4 ms·

Not quite sure what recklessness you are referring to. If necessary, the exception is only for the one directory the EXE is in. IIRC the program isn't really

by jrapdx3 10y ago

Not quite sure what recklessness you are referring to. If necessary, the exception is only for the one directory the EXE is in. IIRC the program isn't really installed, it just needs to run once to make changes in firewall rules, etc., that prevent MS telemetry. AFAIK it doesn't increase external access to the computer being configured. After making modifications, the exclusion can be deleted if desired. If you have more info about risks of using the dwt utility, I'd be real interested to hear about it.

cwyers 10y ago
No, uh, look, running an EXE one finds hosted on GitHub, deliberately disabling the virus-checking on that EXE file and running the EXE is the reckless behavior. Even assuming that the person who made the EXE didn't mean so maliciously, any kind of a MitM attack or other way of sureptuously putting a payload in that EXE is an attack vector.
- dTal 10y ago
  Why is it particularly worse than downloading a binary hosted anywhere else, upstream binaries being the standard way of obtaining software on Windows? As for the virus checker, their program's raison d'etre is making registry changes. It's not difficult to imagine that being flagged by Windows Defender is unavoidable.
  - cwyers 10y ago
    I think the recent situation with SourceForge, where binaries were changed to add a malware-ridden installer[1] shows why GitHub is potentially worse than trusting some other provider. I think it's a low likelihood that something like that happens with GitHub ever, much less soon, and SourceForge has reversed that action already. But it is one reason to potentially trust binaries from a third party like that less. But that's not really the thrust of the point. It's software from an unknown provenance, and yes, that's pretty standard for Windows but it's not great and it's getting worse all the time. Virus scanners are not a great solution, but not having them are worse. Without any kind of a checksum on that page, it's impossible to verify that the binary you have is the one that you should have. (Not that it's guaranteed that you can do so if there is a checksum.) So you're already in a bad situation, and you're turning off one of the few safeguards you have. As for registry changes getting flagged by Defender... programs that change the registry aren't rare.[2] They do not universally share this problem. I imagine it's probably a false positive and I don't know how it could be avoided, but the proposed remedy is reckless. 1) http://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/ http://arstechnica.com/information-technology/2015/05/source... 2) http://windowsreport.com/windows-10-registry-cleaners/ http://windowsreport.com/windows-10-registry-cleaners/

by jrapdx3 10y ago

cwyers 10y ago

No, uh, look, running an EXE one finds hosted on GitHub, deliberately disabling the virus-checking on that EXE file and running the EXE is the reckless behavior. Even assuming that the person who made the EXE didn't mean so maliciously, any kind of a MitM attack or other way of sureptuously putting a payload in that EXE is an attack vector.

dTal 10y ago
Why is it particularly worse than downloading a binary hosted anywhere else, upstream binaries being the standard way of obtaining software on Windows? As for the virus checker, their program's raison d'etre is making registry changes. It's not difficult to imagine that being flagged by Windows Defender is unavoidable.
- cwyers 10y ago
  I think the recent situation with SourceForge, where binaries were changed to add a malware-ridden installer[1] shows why GitHub is potentially worse than trusting some other provider. I think it's a low likelihood that something like that happens with GitHub ever, much less soon, and SourceForge has reversed that action already. But it is one reason to potentially trust binaries from a third party like that less. But that's not really the thrust of the point. It's software from an unknown provenance, and yes, that's pretty standard for Windows but it's not great and it's getting worse all the time. Virus scanners are not a great solution, but not having them are worse. Without any kind of a checksum on that page, it's impossible to verify that the binary you have is the one that you should have. (Not that it's guaranteed that you can do so if there is a checksum.) So you're already in a bad situation, and you're turning off one of the few safeguards you have. As for registry changes getting flagged by Defender... programs that change the registry aren't rare.[2] They do not universally share this problem. I imagine it's probably a false positive and I don't know how it could be avoided, but the proposed remedy is reckless. 1) http://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/ http://arstechnica.com/information-technology/2015/05/source... 2) http://windowsreport.com/windows-10-registry-cleaners/ http://windowsreport.com/windows-10-registry-cleaners/