3 ms·

Free as in beer. I wouldn't trust such an intrusive proprietary application on my machine from a vendor who doesn't need to care about its reputation.

PicassoCTs 5y ago
You mean windows. Neither do i. Linux and VMs for the proprietary crap.
nfriedly 5y ago
Are you talking about this tool or Windows itself?
- marcodiego 5y ago
  Actually it can be seen as both. You're replacing an abusive part with another with the same potential of abuse and you can't check of modify either of them.
  - lvass 5y ago
    Confirmed abuse isn't the same as potential abuse.
MauranKilom 5y ago
Had the same thought, but upon investigation I don't see the incentive for the vendor to do something shady with it. They have a clear business model: Develop software for Windows that companies need. See their About page: https://www.oo-software.com/en/company https://www.oo-software.com/en/company Hence, it is clear what benefit they draw from releasing this software for free: Marketing. They are not in the business of brokering user data or mining bitcoin covertly. This tool isn't even installed, it's "run once". To me, that's about as trustworthy as it could be.
- marcodiego 5y ago
  > I don't see the incentive for the vendor to do something shady with it. Now. It is not a matter of having incentives. It is a matter that they can abuse and you simply have no way to check or control it.
  - loldk 5y ago
    Incentives are literally just reasons for doing things. So naturally I don't follow your logic at all.
  - breakfastduck 5y ago
    You have no way to check if this app is sending network requests back 'home'? That doesn't seem correct at all.
    - marcodiego 5y ago
      For such an intrusive application there are many ways to hide it. Not saying they do it, but I see no way to check it unless looking at the source code.
      - MauranKilom 5y ago
        Well, two possibilities that come to my mind: - Run it in a Windows VM. The program could detect this and not phone home in this case, of course. - Monitoring on network level (wireshark on same network, Pi-hole, router itself...). This is virtually impossible for the program to circumvent. You could also audit the changes it made to the system (resorting to stuff like diffing disk images before/after if you really want zero trust) to verify that nothing sneaky was left after running the program once.
      - stinos 5y ago
        Is it possible to circumvent Wireshark, Procmon and the likes? Otherwise those 2 combined give pretty good insight in what an application is doing wrt I/O.
      - 5y ago
LinuxBender 5y ago
I've not done any in-depth analysis of this app, but have used it on a machine that required windows 10 at the time. My family and friends have also used it. I can say that after they use it, the DNS activity to the Microsoft tracking endpoints appears to stop and other DNS activity is reduced but I am no windows expert so I can not say for sure if 100% of telemetry is truly nullfied. The real time dependencies on the activity DNS/HTTPS endpoints does appear to be removed after usage. From a network perspective it does stop the "chattyness" of Windows 10.
- unicornporn 5y ago
  > I can not say for sure if 100% of telemetry is truly nullfied. I'll leave this here: https://ameliorated.info/ https://ameliorated.info/ No Windows Update for you, so security is debatable.
  - LinuxBender 5y ago
    This looks interesting. Is there something like a Vagrant build image for this so that you can easily automate the build process to pick up the updates and adjust the configuration/customization in a json or yaml file?
  - kosasbest 5y ago
    I prefer the script[0] instead of the hacked ISO since you can install the script in later versions of W10 using your own preferred ISO. Only caveat: There's no way of telling what versions of W10 it's compatible with (I imagine it breaks some versions). I have an old VM with AME installed and manually enabled updates by hacking the registry. (You could also alter the .BAT script to enable updates, but you have to know what to remove). This project is cute, but I only ever used it for an offline sandbox for running low resource games and cracked versions of Photoshop. I am scared as shit to connect this thing to the Internet. I only connect to receive updates. [0] https://wiki.ameliorated.info/doku.php?id=documentation_20H2 https://wiki.ameliorated.info/doku.php?id=documentation_20H2
    - unicornporn 5y ago
jeroenhd 5y ago
I can get behind that mindset, but if you're using Windows you've already given up your ability to introspect your system. The same is true for most of macOS/iOS and large parts of the basic feature set found in Android. Most Windows programs, both freeware and paid, are closed source, that's just the way that ecosystem functions. These companies can exist the same way Winrar can exist: give people the tool for free, wait for them to want to use it at their business and sell the subscriptions there. Businesses are much more wary if pirated software than consumers so Winrar manages to survive to this day. To me, the amount of telemetry collected from modern crapware indicates a lack of trust in the product from even the developers themselves, which in turn proves to me that the product isn't very good on some level I might not be able to see. Just because something is free doesn't mean it's not reliable if there are business subscriptions funding the product itself. The way programs stalk their customers these days used to be rare and the O&O team seems to follow the old software shop practices rather than "modernising" and adding the very thing they try to block to their own product.
- marcodiego 5y ago
  It is possible to use windows as a mere kernel. Much desktop software on a modern linux distro is portable. Even your example, winrar, can be replaced by peazip or 7zip. I actually saw some people using mostly FLOSS on windows as a step before full migration away from it.
vgeek 5y ago
The simplest way to test any software you're suspicious of on Windows is Sandboxie (https://sandboxie-plus.com/downloads/ https://sandboxie-plus.com/downloads/). Any files or registry changes are persisted to a separate location in the filesystem, so it is pretty easy to catch misbehaving software. For software like this, it will negate the utility of the software due to being in a sandboxed environment, but it will least give an idea of the registry keys and files that may be modified.
- marcodiego 5y ago
  This is not convenient to do at every update. On a windows system were there is no known concept of built-in package manager it is even more complicated. I've seen windows apps that automatically update themselves. Also, since it is very intrusive, I don't think running it into a sandbox may give good diagnostics.
  - vgeek 5y ago
    If this program has to be run persistently, then it won't provide much, since a malicious program could wait X days prior to downloading a payload. It is mostly useful for looking for one time changes like registry settings and verifying that the program doesn't place a bunch of random .bat or .exe's in obscure folders. Windows loves to silently update things, even if it ends up breaking everything, too. Especially drivers where it isn't super obvious that it was updated and something just stops working. Windows 10 is _way_ more aggressive with forcing updates than 7/8 were, automatically re-enabling Windows Update after 30 days of disabling. The easiest solution that I've found is just blocking everything at the DNS level. They can obviously use IP addresses as a workaround if they really want telemetry, but I haven't had issues after blocking a bunch of MS domains in the hosts file.
midasuni 5y ago
How did you get windows in there in the first place?
iratewizard 5y ago
They're a Microsoft gold partner. Their reputation is on the line.
- marcodiego 5y ago
  Their with microsoft, you mean. Considering microsoft's reputation with regard to telemetry and other abuses, I'd say it doesn't mean much.
  - iso1210 5y ago
    You're happy enough to take Microsoft products, how much worse can a microsoft gold partner be?
  - iratewizard 5y ago
    Partners aren't with Microsoft. They're vendors and service providers that live off of scraps from the mothership. If they were to do something malicious, it would potentially cost them their business. I'm sure Microsoft itself doesn't care if under 1% of desktops use tools like this to turn off their telemetry.
Ardren 5y ago
Fair enough, though O&O has been around for ages (24 years) and I don't remember hearing anything bad about them (and have used their software in the past).

PicassoCTs 5y ago

You mean windows. Neither do i. Linux and VMs for the proprietary crap.

nfriedly 5y ago

Are you talking about this tool or Windows itself?

marcodiego 5y ago
Actually it can be seen as both. You're replacing an abusive part with another with the same potential of abuse and you can't check of modify either of them.
- lvass 5y ago
  Confirmed abuse isn't the same as potential abuse.

MauranKilom 5y ago

Had the same thought, but upon investigation I don't see the incentive for the vendor to do something shady with it. They have a clear business model: Develop software for Windows that companies need. See their About page: https://www.oo-software.com/en/company https://www.oo-software.com/en/company Hence, it is clear what benefit they draw from releasing this software for free: Marketing. They are not in the business of brokering user data or mining bitcoin covertly. This tool isn't even installed, it's "run once". To me, that's about as trustworthy as it could be.

marcodiego 5y ago
> I don't see the incentive for the vendor to do something shady with it. Now. It is not a matter of having incentives. It is a matter that they can abuse and you simply have no way to check or control it.
- loldk 5y ago
  Incentives are literally just reasons for doing things. So naturally I don't follow your logic at all.
- breakfastduck 5y ago
  You have no way to check if this app is sending network requests back 'home'? That doesn't seem correct at all.
  - marcodiego 5y ago
    For such an intrusive application there are many ways to hide it. Not saying they do it, but I see no way to check it unless looking at the source code.
    - MauranKilom 5y ago
      Well, two possibilities that come to my mind: - Run it in a Windows VM. The program could detect this and not phone home in this case, of course. - Monitoring on network level (wireshark on same network, Pi-hole, router itself...). This is virtually impossible for the program to circumvent. You could also audit the changes it made to the system (resorting to stuff like diffing disk images before/after if you really want zero trust) to verify that nothing sneaky was left after running the program once.
    - stinos 5y ago
      Is it possible to circumvent Wireshark, Procmon and the likes? Otherwise those 2 combined give pretty good insight in what an application is doing wrt I/O.
    - 5y ago

LinuxBender 5y ago

I've not done any in-depth analysis of this app, but have used it on a machine that required windows 10 at the time. My family and friends have also used it. I can say that after they use it, the DNS activity to the Microsoft tracking endpoints appears to stop and other DNS activity is reduced but I am no windows expert so I can not say for sure if 100% of telemetry is truly nullfied. The real time dependencies on the activity DNS/HTTPS endpoints does appear to be removed after usage. From a network perspective it does stop the "chattyness" of Windows 10.

unicornporn 5y ago
> I can not say for sure if 100% of telemetry is truly nullfied. I'll leave this here: https://ameliorated.info/ https://ameliorated.info/ No Windows Update for you, so security is debatable.
- LinuxBender 5y ago
  This looks interesting. Is there something like a Vagrant build image for this so that you can easily automate the build process to pick up the updates and adjust the configuration/customization in a json or yaml file?
- kosasbest 5y ago
  I prefer the script[0] instead of the hacked ISO since you can install the script in later versions of W10 using your own preferred ISO. Only caveat: There's no way of telling what versions of W10 it's compatible with (I imagine it breaks some versions). I have an old VM with AME installed and manually enabled updates by hacking the registry. (You could also alter the .BAT script to enable updates, but you have to know what to remove). This project is cute, but I only ever used it for an offline sandbox for running low resource games and cracked versions of Photoshop. I am scared as shit to connect this thing to the Internet. I only connect to receive updates. [0] https://wiki.ameliorated.info/doku.php?id=documentation_20H2 https://wiki.ameliorated.info/doku.php?id=documentation_20H2
  - unicornporn 5y ago

jeroenhd 5y ago

I can get behind that mindset, but if you're using Windows you've already given up your ability to introspect your system. The same is true for most of macOS/iOS and large parts of the basic feature set found in Android. Most Windows programs, both freeware and paid, are closed source, that's just the way that ecosystem functions. These companies can exist the same way Winrar can exist: give people the tool for free, wait for them to want to use it at their business and sell the subscriptions there. Businesses are much more wary if pirated software than consumers so Winrar manages to survive to this day. To me, the amount of telemetry collected from modern crapware indicates a lack of trust in the product from even the developers themselves, which in turn proves to me that the product isn't very good on some level I might not be able to see. Just because something is free doesn't mean it's not reliable if there are business subscriptions funding the product itself. The way programs stalk their customers these days used to be rare and the O&O team seems to follow the old software shop practices rather than "modernising" and adding the very thing they try to block to their own product.

marcodiego 5y ago
It is possible to use windows as a mere kernel. Much desktop software on a modern linux distro is portable. Even your example, winrar, can be replaced by peazip or 7zip. I actually saw some people using mostly FLOSS on windows as a step before full migration away from it.

vgeek 5y ago

The simplest way to test any software you're suspicious of on Windows is Sandboxie (https://sandboxie-plus.com/downloads/ https://sandboxie-plus.com/downloads/). Any files or registry changes are persisted to a separate location in the filesystem, so it is pretty easy to catch misbehaving software. For software like this, it will negate the utility of the software due to being in a sandboxed environment, but it will least give an idea of the registry keys and files that may be modified.

marcodiego 5y ago
This is not convenient to do at every update. On a windows system were there is no known concept of built-in package manager it is even more complicated. I've seen windows apps that automatically update themselves. Also, since it is very intrusive, I don't think running it into a sandbox may give good diagnostics.
- vgeek 5y ago
  If this program has to be run persistently, then it won't provide much, since a malicious program could wait X days prior to downloading a payload. It is mostly useful for looking for one time changes like registry settings and verifying that the program doesn't place a bunch of random .bat or .exe's in obscure folders. Windows loves to silently update things, even if it ends up breaking everything, too. Especially drivers where it isn't super obvious that it was updated and something just stops working. Windows 10 is _way_ more aggressive with forcing updates than 7/8 were, automatically re-enabling Windows Update after 30 days of disabling. The easiest solution that I've found is just blocking everything at the DNS level. They can obviously use IP addresses as a workaround if they really want telemetry, but I haven't had issues after blocking a bunch of MS domains in the hosts file.

midasuni 5y ago

How did you get windows in there in the first place?

iratewizard 5y ago

They're a Microsoft gold partner. Their reputation is on the line.

marcodiego 5y ago
Their with microsoft, you mean. Considering microsoft's reputation with regard to telemetry and other abuses, I'd say it doesn't mean much.
- iso1210 5y ago
  You're happy enough to take Microsoft products, how much worse can a microsoft gold partner be?
- iratewizard 5y ago
  Partners aren't with Microsoft. They're vendors and service providers that live off of scraps from the mothership. If they were to do something malicious, it would potentially cost them their business. I'm sure Microsoft itself doesn't care if under 1% of desktops use tools like this to turn off their telemetry.

Ardren 5y ago

Fair enough, though O&O has been around for ages (24 years) and I don't remember hearing anything bad about them (and have used their software in the past).