7 ms·

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my window

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on other OS as well, but I'm betting Windows is the leader in "my-pc-is-not-my-pc-anymore" :/

Sebb767 5y ago
> I'm betting Windows is the leader in "my-pc-is-not-my-pc-anymore" :/ There are PCs out there running ChromeOS and Android. Not to mention smartphones and game consoles. Windows is not good in this regard, but it's by far not the worst (though the UX for administrative actions is really not great, IMO).
- techrat 5y ago
  (Nearly?) All ChromeOS devices use CoreBoot. You really can't get much more open than that. Android is open source and if you don't buy a locked down device from a carrier, the bootloader is unlockable and the system easily rootable. Your two examples of something more 'not my pc anymore' than Windows aren't exactly good ones. Now, if you were to mention MacOS and iOS... then you definitely would have had a point.
  - Sebb767 5y ago
    > (Nearly?) All ChromeOS devices use CoreBoot. You really can't get much more open than that. Last time I looked, it was really hard to install anything other than ChromeOS on Chromebook hardware. You can install a chrooted Linux on them, yes, but on the device itself you can't even execute unsigned binaries. Impossible? No. Harder than executing an installer with elevated rights? Yes. Plus, they also come with pre-installed software like Google Docs. > Android is open source and if you don't buy a locked down device from a carrier, That's quite a big if. Android itself is open source, yes, but >90% of the ecosystem rely on Google Play services, which are anything but. And, when talking about pre-installed apps that the user can't remove without a lot of effort, Android basically invented that. > the bootloader is unlockable and the system easily rootable. If you wipe your device and void your warranty. And then install a third-party binary to actually use those rights, while similarly loosing the ability to use quite a few apps (like banking). That is, if the manufacturer makes it that easy (Xiaomi, for example, needs you to sign up and wait for that - it's possible, but anything but frictionless). > Now, if you were to mention MacOS and iOS... then you definitely would have had a point I can't talk about MacOS, to be honest. Though, as far as I know, getting a root shell is not hard and running own software is not a problem. We agree on iOS, but the grandparent talked about PCs - iOS really does not fall into that category (that's why I explicitly mentioned smartphones). > Your two examples of something more 'not my pc anymore' than Windows aren't exactly good ones. Windows is not a good example of that. Don't get me wrong, I don't like windows. But it's by far not the worst example of a locked-down, vendor-owned system and it would be even less bad if the administration UX would be simpler.
    - techrat 5y ago
      > Last time I looked, it was really hard to install anything other than ChromeOS on Chromebook hardware. Look again. Switching to Developer Mode and hitting Ctrl-L at the boot up screen allows you to boot from USB or SD Card. >And, when talking about pre-installed apps that the user can't remove without a lot of effort, Android basically invented that. This statement is so disingenuous that I'm just going to stop quoting here. Hello? iOS? Couldn't even remove icons/apps like Newsstand off your homescreen for 7 OS versions. You need to familiarize yourself a bit more with what you're criticizing lest you sound like a head-in-the-sand zealot.
      - Sebb767 5y ago
        Maybe you should have read my comment (or the previous one): > We agree on iOS, but the grandparent talked about PCs - iOS really does not fall into that category (that's why I explicitly mentioned smartphones).
        techrat 5y ago
        > > > Android basically invented that. > > Prior art. > Watch me dance. Okay.
        Sebb767 5y ago
        I mentioned that exclusion in the first comment. I re-emphasized it in the second comment. If we don't limit ourselves to PCs, I raise you my PS1 - could not even play a burned CD without hardware modifications, let alone customize anything. Predates iOS by 13 years.
  - jmnicolas 5y ago
    > Android is open source and if you don't buy a locked down device from a carrier, the bootloader is unlockable and the system easily rootable. Yes but it's a subpar experience compared to the closed Android. I use GrapheneOS since about a year, and I can't do much with my phone anymore. I stay on it for the same reason I have Kubuntu on my PC: it's a relief to know it's not Microsoft's / Google's all seeing eye.
aftbit 5y ago
IMO if you expand PC to cover mobile computing, the real tragedy is iPhone. No sideloading, very restrictive app store policies, and no custom OSes at all. At least with a Windows desktop or laptop, you can run Linux or one of the other actually free OSes. Modern MacOS is also pretty unfriendly for developers and power users, but at least Apple is somewhat aligned with users on privacy and security, unlike Microsoft.
- Wowfunhappy 5y ago
  > Modern MacOS is also pretty unfriendly for developers and power users. It has become somewhat unfriendly, but I really appreciate that you can still do whatever you want. To run self-signed apps, run `sudo spctl --master-disable` To turn off System Integrity Protection, run `csrutil --disable` from recovery mode. To modify the root filesystem, do all of the above and run `csrutil authenticated-root disable` from recovery mode. To disable library validation, do all of the above and run `sudo defaults write /Library/Preferences/com.apple.security.libraryvalidation.plist DisableLibraryValidation -bool true` To disable AMFI, do all of the above and add the boot argument amfi_get_out_of_my_way=0x1 (Some steps may be a bit different on Apple Silicon Macs, I don't own any so I'm not as familiar.) --- You now have the same privileges Apple does. You can grant yourself whatever entitlements you like, inject your own code into any process, load your own kernel extensions, or just replace the whole kernel with your custom build of XNU. I actually think a decent chunk of macOS's perceived "unfriendliness" comes from Mac users being less willing to hack around than users of other OSs. The common refrain in Mac circles seems to be that System Integrity Protection should never be switched off under any circumstances. I agree, if you're a normal user—but if you're not, and the handcuffs are annoying you, just unlock them already. (But do leave everything else in place until such a time as it presents a roadblock.) Also, method swizzling in Objective-C is fun, try it!
  - joshtynjala 5y ago
    There’s a safer way to run self-signed software on macOS, for anyone that prefers not to do the master disable. First, try to run the program. When it fails, open Settings.app and go to the security section. You’ll find the most recently blocked program name mentioned and an Allow button that will remove the block. Then, you can run the program. You need to do this only once per program.
shawnz 5y ago
If there was never an "old way" of doing things that didn't involve the new TrustedInstaller system, then would we even be thinking twice about these new restrictions? Or would we just see the restrictions as part of the design of the APIs? Just because they took a part of the system that used to be externally facing and made it internally facing, I don't think that is the same as making "your PC not your PC anymore". If they were blocking administrators from executing arbitrary code or having arbitrary access to I/Os, that would be a different story.
- bob1029 5y ago
  > If they were blocking administrators from executing arbitrary code or having arbitrary access to I/Os, that would be a different story. I think this is the exact story being discussed here.
  - deleted 5y ago
    [deleted]
Wowfunhappy 5y ago
I’m not proud of it, but when the reporting on Pegasus came out last week I was thinking “I wonder if this could lead to a Jailbreak on iOS 15.”
majkinetor 5y ago
> But DAMN that quote above is really showing me how bad it is out there ! Actually Windows is quite awesome nowdays. I was using mentioned OSes for years during periods of Windows downs, and since Satya Nadella took the leadership I was very happy with Windows (I primarily spend my time in PowerShell, browser, vscode and using dev tools but have different dedicated installations for games, media etc.) Now with this can't-turn-off-helicopter attitude I am really considering switching to some Linux variant again. Mac is totally out of question due to similar concerns.
bob1029 5y ago
I've been spending the last 48 hours strongly pondering Linux as a daily driver. If it wasn't for my crippling visual studio addiction, I'd probably be able to swap all my PCs over, with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released. Virtualization is another option that I am investigating actively now. I could even see the path for getting our product off the Windows platform and onto Linux (while still using Microsoft's dotnet toolchain). There are only 2 DLLs keeping us locked to Windows and I have a very solid hypothetical answer for both. All of this is so depressing because it doesn't have to be this way. A few small changes to the OS (that would incur negligible impact to Microsoft's cashflow or margins) could mean life changing improvements in the user experience. If profit must be obtained, then Microsoft should consider a "hacker" build of windows that starts as a bare-ass powershell prompt that you have to tack on what you want to use. I'd pay a fucking premium. Microsoft, are you out there? Charge me $1000. I swear I'll pay it if you promise to not shove updates, telemetry, defender or cortana down my throat ever again.
- jakogut 5y ago
  > with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released For what it's worth, all recent Battlefield games run flawlessly through Proton, including multiplayer with anti-cheat, D3D12, and soon (if not already), ray tracing. This includes at least BF:BC2, BF3, BF4, BF1, and BFV. There's no reason to think BF2042 will be any different.
- CrazyPyroLinux 5y ago
  I've found VSCode and dotnet 5/core be amazingly liberating from the the slow bloated mess that is Visual Studio and the old .NET Framework. This is the way it should have always been, but I'm happy we finally got here.
  - bob1029 5y ago
    Do razor components work in vscode? Like w/ breakpoints and such?
  - 5y ago
jmnicolas 5y ago
> Magic-Pony-OS and there I was thinking you were joking, but there's actually a PonyOS! https://www.ponyos.org/ https://www.ponyos.org/
- rawoke083600 5y ago
  Haha i really was joking :D, Was looking for the one crazy-one-person, that "simply-must-know" if there is a such a OS :D
  - jmnicolas 5y ago
    You got me :)
- rawoke083600 5y ago
  Damn it looks "pretty" in a "Hello-Kitty" sort of way :D
Godel_unicode 5y ago
Except this is in no way an exploit. Running processes as TrustedInstaller is no different than a user using sudo to run vim as root.

Sebb767 5y ago

> I'm betting Windows is the leader in "my-pc-is-not-my-pc-anymore" :/ There are PCs out there running ChromeOS and Android. Not to mention smartphones and game consoles. Windows is not good in this regard, but it's by far not the worst (though the UX for administrative actions is really not great, IMO).

techrat 5y ago
(Nearly?) All ChromeOS devices use CoreBoot. You really can't get much more open than that. Android is open source and if you don't buy a locked down device from a carrier, the bootloader is unlockable and the system easily rootable. Your two examples of something more 'not my pc anymore' than Windows aren't exactly good ones. Now, if you were to mention MacOS and iOS... then you definitely would have had a point.
- Sebb767 5y ago
  > (Nearly?) All ChromeOS devices use CoreBoot. You really can't get much more open than that. Last time I looked, it was really hard to install anything other than ChromeOS on Chromebook hardware. You can install a chrooted Linux on them, yes, but on the device itself you can't even execute unsigned binaries. Impossible? No. Harder than executing an installer with elevated rights? Yes. Plus, they also come with pre-installed software like Google Docs. > Android is open source and if you don't buy a locked down device from a carrier, That's quite a big if. Android itself is open source, yes, but >90% of the ecosystem rely on Google Play services, which are anything but. And, when talking about pre-installed apps that the user can't remove without a lot of effort, Android basically invented that. > the bootloader is unlockable and the system easily rootable. If you wipe your device and void your warranty. And then install a third-party binary to actually use those rights, while similarly loosing the ability to use quite a few apps (like banking). That is, if the manufacturer makes it that easy (Xiaomi, for example, needs you to sign up and wait for that - it's possible, but anything but frictionless). > Now, if you were to mention MacOS and iOS... then you definitely would have had a point I can't talk about MacOS, to be honest. Though, as far as I know, getting a root shell is not hard and running own software is not a problem. We agree on iOS, but the grandparent talked about PCs - iOS really does not fall into that category (that's why I explicitly mentioned smartphones). > Your two examples of something more 'not my pc anymore' than Windows aren't exactly good ones. Windows is not a good example of that. Don't get me wrong, I don't like windows. But it's by far not the worst example of a locked-down, vendor-owned system and it would be even less bad if the administration UX would be simpler.
  - techrat 5y ago
    > Last time I looked, it was really hard to install anything other than ChromeOS on Chromebook hardware. Look again. Switching to Developer Mode and hitting Ctrl-L at the boot up screen allows you to boot from USB or SD Card. >And, when talking about pre-installed apps that the user can't remove without a lot of effort, Android basically invented that. This statement is so disingenuous that I'm just going to stop quoting here. Hello? iOS? Couldn't even remove icons/apps like Newsstand off your homescreen for 7 OS versions. You need to familiarize yourself a bit more with what you're criticizing lest you sound like a head-in-the-sand zealot.
    - Sebb767 5y ago
      Maybe you should have read my comment (or the previous one): > We agree on iOS, but the grandparent talked about PCs - iOS really does not fall into that category (that's why I explicitly mentioned smartphones).
      - techrat 5y ago
        > > > Android basically invented that. > > Prior art. > Watch me dance. Okay.
        Sebb767 5y ago
        I mentioned that exclusion in the first comment. I re-emphasized it in the second comment. If we don't limit ourselves to PCs, I raise you my PS1 - could not even play a burned CD without hardware modifications, let alone customize anything. Predates iOS by 13 years.
- jmnicolas 5y ago
  > Android is open source and if you don't buy a locked down device from a carrier, the bootloader is unlockable and the system easily rootable. Yes but it's a subpar experience compared to the closed Android. I use GrapheneOS since about a year, and I can't do much with my phone anymore. I stay on it for the same reason I have Kubuntu on my PC: it's a relief to know it's not Microsoft's / Google's all seeing eye.

aftbit 5y ago

IMO if you expand PC to cover mobile computing, the real tragedy is iPhone. No sideloading, very restrictive app store policies, and no custom OSes at all. At least with a Windows desktop or laptop, you can run Linux or one of the other actually free OSes. Modern MacOS is also pretty unfriendly for developers and power users, but at least Apple is somewhat aligned with users on privacy and security, unlike Microsoft.

Wowfunhappy 5y ago
> Modern MacOS is also pretty unfriendly for developers and power users. It has become somewhat unfriendly, but I really appreciate that you can still do whatever you want. To run self-signed apps, run `sudo spctl --master-disable` To turn off System Integrity Protection, run `csrutil --disable` from recovery mode. To modify the root filesystem, do all of the above and run `csrutil authenticated-root disable` from recovery mode. To disable library validation, do all of the above and run `sudo defaults write /Library/Preferences/com.apple.security.libraryvalidation.plist DisableLibraryValidation -bool true` To disable AMFI, do all of the above and add the boot argument amfi_get_out_of_my_way=0x1 (Some steps may be a bit different on Apple Silicon Macs, I don't own any so I'm not as familiar.) --- You now have the same privileges Apple does. You can grant yourself whatever entitlements you like, inject your own code into any process, load your own kernel extensions, or just replace the whole kernel with your custom build of XNU. I actually think a decent chunk of macOS's perceived "unfriendliness" comes from Mac users being less willing to hack around than users of other OSs. The common refrain in Mac circles seems to be that System Integrity Protection should never be switched off under any circumstances. I agree, if you're a normal user—but if you're not, and the handcuffs are annoying you, just unlock them already. (But do leave everything else in place until such a time as it presents a roadblock.) Also, method swizzling in Objective-C is fun, try it!
- joshtynjala 5y ago
  There’s a safer way to run self-signed software on macOS, for anyone that prefers not to do the master disable. First, try to run the program. When it fails, open Settings.app and go to the security section. You’ll find the most recently blocked program name mentioned and an Allow button that will remove the block. Then, you can run the program. You need to do this only once per program.

shawnz 5y ago

If there was never an "old way" of doing things that didn't involve the new TrustedInstaller system, then would we even be thinking twice about these new restrictions? Or would we just see the restrictions as part of the design of the APIs? Just because they took a part of the system that used to be externally facing and made it internally facing, I don't think that is the same as making "your PC not your PC anymore". If they were blocking administrators from executing arbitrary code or having arbitrary access to I/Os, that would be a different story.

bob1029 5y ago
> If they were blocking administrators from executing arbitrary code or having arbitrary access to I/Os, that would be a different story. I think this is the exact story being discussed here.
- deleted 5y ago
  [deleted]

Wowfunhappy 5y ago

I’m not proud of it, but when the reporting on Pegasus came out last week I was thinking “I wonder if this could lead to a Jailbreak on iOS 15.”

majkinetor 5y ago

> But DAMN that quote above is really showing me how bad it is out there ! Actually Windows is quite awesome nowdays. I was using mentioned OSes for years during periods of Windows downs, and since Satya Nadella took the leadership I was very happy with Windows (I primarily spend my time in PowerShell, browser, vscode and using dev tools but have different dedicated installations for games, media etc.) Now with this can't-turn-off-helicopter attitude I am really considering switching to some Linux variant again. Mac is totally out of question due to similar concerns.

bob1029 5y ago

I've been spending the last 48 hours strongly pondering Linux as a daily driver. If it wasn't for my crippling visual studio addiction, I'd probably be able to swap all my PCs over, with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released. Virtualization is another option that I am investigating actively now. I could even see the path for getting our product off the Windows platform and onto Linux (while still using Microsoft's dotnet toolchain). There are only 2 DLLs keeping us locked to Windows and I have a very solid hypothetical answer for both. All of this is so depressing because it doesn't have to be this way. A few small changes to the OS (that would incur negligible impact to Microsoft's cashflow or margins) could mean life changing improvements in the user experience. If profit must be obtained, then Microsoft should consider a "hacker" build of windows that starts as a bare-ass powershell prompt that you have to tack on what you want to use. I'd pay a fucking premium. Microsoft, are you out there? Charge me $1000. I swear I'll pay it if you promise to not shove updates, telemetry, defender or cortana down my throat ever again.

jakogut 5y ago
> with the exception of the one bastard stepchild win10 that I will keep in the closet for when BF2042 is released For what it's worth, all recent Battlefield games run flawlessly through Proton, including multiplayer with anti-cheat, D3D12, and soon (if not already), ray tracing. This includes at least BF:BC2, BF3, BF4, BF1, and BFV. There's no reason to think BF2042 will be any different.
CrazyPyroLinux 5y ago
I've found VSCode and dotnet 5/core be amazingly liberating from the the slow bloated mess that is Visual Studio and the old .NET Framework. This is the way it should have always been, but I'm happy we finally got here.
- bob1029 5y ago
  Do razor components work in vscode? Like w/ breakpoints and such?
- 5y ago

jmnicolas 5y ago

> Magic-Pony-OS and there I was thinking you were joking, but there's actually a PonyOS! https://www.ponyos.org/ https://www.ponyos.org/

rawoke083600 5y ago
Haha i really was joking :D, Was looking for the one crazy-one-person, that "simply-must-know" if there is a such a OS :D
- jmnicolas 5y ago
  You got me :)
rawoke083600 5y ago
Damn it looks "pretty" in a "Hello-Kitty" sort of way :D

Godel_unicode 5y ago

Except this is in no way an exploit. Running processes as TrustedInstaller is no different than a user using sudo to run vim as root.