3 ms·

TBH, Windows shouldn't even be in the business of having any opinion on uncommon software. If they want to collect data sets for virus protection, go ahead. I

by ethbr0 5y ago

TBH, Windows shouldn't even be in the business of having any opinion on uncommon software. If they want to collect data sets for virus protection, go ahead. If they want to hash installed files from common software to detect divergences for virus protection, go ahead. But having any kind of notification that an install is uncommon? We call it a general purpose computer because we want to use it for general purposes: which is to say, uncommon purposes. This feels like ape'ing Apple without thinking it through.

gruez 5y ago
> But having any kind of notification that an install is uncommon? We call it a general purpose computer because we want to use it for general purposes: which is to say, uncommon purposes. How much % of the windows install base do you think is running random programs that they downloaded off github, and how many are just running the top 1000 programs (eg. chrome/office/winrar)?
- ethbr0 5y ago
  Do we want to live in a world where someone running something different than everyone else on their computer is treated with suspicion? This seems like a very slippery slope towards the iPhonization of the PC.
  - gruez 5y ago
    > Do we want to live in a world where someone running something different than everyone else on their computer is treated with suspicion? It depends on what you mean by "suspicion". Should users be wary and not blindly run uncommon binaries they got off the internet, on a unsandboxed system? I don't see why not. I'll even say that most developers are not exercising enough caution when downloading random packages off npm.
    - ethbr0 5y ago
      Isn't this already what Windows does? It's warned about unsigned binaries on first run for a while now, no? And I can see some argument for that, even if in practice it feels more like teaching users to blindly ignore warnings. But holding uncommon or un-Microsoft-sourced (that is, signed) to a higher standard feels wrong.
      - gruez 5y ago
        > Isn't this already what Windows does? It's warned about unsigned binaries on first run for a while now, no? Sort of? There's three I know of 1. the generic warning for files you downloaded off the internet 2. the UAC warning when you try to run any program as admin 3. the smartscreen warning for uncommon files. The first two has the "run/open" equally as visible as the "don't run/cancel" button. The last one is the one where the "run" button is hidden. >And I can see some argument for that, even if in practice it feels more like teaching users to blindly ignore warnings. That's exactly the problem. The first two warnings show up for everything, so users are trained to click through. >But holding uncommon or un-Microsoft-sourced (that is, signed) to a higher standard feels wrong. The problem is that without a digital signature, you can't tell whether a binary from a legitimate developer and a malware developer. Hence the need to rely on file hashes and needing to warn users for uncommon binaries.
        jodrellblank 5y ago
        Another interaction before 3. is the Edge / SmartScreen integration where it won't download files thought to be unsafe "This is unsafe to download and was blocked by SmartScreen Filter" and you need to explicitly download them, e.g. screenshot in this blog: https://www.windowscentral.com/how-download-blocked-files-smartscreen-filter-microsoft-edge https://www.windowscentral.com/how-download-blocked-files-sm...

by ethbr0 5y ago

gruez 5y ago

> But having any kind of notification that an install is uncommon? We call it a general purpose computer because we want to use it for general purposes: which is to say, uncommon purposes. How much % of the windows install base do you think is running random programs that they downloaded off github, and how many are just running the top 1000 programs (eg. chrome/office/winrar)?

ethbr0 5y ago
Do we want to live in a world where someone running something different than everyone else on their computer is treated with suspicion? This seems like a very slippery slope towards the iPhonization of the PC.
- gruez 5y ago
  > Do we want to live in a world where someone running something different than everyone else on their computer is treated with suspicion? It depends on what you mean by "suspicion". Should users be wary and not blindly run uncommon binaries they got off the internet, on a unsandboxed system? I don't see why not. I'll even say that most developers are not exercising enough caution when downloading random packages off npm.
  - ethbr0 5y ago
    Isn't this already what Windows does? It's warned about unsigned binaries on first run for a while now, no? And I can see some argument for that, even if in practice it feels more like teaching users to blindly ignore warnings. But holding uncommon or un-Microsoft-sourced (that is, signed) to a higher standard feels wrong.
    - gruez 5y ago
      > Isn't this already what Windows does? It's warned about unsigned binaries on first run for a while now, no? Sort of? There's three I know of 1. the generic warning for files you downloaded off the internet 2. the UAC warning when you try to run any program as admin 3. the smartscreen warning for uncommon files. The first two has the "run/open" equally as visible as the "don't run/cancel" button. The last one is the one where the "run" button is hidden. >And I can see some argument for that, even if in practice it feels more like teaching users to blindly ignore warnings. That's exactly the problem. The first two warnings show up for everything, so users are trained to click through. >But holding uncommon or un-Microsoft-sourced (that is, signed) to a higher standard feels wrong. The problem is that without a digital signature, you can't tell whether a binary from a legitimate developer and a malware developer. Hence the need to rely on file hashes and needing to warn users for uncommon binaries.
      - jodrellblank 5y ago
        Another interaction before 3. is the Edge / SmartScreen integration where it won't download files thought to be unsafe "This is unsafe to download and was blocked by SmartScreen Filter" and you need to explicitly download them, e.g. screenshot in this blog: https://www.windowscentral.com/how-download-blocked-files-smartscreen-filter-microsoft-edge https://www.windowscentral.com/how-download-blocked-files-sm...