5 ms·

Windows isn't allowed to run on any of my networks, and visitors who bring their own laptops are not allowed to connect if they're running Windows. I give them

Windows isn't allowed to run on any of my networks, and visitors who bring their own laptops are not allowed to connect if they're running Windows. I give them a bootable USB stick with Linux to use until they leave. Anyone knowledgable about tech (i.e. everyone on HN) is a fool to do otherwise.

mwcampbell 6y ago
Why do you believe Windows running on someone else's computer is a threat to your network? It seems to me that if Windows's telemetry is a threat, it's a threat to that person's computer and not your network. So this strikes me as an extreme overreaction. Disclosure: I work at Microsoft on the Windows accessibility team. But this is my own opinion, posted on my initiative, and I do try to have nuanced positions even when it comes to my employer.
- DoofusOfDeath 6y ago
  > Why do you believe Windows running on someone else's computer is a threat to your network? Not the OP, but given how Windows 10 treats the privacy of its localhost user, I can't rule out it trying to obtain information about other hosts on my network and sending it back to Microsoft. Can I truly rule out the possibility of it sniffing network traffic to see what DNS queries are posed by other devices on the network? Or telling Microsoft about the count/timing/type of cellphones connected to my network?
  - Silhouette 6y ago
    I concur. Unfortunately, Microsoft has forfeited a lot of trust in recent years through a series of user-hostile acts it has taken in connection with Windows 10. It's prudent to apply the principle of least privilege with any device on your network, and given those user-hostile measures, a rational response is to consider a Windows 10 machine as potentially hostile and apply similar restrictions to something like a BYOD environment. After all, a device can't compromise information it never has through an external firewall that won't let it phone home.
  - Dylan16807 6y ago
    Can you truly rule that out with any other OS?
    - AnthonyMouse 6y ago
      There is a difference between something you can't rule out as impossible because it isn't a violation of the laws of physics and something you can't rule out as implausible based on the observed past behavior of the entity responsible. If I told you that an operating system has just been caught doing that, would your first guess be Windows or Debian?
      - Dylan16807 6y ago
        Debian itself I wouldn't worry about much, but Mac OS would be close to Windows. And I'd be more worried about malware than the OS. Especially phone malware.
- ddevault 6y ago
  You assume that Microsoft has the presumption of good will. They do not.
- chris37879 6y ago
  For me it's because I just don't trust Microsoft anymore. Whats stopping them from using their broad powers under their EULA from collecting information about any device on my network that will respond to the Windows 10 machine's request? The amount of telemetry they force you to accept just to use Windows 10 is unacceptable. If I want a local user account without the OS phoning home for anything other than Windows Update, I should be able to do that. Instead, on a default install of Windows 10 Pro, which I bought a license for, I get tons of preinstalled crapware / links to install said crapware, a barrage of attempts to convert my local user account to a Microsoft account, an antivirus tool that's so aggressive that some of my software development tools have had to include directions for whitelisting their cache directories, and just this persistent worry that Microsoft will push out the next update and break my PC or start collecting new data, or re-enabling things I've already disabled. My ideal Windows 10 setup would be basically Windows 7 + a wizard of 'Do you want this feature / telemetry' that actually respects my answers.
- PeterStuer 6y ago
  Trust is hard to gain and easy to lose. Rationally any device you allow unisolated on your network is a potential threat. Rationally you'd be more worried about infectious malicious packages or applications the user might have unknowingly installed and active than the base system/OS itself. Empathically people will tend to tar with a bigger brush, like banning all Windows machines of the network, or not allowing any Huawei devices etc. While these may not be 100% rational trade-offs, there are underpinnings in some if not all of these cases that can have some merit. The US lenience with regards to surveillance and their gagging laws, same for the Chinese etc. So once that trust is lost, you will be hard pressed to convince people otherwise. What measures if any they are willing/capable to implement in light of that lack of trust will of course be different from person to person. One person's 'extreme overreaction' is another person's 'healthy caution'. One person's 'Calculated Risk' will be another person's 'Callous Neglect'.
- jnxx 6y ago
  > Why do you believe Windows running on someone else's computer is a threat to your network? For example because it stores WiFi credentials without explicit permission, and even hides the passwords? https://superuser.com/questions/1498494/where-does-windows10-saves-wifi-login-password-for-automatic-wifi-login https://superuser.com/questions/1498494/where-does-windows10...
jamesponddotco 6y ago
I created a separate, isolated network, which is the only one that guests using Windows can access. Same goes for Android phones running default images from their manufacturers. That is not reserved only for guests, thought. My wife is now working from home, and follow best practices when it comes to device separation, so she uses her company given Windows 10 laptop for work. That computer can only connect to the isolated network. At this point, I would argue anyone should do the same.
- pmontra 6y ago
  How do you do it? Do you manually give them the password of the isolated network or is there an automatic way to connect those devices to it?
  - rohan1024 6y ago
    Most routers support guest network. You do have to share the password manually. Any new device on my network other than my own logs on to guest network.
  - jamesponddotco 6y ago
    I tell them which network to connect to — the isolated network has a different name than the main one —, and share a link with them containing the password over whatever messaging application we use to communicate. The password for the isolated network has been randomly created using apg[1], so I just share a self-destruct link from a self-hosted PrivateBin[2] instance. The bin part is totally overkill, as long as you create a typeable password using the diceware technique, but since I have the instance running, why not use it? ¯\_(ツ)_/¯ Using apg to generate the diceware password for you is as simple as: apg -n 1 -m 12 -l -c /dev/urandom | awk '{print $2}' Okay, maybe not simple, but you get the idea. [1] https://manpages.ubuntu.com/manpages/disco/man1/apg.1.html https://manpages.ubuntu.com/manpages/disco/man1/apg.1.html [2] https://privatebin.net/ https://privatebin.net/
deno 6y ago
Security of your network shouldn’t depend on your visitors not running malware (and/or Windows). I’d suggest putting them in a separate WiFi network isolated from your internal LAN and from each other. Most decent APs support it and call it something like client isolation, on top of that you might want to assign this traffic to a separate VLAN that only routes to WAN.
- a1369209993 6y ago
  > malware (and/or Windows) That would be better phrased as "malware (Windows or otherwise)"; your phrasing makes it sound like you don't know that Windows itself is malware. But yes, network security that depends on the good behaviour of everything on the network... isn't.
  - deleted 6y ago
    [deleted]
  - deno 6y ago
    I’m sorry. Can I still be in the cool kids club?

mwcampbell 6y ago

Why do you believe Windows running on someone else's computer is a threat to your network? It seems to me that if Windows's telemetry is a threat, it's a threat to that person's computer and not your network. So this strikes me as an extreme overreaction. Disclosure: I work at Microsoft on the Windows accessibility team. But this is my own opinion, posted on my initiative, and I do try to have nuanced positions even when it comes to my employer.

DoofusOfDeath 6y ago
> Why do you believe Windows running on someone else's computer is a threat to your network? Not the OP, but given how Windows 10 treats the privacy of its localhost user, I can't rule out it trying to obtain information about other hosts on my network and sending it back to Microsoft. Can I truly rule out the possibility of it sniffing network traffic to see what DNS queries are posed by other devices on the network? Or telling Microsoft about the count/timing/type of cellphones connected to my network?
- Silhouette 6y ago
  I concur. Unfortunately, Microsoft has forfeited a lot of trust in recent years through a series of user-hostile acts it has taken in connection with Windows 10. It's prudent to apply the principle of least privilege with any device on your network, and given those user-hostile measures, a rational response is to consider a Windows 10 machine as potentially hostile and apply similar restrictions to something like a BYOD environment. After all, a device can't compromise information it never has through an external firewall that won't let it phone home.
- Dylan16807 6y ago
  Can you truly rule that out with any other OS?
  - AnthonyMouse 6y ago
    There is a difference between something you can't rule out as impossible because it isn't a violation of the laws of physics and something you can't rule out as implausible based on the observed past behavior of the entity responsible. If I told you that an operating system has just been caught doing that, would your first guess be Windows or Debian?
    - Dylan16807 6y ago
      Debian itself I wouldn't worry about much, but Mac OS would be close to Windows. And I'd be more worried about malware than the OS. Especially phone malware.
ddevault 6y ago
You assume that Microsoft has the presumption of good will. They do not.
chris37879 6y ago
For me it's because I just don't trust Microsoft anymore. Whats stopping them from using their broad powers under their EULA from collecting information about any device on my network that will respond to the Windows 10 machine's request? The amount of telemetry they force you to accept just to use Windows 10 is unacceptable. If I want a local user account without the OS phoning home for anything other than Windows Update, I should be able to do that. Instead, on a default install of Windows 10 Pro, which I bought a license for, I get tons of preinstalled crapware / links to install said crapware, a barrage of attempts to convert my local user account to a Microsoft account, an antivirus tool that's so aggressive that some of my software development tools have had to include directions for whitelisting their cache directories, and just this persistent worry that Microsoft will push out the next update and break my PC or start collecting new data, or re-enabling things I've already disabled. My ideal Windows 10 setup would be basically Windows 7 + a wizard of 'Do you want this feature / telemetry' that actually respects my answers.
PeterStuer 6y ago
Trust is hard to gain and easy to lose. Rationally any device you allow unisolated on your network is a potential threat. Rationally you'd be more worried about infectious malicious packages or applications the user might have unknowingly installed and active than the base system/OS itself. Empathically people will tend to tar with a bigger brush, like banning all Windows machines of the network, or not allowing any Huawei devices etc. While these may not be 100% rational trade-offs, there are underpinnings in some if not all of these cases that can have some merit. The US lenience with regards to surveillance and their gagging laws, same for the Chinese etc. So once that trust is lost, you will be hard pressed to convince people otherwise. What measures if any they are willing/capable to implement in light of that lack of trust will of course be different from person to person. One person's 'extreme overreaction' is another person's 'healthy caution'. One person's 'Calculated Risk' will be another person's 'Callous Neglect'.
jnxx 6y ago
> Why do you believe Windows running on someone else's computer is a threat to your network? For example because it stores WiFi credentials without explicit permission, and even hides the passwords? https://superuser.com/questions/1498494/where-does-windows10-saves-wifi-login-password-for-automatic-wifi-login https://superuser.com/questions/1498494/where-does-windows10...

jamesponddotco 6y ago

I created a separate, isolated network, which is the only one that guests using Windows can access. Same goes for Android phones running default images from their manufacturers. That is not reserved only for guests, thought. My wife is now working from home, and follow best practices when it comes to device separation, so she uses her company given Windows 10 laptop for work. That computer can only connect to the isolated network. At this point, I would argue anyone should do the same.

pmontra 6y ago
How do you do it? Do you manually give them the password of the isolated network or is there an automatic way to connect those devices to it?
- rohan1024 6y ago
  Most routers support guest network. You do have to share the password manually. Any new device on my network other than my own logs on to guest network.
- jamesponddotco 6y ago
  I tell them which network to connect to — the isolated network has a different name than the main one —, and share a link with them containing the password over whatever messaging application we use to communicate. The password for the isolated network has been randomly created using apg[1], so I just share a self-destruct link from a self-hosted PrivateBin[2] instance. The bin part is totally overkill, as long as you create a typeable password using the diceware technique, but since I have the instance running, why not use it? ¯\_(ツ)_/¯ Using apg to generate the diceware password for you is as simple as: apg -n 1 -m 12 -l -c /dev/urandom | awk '{print $2}' Okay, maybe not simple, but you get the idea. [1] https://manpages.ubuntu.com/manpages/disco/man1/apg.1.html https://manpages.ubuntu.com/manpages/disco/man1/apg.1.html [2] https://privatebin.net/ https://privatebin.net/

deno 6y ago

Security of your network shouldn’t depend on your visitors not running malware (and/or Windows). I’d suggest putting them in a separate WiFi network isolated from your internal LAN and from each other. Most decent APs support it and call it something like client isolation, on top of that you might want to assign this traffic to a separate VLAN that only routes to WAN.

a1369209993 6y ago
> malware (and/or Windows) That would be better phrased as "malware (Windows or otherwise)"; your phrasing makes it sound like you don't know that Windows itself is malware. But yes, network security that depends on the good behaviour of everything on the network... isn't.
- deleted 6y ago
  [deleted]
- deno 6y ago
  I’m sorry. Can I still be in the cool kids club?