from MS I will move to a Linux solution (or even OSX if my privacy stands a better chance of being protected than on Windows). Sad in a way cause I'm fundamentally fine with Windows from a work perspective, it gets stuff done for me.

w8rbt 11y ago

What's the difference between a sensitive/private email being composed on a smart phone or a Windows 10 laptop or desktop? It used to be that only the smartphone knew your location, what you type, who you are, who you are emailing, etc. The difference now is that desktops and laptops running Windows 10 do too. This seems to upset people, but the same people were/are OK with using smart phones. I don't get it, of course I don't use smart phones either and have no plans to use Windows 10. But when all my Android and iPhone friends complain about Windows 10, I just scratch my head and wonder these things.

bigbugbag 11y ago
It seems there are a few assumptions here which are not true: desktop computer (also laptops) know your location, what you type, who you are (sort of), who you are emailing, etc. and it has been so for a while but it used to be third party software, websites, governments, corpo or malware that would collect and use this data. Cell phones are tracking devices you can use to make a phone call, people using those devices doesn't mean they are ok with the surveillance that come with it. When your friends complain they're complaining that the surveillance is creeping its way back into an OS.
brianberns 11y ago
They are different computing environments. A desktop PC is a general-purpose standalone computer, whereas a smartphone without a network connection is of limited use. A desktop OS like Windows 10 creates a dependency on "the cloud" that many people find crippling, rather than enabling.
metric10 11y ago
? The issue isn't that Windoes knows your location when you type an email, it's that it sends all this information and much more to Microsoft. If I type an email on my iPhone it doesn't get sent to Apple (unless, of course, I'm using my iCloud email account). Additionally, Apple is very clear which what they collect and what gets sent to Apple. They go through it when you set your iOS or Mac OS X device up. It's not hidden in some "advanced setup" link.

jetm9 11y ago

does this contain fixes for things explained in https://news.ycombinator.com/item?id=10053420 https://news.ycombinator.com/item?id=10053420? i think listing what it does would be cool. because after that revealation disabling everything and anything still may not be enough.

r3bl 11y ago

Is it just me, or is this like third or forth open source program posted here that does the same thing?

cwyers 11y ago

Like, this disables a lot of actual features -- the Xbox stuff, Windows Store... I get some people don't use that stuff, but it's generalizing from a local preference to a global one to call these "anti-features" and the like as some in this thread have. Features you don't use are not the same as features nobody uses. Meanwhile disabling UAC so you can run a pile of batch files off the Internet sounds like a terrible idea to me.

nej_simon 11y ago
The batch files are small so it's easy to verify what they do at least!
- cwyers 11y ago
  Even if one reviews them and finds them not actively malicious (which on cursory review seems likely) there's still the question of how well they're written. If I am not mistaken, the PowerShell script to remove the bundled Metro apps (what's the deal with removing the Calculator anyway?) is littered with wildcards. The bigger point is that you shouldn't be disabling UAC anyway, and anyone who suggests it is immediately on my list of people I don't fully trust.

aluhut 11y ago

Thank you! This is what a Windows solution looks like.

deleted 11y ago

[deleted]

MDCore 11y ago
In the README: > Another warning: data-harvesting-services-removal.bat will be flagged as malware, since it tries to automatically alter the hosts file. You can either allow it, or add the hosts manually via the data-harvesting-hosts.txt file.

arthurfm 11y ago

The person who wrote the aforementioned batch files for Windows 10 also created "firefox-tweaks" [1]. These also contain some very dubious and/or irresponsible suggestions [2] which implies the author doesn't actually know what they are doing. [1] https://github.com/dfkt/firefox-tweaks/blob/master/firefox-tweaks.txt https://github.com/dfkt/firefox-tweaks/blob/master/firefox-t... [2] https://github.com/pbiggar/firefox-tweaks/commit/635779c79393d017a1a73dbc38e230546e724a35 https://github.com/pbiggar/firefox-tweaks/commit/635779c7939...