5 ms·

Your last few points are annoying for sure, but the first 3 are the result of 20+ years of Microsoft's poor reputation for security due to its prominence and nu

by dimino 10y ago

Your last few points are annoying for sure, but the first 3 are the result of 20+ years of Microsoft's poor reputation for security due to its prominence and numerous flaws. I completely sympathize with Microsoft's plight here, and while you might not be among those who are constantly infected, the number of people who do end up having problems is so high that they're willing to lose you as a cost of keeping the other folks safe. We're all safer for this, too, because fewer infected computers on the Internet means fewer proxies for spam and other malignant behavior.

jakebasile 10y ago
I completely understand why this is the default behavior, but there should be an "I'm not a normie" switch somewhere that allows me to control my experience. The Pro edition was originally that way, but as I understand it this is no longer the case and is similarly controlling.
- oz 10y ago
  >but there should be an "I'm not a normie" switch somewhere... Which will then summarily be used by malware authors and we're back we started.
  - cwyers 10y ago
    I wish I could upvote this about 30 times. For every real Windows security expert slash power user in the wild, there's about 30 pimple-encrusted besotted teenagers out there who just want to run some warez on their parent's computer and will click whatever setting, run whatever software and make whatever Registry edits are necessary to get the game their parents won't buy them up and running. The typical home user is not a sysadmin, doesn't want to be a sysadmin and will not put in the effort to be a sysadmin. Microsoft is building Windows to be safe for them. This is a net good for all of us. And underneith it all, Windows is still Windows, which puts it miles ahead of its real competitors (Android, iOS and I guess ChromeOS) in terms of allowing users to really own their device.
    - jakebasile 10y ago
      This is all great, but I am not a typical home user and there is no option for me on the Windows Edition Menu. I can buy Home or Pro, that's it. Pro used to be the "I know what I'm doing" version but this is no longer the case. Enterprise let's you do whatever you want but requires far more investment and effort to run just so that I can control my computer. Edit to reply to cwyers below me as I cannot reply further: Do you honestly think that running your own Active Directory system, calling Microsoft Enterprise Sales, arguing with them and probably failing to buy a single Enterprise license, and ultimately buying a pack of Enterprise licenses I do not need is required of me to be "on the same Internet as you"? All I want is close to the level of control I can get on previous versions of Windows which pale in comparison to any Linux distribution. Does this mean that anyone using a Linux distro that doesn't automatically update shouldn't be allowed on your internet? Surely if your computer is always up to date you have nothing to fear? I am unsure how you are equating me to an anti-vaxxer simply because I want to control how and when my computer updates. I don't believe I ever said I do not ever want an update, I want to know what they are and control when they are applied as is standard on every other OS I know of. I am also not making any ideological argument to privacy. In fact, I don't care too awful much about the telemetry in Windows 10. I don't really like it but I almost exclusive use my Windows machine for gaming so there isn't much I'm scared of MS finding out about there. I simply want to control how my computer works.
    - hendersoon 10y ago
      That's a spurious argument. What's important is that the OS forces updates _by default_. Sure, some of the people that turn it off overestimate their own capabilities, and that will lead to infection. But that's a very small portion of the total population, the vast majority of which will leave everything set to default.
- jrapdx3 10y ago
  Long story, but my Surface Pro 2 wound up with Win10 Pro. The Pro version is slightly more configurable for privacy than Home, but only the Enterprise version can completely turn off the telemetry and so on. Of course Enterprise is not easily available to end-users and it is expensive. There are some utilities available that are supposed to improve the privacy/security of Win10 installations, e.g., [0]. My wife kept asking me if she should upgrade to Win10 and I said "don't do it". Since Win8.1 will be supported until 2023 or so, it really didn't matter. Now, thankfully, the "free upgrade" period is over and she won't be nagged to do the upgrade. After all the years in the game, we'd think MS should know better than pulling all this crap on its users. [0] https://github.com/10se1ucgo/DisableWinTracking https://github.com/10se1ucgo/DisableWinTracking
  - cwyers 10y ago
    > Note: Windows Defender may report the EXE as a trojan (Win32/Pocyx.C!cl), and may therefore prevent you from extracting the EXE to anywhere on your computer. Set up an exclusion in Settings > Update & Security > Windows Defender > Exclusions by adding the folder you intend to extract the EXE to. I swear, it seems like people are okay with the idea of everyone BUT Microsoft have access to all their personal information on their PCs. Why would anyone install software that has this kind of recklessness in the official documentation?
    - jrapdx3 10y ago
      Not quite sure what recklessness you are referring to. If necessary, the exception is only for the one directory the EXE is in. IIRC the program isn't really installed, it just needs to run once to make changes in firewall rules, etc., that prevent MS telemetry. AFAIK it doesn't increase external access to the computer being configured. After making modifications, the exclusion can be deleted if desired. If you have more info about risks of using the dwt utility, I'd be real interested to hear about it.
      - cwyers 10y ago
        No, uh, look, running an EXE one finds hosted on GitHub, deliberately disabling the virus-checking on that EXE file and running the EXE is the reckless behavior. Even assuming that the person who made the EXE didn't mean so maliciously, any kind of a MitM attack or other way of sureptuously putting a payload in that EXE is an attack vector.
- blakeyrat 10y ago
  What good would that do? Everybody thinks they're a pro. They'd just turn it on the instant they heard of it.
  - SquareWheel 10y ago
    I wouldn't mind if there were some convoluted steps to enable it. Something akin to turning on Android's "developer mode".
    - mitm2mitm 10y ago
      I think requiring the user to boot a Linux live CD and do some voodoo would be enough. Computer would have to self destruct if you failed the steps tho. "Do not turn off your computer, 5, 4.."
  - hendersoon 10y ago
    This really is not true. The vast majority of people have zero illusions about their own basic computing skills.
    - dredmorbius 10y ago
      They don't need illusions about their basic computing skills. They need a drive-by installer, malware, or "tips'n'tricks" guide that gets them to do this. People don't need to understand tools and systems to use them. Hell, they'll use things for millennia without knowing how they work (quite literally).
      - hendersoon 10y ago
        If they're running malware with administrator rights, they're already lost by definition. The kind of people that would leave settings like this at the default generally don't read tips n' tricks guides to tweaking windows. They simply don't care about that sort of thing. Of course _some_ do, as you would no doubt reply, but again it comes down to numbers-- that volume doesn't justify locking it down. They aren't clueful users so they could be socially engineered to turn off updates, but once you get to that point why wouldn't you just get them to run a RAT as administrator? That is the end goal, after all. And once you own their system you can turn off updates yourself. Lastly, we're talking about a switch in the GUI here-- it is already possible to completely disable telemetry and automatic updates on Windows 10. You just need to hack through the registry and group policy or use a third party tool to do it. Anyone who takes control of your computer can do it remotely.
CamperBob2 10y ago
No. The same security patches that are applied to 10 also apply all the way back to 7, and even earlier. To the extent they don't, it's because Microsoft no longer wants them to apply to 7 after the end of its support life. (Which, last I checked, hasn't happened yet.) Do you think they rewrote the whole kernel in 10, or even a big chunk of it?

by dimino 10y ago

jakebasile 10y ago

I completely understand why this is the default behavior, but there should be an "I'm not a normie" switch somewhere that allows me to control my experience. The Pro edition was originally that way, but as I understand it this is no longer the case and is similarly controlling.

oz 10y ago
>but there should be an "I'm not a normie" switch somewhere... Which will then summarily be used by malware authors and we're back we started.
- cwyers 10y ago
  I wish I could upvote this about 30 times. For every real Windows security expert slash power user in the wild, there's about 30 pimple-encrusted besotted teenagers out there who just want to run some warez on their parent's computer and will click whatever setting, run whatever software and make whatever Registry edits are necessary to get the game their parents won't buy them up and running. The typical home user is not a sysadmin, doesn't want to be a sysadmin and will not put in the effort to be a sysadmin. Microsoft is building Windows to be safe for them. This is a net good for all of us. And underneith it all, Windows is still Windows, which puts it miles ahead of its real competitors (Android, iOS and I guess ChromeOS) in terms of allowing users to really own their device.
  - jakebasile 10y ago
    This is all great, but I am not a typical home user and there is no option for me on the Windows Edition Menu. I can buy Home or Pro, that's it. Pro used to be the "I know what I'm doing" version but this is no longer the case. Enterprise let's you do whatever you want but requires far more investment and effort to run just so that I can control my computer. Edit to reply to cwyers below me as I cannot reply further: Do you honestly think that running your own Active Directory system, calling Microsoft Enterprise Sales, arguing with them and probably failing to buy a single Enterprise license, and ultimately buying a pack of Enterprise licenses I do not need is required of me to be "on the same Internet as you"? All I want is close to the level of control I can get on previous versions of Windows which pale in comparison to any Linux distribution. Does this mean that anyone using a Linux distro that doesn't automatically update shouldn't be allowed on your internet? Surely if your computer is always up to date you have nothing to fear? I am unsure how you are equating me to an anti-vaxxer simply because I want to control how and when my computer updates. I don't believe I ever said I do not ever want an update, I want to know what they are and control when they are applied as is standard on every other OS I know of. I am also not making any ideological argument to privacy. In fact, I don't care too awful much about the telemetry in Windows 10. I don't really like it but I almost exclusive use my Windows machine for gaming so there isn't much I'm scared of MS finding out about there. I simply want to control how my computer works.
  - hendersoon 10y ago
    That's a spurious argument. What's important is that the OS forces updates _by default_. Sure, some of the people that turn it off overestimate their own capabilities, and that will lead to infection. But that's a very small portion of the total population, the vast majority of which will leave everything set to default.
jrapdx3 10y ago
Long story, but my Surface Pro 2 wound up with Win10 Pro. The Pro version is slightly more configurable for privacy than Home, but only the Enterprise version can completely turn off the telemetry and so on. Of course Enterprise is not easily available to end-users and it is expensive. There are some utilities available that are supposed to improve the privacy/security of Win10 installations, e.g., [0]. My wife kept asking me if she should upgrade to Win10 and I said "don't do it". Since Win8.1 will be supported until 2023 or so, it really didn't matter. Now, thankfully, the "free upgrade" period is over and she won't be nagged to do the upgrade. After all the years in the game, we'd think MS should know better than pulling all this crap on its users. [0] https://github.com/10se1ucgo/DisableWinTracking https://github.com/10se1ucgo/DisableWinTracking
- cwyers 10y ago
  > Note: Windows Defender may report the EXE as a trojan (Win32/Pocyx.C!cl), and may therefore prevent you from extracting the EXE to anywhere on your computer. Set up an exclusion in Settings > Update & Security > Windows Defender > Exclusions by adding the folder you intend to extract the EXE to. I swear, it seems like people are okay with the idea of everyone BUT Microsoft have access to all their personal information on their PCs. Why would anyone install software that has this kind of recklessness in the official documentation?
  - jrapdx3 10y ago
    Not quite sure what recklessness you are referring to. If necessary, the exception is only for the one directory the EXE is in. IIRC the program isn't really installed, it just needs to run once to make changes in firewall rules, etc., that prevent MS telemetry. AFAIK it doesn't increase external access to the computer being configured. After making modifications, the exclusion can be deleted if desired. If you have more info about risks of using the dwt utility, I'd be real interested to hear about it.
    - cwyers 10y ago
      No, uh, look, running an EXE one finds hosted on GitHub, deliberately disabling the virus-checking on that EXE file and running the EXE is the reckless behavior. Even assuming that the person who made the EXE didn't mean so maliciously, any kind of a MitM attack or other way of sureptuously putting a payload in that EXE is an attack vector.
blakeyrat 10y ago
What good would that do? Everybody thinks they're a pro. They'd just turn it on the instant they heard of it.
- SquareWheel 10y ago
  I wouldn't mind if there were some convoluted steps to enable it. Something akin to turning on Android's "developer mode".
  - mitm2mitm 10y ago
    I think requiring the user to boot a Linux live CD and do some voodoo would be enough. Computer would have to self destruct if you failed the steps tho. "Do not turn off your computer, 5, 4.."
- hendersoon 10y ago
  This really is not true. The vast majority of people have zero illusions about their own basic computing skills.
  - dredmorbius 10y ago
    They don't need illusions about their basic computing skills. They need a drive-by installer, malware, or "tips'n'tricks" guide that gets them to do this. People don't need to understand tools and systems to use them. Hell, they'll use things for millennia without knowing how they work (quite literally).
    - hendersoon 10y ago
      If they're running malware with administrator rights, they're already lost by definition. The kind of people that would leave settings like this at the default generally don't read tips n' tricks guides to tweaking windows. They simply don't care about that sort of thing. Of course _some_ do, as you would no doubt reply, but again it comes down to numbers-- that volume doesn't justify locking it down. They aren't clueful users so they could be socially engineered to turn off updates, but once you get to that point why wouldn't you just get them to run a RAT as administrator? That is the end goal, after all. And once you own their system you can turn off updates yourself. Lastly, we're talking about a switch in the GUI here-- it is already possible to completely disable telemetry and automatic updates on Windows 10. You just need to hack through the registry and group policy or use a third party tool to do it. Anyone who takes control of your computer can do it remotely.

CamperBob2 10y ago

No. The same security patches that are applied to 10 also apply all the way back to 7, and even earlier. To the extent they don't, it's because Microsoft no longer wants them to apply to 7 after the end of its support life. (Which, last I checked, hasn't happened yet.) Do you think they rewrote the whole kernel in 10, or even a big chunk of it?