11 ms·

Nearly all of these "clean up" scripts are a horrendous idea to run on your machine, I see right at the top that this script disables SmartScreen, a service tha

Nearly all of these "clean up" scripts are a horrendous idea to run on your machine, I see right at the top that this script disables SmartScreen, a service that absolutely should not be disabled unless you want your machine to get owned. It then proceeds to set your current network as Private (aka "open all the ports") regardless of which network you're connected to - hope you're at home! Other changes are completely superfluous, like disabling "3D Objects" which has already been disabled in the latest Windows version Just don't run this stuff.

hughrr 5y ago
Totally agree with this. I’ve not seen one of these things that isn’t seriously dangerous to run. As with all these things, the road to hell is paved with good intentions, apparently by tinfoil hatted nut jobs who don’t understand the problem domain well enough to be making decisions for people who know even less than they do.
2ion 5y ago
Just not this stuff, any stuff without review. A lot of Windows advice has sadly always been the equivalent of curl | sudo bash - and the culture proliferates this practice. But it also highlights that Windows 10 is unusable without Group Policy, which is an almost sane interface for Windows "tweaks". Windows editions without full group policy support are essentially garbage.
camgunz 5y ago
Thanks for the info; I've been concerned enough about Windows 10 telemetry (etc.) to avoid it, and when I saw this script I thought "ohhh maybe I can just do this?"--so you saved me. Do you have a rec or a resource? I haven't looked seriously at this so if it's just like "google it" mea culpa, but it seems like there's a lot of misinformation and what not out there. I saw "O&O ShutUp10" in a sibling thread?
- anaisbetts 5y ago
  I think I would think about specific Windows Telemetry that you want to disable and more importantly, why (i.e. "What's the Threat Model around Microsoft knowing this"). Because the vast majority of the telemetry collected by Windows is simply to make Windows work better - things like "Upgrade failed because $REASON" or "$DRIVER is causing performance problems". You can see a lot of the kinds of telemetry that Windows is interested in if you go to Event Viewer => Application Logs => Microsoft => Windows, if you read it you see that it's like, Google Lighthouse style stuff, to make Windows faster and more reliable Use these scripts to figure out the kinds of things you don't want to run, then make really targeted "Disable This" choices
  - philliphaydon 5y ago
    I don’t have a problem with the telemetry on windows. I’m unsure why everyone gets so upset. MS isn’t collecting stuff to shove advertising down our throat. It’s getting usage to figure out what’s wrong with windows and make it better. As you say. I have issue with Facebook and Google blatantly collecting whatever they can to build profiles of us all to shove advertising down our throat that isn’t even relevant to us.
    - ptomato 5y ago
      > MS isn’t collecting stuff to shove advertising down our throat maybe if MS wanted people to believe that, they wouldn't put so much advertising in their OS
      - philliphaydon 5y ago
        I’ve to this day never seen any advertising in windows. Must be something only in America. :/ Edit: (seen the articles about it but never actually seen it in Windows)
  - WorldMaker 5y ago
    Developers can also enable the Diagnostic Data Viewer and directly see all the telemetry events that Windows sends in the JSON forms that it sends them: https://docs.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview https://docs.microsoft.com/en-us/windows/privacy/diagnostic-...
- Daho0n 5y ago
  This might be an unpopular opinion but in my opinion anything more than ShutUp10 is a complete waste of time unless you go all the way and run Windows behind a firewall (OPNsense) and use a whitelist. It is (again IMO) impossible to control software from the same machine.
- black3r 5y ago
  The thing is this script is not only about telemetry, but also about disabling some annoyances that are especially annoying in server or workstation environment. I don't think there's an up to date resource describing all these tweaks. My recommendations: - Use the original script, it's slightly more up to date, last update was in november 2020: https://github.com/Disassembler0/Win10-Initial-Setup-Script https://github.com/Disassembler0/Win10-Initial-Setup-Script - Read it's library of tweaks, especially the notes about potential unwanted side effects in comments. If you don't understand what each feature does, google it. The tweaks are grouped. - Don't enable any tweak where you don't understand what it does, especially in the security and network tweaks categories.
- windthrown 5y ago
  I use O&O ShutUp10 and it is much more approachable. Rather than immediately enabling and blocking settings, ShutUp10 gives you recommendations and you can reasearch individual settings you aren't sure of.
vmception 5y ago
I've seen disk images of windows on piracy sites that have all this stuff preconfigured you can get slim builds with chrome ready to go already, builds with all these cleanup scripts configured, and more sadly, they also know people in a rush are looking for this or prefer it, and they install backdoors or ways to steal your crypto on them and stuff I wouldn't even trust the scripts itself at this point, so I'm another for just don't run this stuff
- hestefisk 5y ago
  As good as it sounds, I wouldn’t feel comfortable installing a modded Win10 install from a piracy site…. Maybe it’s just me.
  - vmception 5y ago
    Thats… what I said as consensus has flipped multiple times since I posted it, it makes me wonder if other people misread my comment
- vetinari 5y ago
  > I wouldn't even trust the scripts itself at this point, so I'm another for just don't run this stuff The scripts (they are mostly forks of https://github.com/Disassembler0/Win10-Initial-Setup-Script https://github.com/Disassembler0/Win10-Initial-Setup-Script) are nicely written toggles for registry values or GPO, that you can read and selectively all. Nothing scary.
tux3 5y ago
Sadly, this is an expected consequence of the aggressive monetization, telemetry, and other tracking that ships with the OS. When you make it hard to trust the system, people will look at any component that seems unnecessary. They might not know what it is, but they don't trust it anymore. So it might as well get disabled. You know, to be safe. But at the end of the day I suppose it's only a small percent of users, isn't it? I'm sure the aggressive push for automatic updates — replacing the "Cancel" button by "Maybe Later", and the "Maybe Later" by "You have 2 minutes" — has worked miracles. So I think we can expect more of this in the future, and the scripts will get even more paranoid in response. What an antagonistic situation.
- nojito 5y ago
  No this is a consequence of horrendous fear mongering in the tech community. Privacy scripts are a very common attack vector due to their popularity these days. Not to mention that the benefits of these “tweaks” is negligible at best.
- swiley 5y ago
  I've noticed this on iOS too. There are scams out there that encourage users to install root CA certs in order to jailbreak or get access to non-AppStore apps (this used to be required by one method.) I don't know what happened to the idea of user friendly software respecting the intentions of a user. Modern OSes really are effectively just well funded socially acceptable malware.
- slver 5y ago
  Look Windows has couple of odd settings, but the defaults are just fine. Some people will find reasons to tweak even if there's nothing to tweak. Been there in my teen years, but I grew up.
- Arainach 5y ago
  This class of user has always been doing such silly things long before "monetization". There were plenty of guides for Windows XP and Vista claiming to "increase performance" by disabling things like the indexer (fun fact, that will TANK your performance in a variety of areas), the Cryptographic services, and more. They never had any trust to violate, only a strange (and completely incorrect) sense that they knew more than the engineers who built the OS in the first place.
black3r 5y ago
Just as the note from the author says: Never run scripts without reading and understanding what they do. This is an outdated fork of a configurable script that I use to do initial config of my windows 10 machines. But I've created my own config saying which functions to run and which not to run based on reading what each function actually does. I'm an IT pro, I knew how to do most of these tweaks in windows settings or group policy, but it's still easier to just run a script than to perform hundreds of clicks, especially when the settings get reorganized in every other windows update. And as this is HN, I expect lots of people here being IT pros, so I would correct you here: Don't run this stuff if you don't understand what it does.
as1mov 5y ago
I haven't used Windows for a long time but a look at the script makes me think people wouldn't be resorting to such measures if Microsoft wasn't including stupid crap in their operating system. > Disabling Telemetry breaks Windows updates > Automatic web searches in start menu > Application suggestions are silently installed (wat?) > Allow MS to collect activity history > Location tracking > Map updates (who the fuck uses maps on a PC?) > Tailored experiences (apparently spamming ads on a desktop OS is an experience) > Advertising ID > Cortana This is just from skimming the list for 5 minutes. Not even sure what else is in there.
- dawnerd 5y ago
  macOS has a lot of this too. It’s weird Apple seems to get a pass but Microsoft gets attacked. (Ads in start is a huge problem though).
  - pessimizer 5y ago
    > Apple seems to get a pass Seems to who?
  - rsynnott 5y ago
    ... I don't think MacOS has _any_ of this? Besides Siri and telemetry, but it asks you on installation if you want to enable those.
    - dawnerd 5y ago
      Siri/spotlight does web searches, maps are included, location tracking baked in under the disguise of find-my (Microsoft also has a find-my alternative), there is an advertiser id built into mac toohttps://developer.apple.com/documentation/adsupport/asidentifiermanager/1614151-advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti... Really the only thing different is Apple has made it seem beneficial to users where Microsoft just comes off spammy.
      - rsynnott 5y ago
ziml77 5y ago
They're not a horrendous idea. This is forked off of the script that I've been using for years. All of the settings it touches are very clear since each change it makes is configured right up front. I purposely disable SmartScreen because I don't need information about applications I'm running shipped off to Microsoft. Setting the current network to private is handy after a first-time install since Windows often doesn't prompt and defaults to public.
stevenhuang 5y ago
> service that absolutely should not be disabled unless you want your machine to get owned. SmartScreen sends all your file hashes and unique computer info to Microsoft. If you're not stepping into weird links and running weird executables it's really not doing much for you.
e3bc54b2 5y ago
Well, the "Smart" screen says that WinMerge and KDiff3 are malwares. Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen, I can inspect their code. Yes, the binaries can contain malware, but the first principles tell me that trustability score is inverse of what is being reported by MS. Naturally I have disabled Smartscreen and Windows defender and admin rights alerts and bajilion things that internet gurus will tell me not to because I don't know what's good for me. Needless to say, my PC runs faster, calmer and is actually malware free because I don't run unauditable things like Smartscreen on it. Edit: I get WinMerge binary from GitHub repo, and KDiff3 from official website. As trusted as it can get, short of compiling myself. This is a work machine so I can't control most of Windows behavior. Personal machine runs NixOS for 90% tasks + Windows dual boot for games without connecting to network because I can't be bothered with disabling Smartscreen and defender every other week.
- cptskippy 5y ago
  > Well, the "Smart" screen says that WinMerge and KDiff3 are malwares. I've got WinMerge installed on my machines and I've never had that issue. Are you sure you're using trusted sources?
  - e3bc54b2 5y ago
    I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself.
    - lghh 5y ago
      > Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen, I can inspect their code. > I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself. So, you don't actually know what code you're running and that binary actually could be malware.
      - e3bc54b2 5y ago
        Yes, and original comment addresses that. In theory WinMerge binary can contain malware. But WinMerge authors have a proven track record against that and they are transparent about working of their application enough through their source. MS and Smartscreen do not have that track record, and IMO have an opposite kind of record with all kind of map/adware practices throughout the system and applications. So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more?
tedajax 5y ago
SmartScreen exists solely to warn you about executables you already trust and be annoying. Fortunately you can just disable it from the settings though.
smaudet 5y ago
Could not disagree more, SmartScreen is a horrendous idea. You should only be installing verified trusted apps you can verify the sources or hash for, farming this out to a third party, even if its MS, is a great way to open yourself up to watering hole attacks. Furthermore, you are encouraging poor user behaviour with "oh man this app said my app is good" and then ending up with all manner of poorly vetted bloatware, not to mention antitrust and legal issues. Really it should be possible to completely remove and/or replace this whole component. As for network, why aren't running from behind a properly secured connection? That's just bad practice. If you want to connect from a coffeeshop or whatever, set your firewall to block everything by default.
avereveard 5y ago
most of these things also look for registry file entries that point to non existing files and they have no regards for parametric entries (i.e. c:\users\{current}\blah) so they wreak havoc on your installed services and applications.
ocdtrekkie 5y ago
To me, I'd never run someone's prefab cleanup script, but I find this script really nice because it's documented, categorized, and there's a lot of useful PowerShell in here, if you're looking for specific things. There's plenty of commands in here I use, and plenty I'd like to... along with quite a few I definitely would not.
hparadiz 5y ago
I've been using these scripts on my boxes for years now with no issues. Maybe don't make assumptions about people's use cases?
chaosite 5y ago
I mean, sure, SmartScreen is an important security service that should not be disabled if you're OK with hashes of every executable you run being transmitted to Microsoft.
josephcsible 5y ago
I agree with most of what you said, but this is just totally false: > SmartScreen, a service that absolutely should not be disabled unless you want your machine to get owned It's not hard for people, especially ones who read HN, to be perfectly safe with SmartScreen disabled.
majkinetor 5y ago
Your comment is absolute nonsense. You can't say anything like that without context. SmartScreen and defender are the first things to go on my machine as they slow down computer at least by the factor of 2, if not more. People on HN generally don't need babysitting!. Know where you are.
- DeliriumTrigger 5y ago
  You complain about nonsense and than go forward and spread some on your own. You saying that SmartScreen and Defender slows down a Windows machine by a factor of 2 just makes you a nonsense clown.
  - majkinetor 5y ago
    Yes, I was wrong - its not by a factor of 2, more like a factor or 3 to 5. The best way to make your computer age 10 years in a second is to enable ANY antivirus. There are so many places that you can check that out if you didn't experience it, or u need me to LMGTFY ?
    - tomnipotent 5y ago
      So you decide to double down on your wrongness? Windows Defender has a marginal impact on performance, such that for most users and most tasks it's not even perceptible. > need me to LMGTFY You've provided zero evidence to the contrary. The burden of proof is on you.
      - majkinetor 5y ago
        Here is 1 for you: > As far as I can tell, as long as Windows Defender (and presumably other A/V scanners) are running, there's no way to make the Windows I/O APIs consistently fast. https://gregoryszorc.com/blog/2021/04/06/surprisingly-slow/ https://gregoryszorc.com/blog/2021/04/06/surprisingly-slow/ This is really even a common knowledge - if you did ANY IT work, you should already know it. I can't count the number of times when server wasn't working correctly when it turns out it just has Defender on.
mipsi 5y ago
This criticism is a bit unfair. It's a gist on github, which you are supposed to read and understand as the author states in his opening disclaimer. The statement for enabling SmartScreen is also included. And no, your machine gets not owned when you disable SmartScreen - there are other protective measures you can take.
skjoldr 5y ago
Is there any use for SmartScreen when running a proper antivirus, as you should?
emptysongglass 5y ago
I agree. If you want a stripped down Windows use Windows 10 LTSC. It's everything anyone wants from Windows without any of the cruft. I'm a Linux person but when I installed LTSC for my wife all her complaints about sudden reboots and other unwanted behavior evaporated. Makes you wonder why they bother with any other Windows.

hughrr 5y ago

Totally agree with this. I’ve not seen one of these things that isn’t seriously dangerous to run. As with all these things, the road to hell is paved with good intentions, apparently by tinfoil hatted nut jobs who don’t understand the problem domain well enough to be making decisions for people who know even less than they do.

2ion 5y ago

Just not this stuff, any stuff without review. A lot of Windows advice has sadly always been the equivalent of curl | sudo bash - and the culture proliferates this practice. But it also highlights that Windows 10 is unusable without Group Policy, which is an almost sane interface for Windows "tweaks". Windows editions without full group policy support are essentially garbage.

camgunz 5y ago

Thanks for the info; I've been concerned enough about Windows 10 telemetry (etc.) to avoid it, and when I saw this script I thought "ohhh maybe I can just do this?"--so you saved me. Do you have a rec or a resource? I haven't looked seriously at this so if it's just like "google it" mea culpa, but it seems like there's a lot of misinformation and what not out there. I saw "O&O ShutUp10" in a sibling thread?

anaisbetts 5y ago
I think I would think about specific Windows Telemetry that you want to disable and more importantly, why (i.e. "What's the Threat Model around Microsoft knowing this"). Because the vast majority of the telemetry collected by Windows is simply to make Windows work better - things like "Upgrade failed because $REASON" or "$DRIVER is causing performance problems". You can see a lot of the kinds of telemetry that Windows is interested in if you go to Event Viewer => Application Logs => Microsoft => Windows, if you read it you see that it's like, Google Lighthouse style stuff, to make Windows faster and more reliable Use these scripts to figure out the kinds of things you don't want to run, then make really targeted "Disable This" choices
- philliphaydon 5y ago
  I don’t have a problem with the telemetry on windows. I’m unsure why everyone gets so upset. MS isn’t collecting stuff to shove advertising down our throat. It’s getting usage to figure out what’s wrong with windows and make it better. As you say. I have issue with Facebook and Google blatantly collecting whatever they can to build profiles of us all to shove advertising down our throat that isn’t even relevant to us.
  - ptomato 5y ago
    > MS isn’t collecting stuff to shove advertising down our throat maybe if MS wanted people to believe that, they wouldn't put so much advertising in their OS
    - philliphaydon 5y ago
      I’ve to this day never seen any advertising in windows. Must be something only in America. :/ Edit: (seen the articles about it but never actually seen it in Windows)
- WorldMaker 5y ago
  Developers can also enable the Diagnostic Data Viewer and directly see all the telemetry events that Windows sends in the JSON forms that it sends them: https://docs.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview https://docs.microsoft.com/en-us/windows/privacy/diagnostic-...
Daho0n 5y ago
This might be an unpopular opinion but in my opinion anything more than ShutUp10 is a complete waste of time unless you go all the way and run Windows behind a firewall (OPNsense) and use a whitelist. It is (again IMO) impossible to control software from the same machine.
black3r 5y ago
The thing is this script is not only about telemetry, but also about disabling some annoyances that are especially annoying in server or workstation environment. I don't think there's an up to date resource describing all these tweaks. My recommendations: - Use the original script, it's slightly more up to date, last update was in november 2020: https://github.com/Disassembler0/Win10-Initial-Setup-Script https://github.com/Disassembler0/Win10-Initial-Setup-Script - Read it's library of tweaks, especially the notes about potential unwanted side effects in comments. If you don't understand what each feature does, google it. The tweaks are grouped. - Don't enable any tweak where you don't understand what it does, especially in the security and network tweaks categories.
windthrown 5y ago
I use O&O ShutUp10 and it is much more approachable. Rather than immediately enabling and blocking settings, ShutUp10 gives you recommendations and you can reasearch individual settings you aren't sure of.

vmception 5y ago

I've seen disk images of windows on piracy sites that have all this stuff preconfigured you can get slim builds with chrome ready to go already, builds with all these cleanup scripts configured, and more sadly, they also know people in a rush are looking for this or prefer it, and they install backdoors or ways to steal your crypto on them and stuff I wouldn't even trust the scripts itself at this point, so I'm another for just don't run this stuff

hestefisk 5y ago
As good as it sounds, I wouldn’t feel comfortable installing a modded Win10 install from a piracy site…. Maybe it’s just me.
- vmception 5y ago
  Thats… what I said as consensus has flipped multiple times since I posted it, it makes me wonder if other people misread my comment
vetinari 5y ago
> I wouldn't even trust the scripts itself at this point, so I'm another for just don't run this stuff The scripts (they are mostly forks of https://github.com/Disassembler0/Win10-Initial-Setup-Script https://github.com/Disassembler0/Win10-Initial-Setup-Script) are nicely written toggles for registry values or GPO, that you can read and selectively all. Nothing scary.

tux3 5y ago

Sadly, this is an expected consequence of the aggressive monetization, telemetry, and other tracking that ships with the OS. When you make it hard to trust the system, people will look at any component that seems unnecessary. They might not know what it is, but they don't trust it anymore. So it might as well get disabled. You know, to be safe. But at the end of the day I suppose it's only a small percent of users, isn't it? I'm sure the aggressive push for automatic updates — replacing the "Cancel" button by "Maybe Later", and the "Maybe Later" by "You have 2 minutes" — has worked miracles. So I think we can expect more of this in the future, and the scripts will get even more paranoid in response. What an antagonistic situation.

nojito 5y ago
No this is a consequence of horrendous fear mongering in the tech community. Privacy scripts are a very common attack vector due to their popularity these days. Not to mention that the benefits of these “tweaks” is negligible at best.
swiley 5y ago
I've noticed this on iOS too. There are scams out there that encourage users to install root CA certs in order to jailbreak or get access to non-AppStore apps (this used to be required by one method.) I don't know what happened to the idea of user friendly software respecting the intentions of a user. Modern OSes really are effectively just well funded socially acceptable malware.
slver 5y ago
Look Windows has couple of odd settings, but the defaults are just fine. Some people will find reasons to tweak even if there's nothing to tweak. Been there in my teen years, but I grew up.
Arainach 5y ago
This class of user has always been doing such silly things long before "monetization". There were plenty of guides for Windows XP and Vista claiming to "increase performance" by disabling things like the indexer (fun fact, that will TANK your performance in a variety of areas), the Cryptographic services, and more. They never had any trust to violate, only a strange (and completely incorrect) sense that they knew more than the engineers who built the OS in the first place.

black3r 5y ago

Just as the note from the author says: Never run scripts without reading and understanding what they do. This is an outdated fork of a configurable script that I use to do initial config of my windows 10 machines. But I've created my own config saying which functions to run and which not to run based on reading what each function actually does. I'm an IT pro, I knew how to do most of these tweaks in windows settings or group policy, but it's still easier to just run a script than to perform hundreds of clicks, especially when the settings get reorganized in every other windows update. And as this is HN, I expect lots of people here being IT pros, so I would correct you here: Don't run this stuff if you don't understand what it does.

as1mov 5y ago

I haven't used Windows for a long time but a look at the script makes me think people wouldn't be resorting to such measures if Microsoft wasn't including stupid crap in their operating system. > Disabling Telemetry breaks Windows updates > Automatic web searches in start menu > Application suggestions are silently installed (wat?) > Allow MS to collect activity history > Location tracking > Map updates (who the fuck uses maps on a PC?) > Tailored experiences (apparently spamming ads on a desktop OS is an experience) > Advertising ID > Cortana This is just from skimming the list for 5 minutes. Not even sure what else is in there.

dawnerd 5y ago
macOS has a lot of this too. It’s weird Apple seems to get a pass but Microsoft gets attacked. (Ads in start is a huge problem though).
- pessimizer 5y ago
  > Apple seems to get a pass Seems to who?
- rsynnott 5y ago
  ... I don't think MacOS has _any_ of this? Besides Siri and telemetry, but it asks you on installation if you want to enable those.
  - dawnerd 5y ago
    Siri/spotlight does web searches, maps are included, location tracking baked in under the disguise of find-my (Microsoft also has a find-my alternative), there is an advertiser id built into mac toohttps://developer.apple.com/documentation/adsupport/asidentifiermanager/1614151-advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti... Really the only thing different is Apple has made it seem beneficial to users where Microsoft just comes off spammy.
    - rsynnott 5y ago

ziml77 5y ago

They're not a horrendous idea. This is forked off of the script that I've been using for years. All of the settings it touches are very clear since each change it makes is configured right up front. I purposely disable SmartScreen because I don't need information about applications I'm running shipped off to Microsoft. Setting the current network to private is handy after a first-time install since Windows often doesn't prompt and defaults to public.

stevenhuang 5y ago

> service that absolutely should not be disabled unless you want your machine to get owned. SmartScreen sends all your file hashes and unique computer info to Microsoft. If you're not stepping into weird links and running weird executables it's really not doing much for you.

e3bc54b2 5y ago

Well, the "Smart" screen says that WinMerge and KDiff3 are malwares. Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen, I can inspect their code. Yes, the binaries can contain malware, but the first principles tell me that trustability score is inverse of what is being reported by MS. Naturally I have disabled Smartscreen and Windows defender and admin rights alerts and bajilion things that internet gurus will tell me not to because I don't know what's good for me. Needless to say, my PC runs faster, calmer and is actually malware free because I don't run unauditable things like Smartscreen on it. Edit: I get WinMerge binary from GitHub repo, and KDiff3 from official website. As trusted as it can get, short of compiling myself. This is a work machine so I can't control most of Windows behavior. Personal machine runs NixOS for 90% tasks + Windows dual boot for games without connecting to network because I can't be bothered with disabling Smartscreen and defender every other week.

cptskippy 5y ago
> Well, the "Smart" screen says that WinMerge and KDiff3 are malwares. I've got WinMerge installed on my machines and I've never had that issue. Are you sure you're using trusted sources?
- e3bc54b2 5y ago
  I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself.
  - lghh 5y ago
    > Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen, I can inspect their code. > I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself. So, you don't actually know what code you're running and that binary actually could be malware.
    - e3bc54b2 5y ago
      Yes, and original comment addresses that. In theory WinMerge binary can contain malware. But WinMerge authors have a proven track record against that and they are transparent about working of their application enough through their source. MS and Smartscreen do not have that track record, and IMO have an opposite kind of record with all kind of map/adware practices throughout the system and applications. So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more?

tedajax 5y ago

SmartScreen exists solely to warn you about executables you already trust and be annoying. Fortunately you can just disable it from the settings though.

smaudet 5y ago

Could not disagree more, SmartScreen is a horrendous idea. You should only be installing verified trusted apps you can verify the sources or hash for, farming this out to a third party, even if its MS, is a great way to open yourself up to watering hole attacks. Furthermore, you are encouraging poor user behaviour with "oh man this app said my app is good" and then ending up with all manner of poorly vetted bloatware, not to mention antitrust and legal issues. Really it should be possible to completely remove and/or replace this whole component. As for network, why aren't running from behind a properly secured connection? That's just bad practice. If you want to connect from a coffeeshop or whatever, set your firewall to block everything by default.

avereveard 5y ago

most of these things also look for registry file entries that point to non existing files and they have no regards for parametric entries (i.e. c:\users\{current}\blah) so they wreak havoc on your installed services and applications.

ocdtrekkie 5y ago

To me, I'd never run someone's prefab cleanup script, but I find this script really nice because it's documented, categorized, and there's a lot of useful PowerShell in here, if you're looking for specific things. There's plenty of commands in here I use, and plenty I'd like to... along with quite a few I definitely would not.

hparadiz 5y ago

I've been using these scripts on my boxes for years now with no issues. Maybe don't make assumptions about people's use cases?

chaosite 5y ago

I mean, sure, SmartScreen is an important security service that should not be disabled if you're OK with hashes of every executable you run being transmitted to Microsoft.

josephcsible 5y ago

I agree with most of what you said, but this is just totally false: > SmartScreen, a service that absolutely should not be disabled unless you want your machine to get owned It's not hard for people, especially ones who read HN, to be perfectly safe with SmartScreen disabled.

majkinetor 5y ago

Your comment is absolute nonsense. You can't say anything like that without context. SmartScreen and defender are the first things to go on my machine as they slow down computer at least by the factor of 2, if not more. People on HN generally don't need babysitting!. Know where you are.

DeliriumTrigger 5y ago
You complain about nonsense and than go forward and spread some on your own. You saying that SmartScreen and Defender slows down a Windows machine by a factor of 2 just makes you a nonsense clown.
- majkinetor 5y ago
  Yes, I was wrong - its not by a factor of 2, more like a factor or 3 to 5. The best way to make your computer age 10 years in a second is to enable ANY antivirus. There are so many places that you can check that out if you didn't experience it, or u need me to LMGTFY ?
  - tomnipotent 5y ago
    So you decide to double down on your wrongness? Windows Defender has a marginal impact on performance, such that for most users and most tasks it's not even perceptible. > need me to LMGTFY You've provided zero evidence to the contrary. The burden of proof is on you.
    - majkinetor 5y ago
      Here is 1 for you: > As far as I can tell, as long as Windows Defender (and presumably other A/V scanners) are running, there's no way to make the Windows I/O APIs consistently fast. https://gregoryszorc.com/blog/2021/04/06/surprisingly-slow/ https://gregoryszorc.com/blog/2021/04/06/surprisingly-slow/ This is really even a common knowledge - if you did ANY IT work, you should already know it. I can't count the number of times when server wasn't working correctly when it turns out it just has Defender on.

mipsi 5y ago

This criticism is a bit unfair. It's a gist on github, which you are supposed to read and understand as the author states in his opening disclaimer. The statement for enabling SmartScreen is also included. And no, your machine gets not owned when you disable SmartScreen - there are other protective measures you can take.

skjoldr 5y ago

Is there any use for SmartScreen when running a proper antivirus, as you should?

emptysongglass 5y ago

I agree. If you want a stripped down Windows use Windows 10 LTSC. It's everything anyone wants from Windows without any of the cruft. I'm a Linux person but when I installed LTSC for my wife all her complaints about sudden reboots and other unwanted behavior evaporated. Makes you wonder why they bother with any other Windows.