7 ms·

"With added security", but from the FAQ, no security updates, and no way to add them. I can't imagine this is more secure than standard Windows 10.

aspenmayer 5y ago
Secure from PII telemetry phoning home: perhaps, likely better than stock Win10 or even LTSB/LTSC in that regard Secure in literally any other way: outside the scope of the project
- throwmeariver1 5y ago
  Telemetry is a non issue if your network has a good nat in front… software updates on the other hand…
  - alar44 5y ago
    >"has a good NAT" What is a good NAT as opposed to a bad one? "Dude the DHCP on this network is AWESOME" lol
    - throwmeariver1 5y ago
      the configuration? what the fuck is this comment.
      - alar44 5y ago
        What configuration is there? You're either NATing or you're not. There's no "good". It's on or off. What situations have you been in where you weren't NATing between LAN and WAN?
        throwmeariver1 5y ago
        Oh my that's so cute... not everything runs on a home router. lmao
        alar44 5y ago
        I'm not talking about home routers. I'm taking about NAT, which I can tell you don't understand. Toodles.
        Forbo 5y ago
        Confidently incorrect, see my other comment for some examples.
        alar44 5y ago
        Give me an example of a parameter you need to configure for NAT.
        Forbo 5y ago
        Take your pick: https://docs.netgate.com/pfsense/en/latest/nat/index.html https://docs.netgate.com/pfsense/en/latest/nat/index.html
        Forbo 5y ago
        Does VPN subnet translation count as NAT? Because I've definitely seen some footguns come from that.... I've also seen instances where poorly configured NATs ended up allowing victims to be used as proxies. So I'd say there are definite security questions to take into account.
- clucas 5y ago
  Do you understand why people might get confused? They don't qualify what they mean by "more secure," and it seems reasonable to criticize the project if their idiosyncratic definition of "secure" actually excludes one of the biggest advances in consumer software security in the last 20 years...
  - aspenmayer 5y ago
    I’m not a dev on the project, fwiw. In any case, if you wanted security in the way you describe, how would you justify running Windows 10 at all? The onus isn’t on this project to secure Windows when they had no part in making it insecure to begin with. If Windows were open source, these measures wouldn’t be necessary, and wouldn’t result in less security. This is the current best effort that the devs can do to accomplish their goals. It’s fair to criticize the goal or the results, but issues you’re describing are present in stock Windows 10 to begin with. I’m sure that some kind of auto build script could be created, so that whenever new Windows Updates are released, a new build is created.
  - hedora 5y ago
    The biggest advance I can think of is using security as an excuse to gather and monetize data. Different people have different attacker models. I can imagine something like this would be perfect for keeping a mostly airgapped machine to access archives of documents created by Windows. (Or to use legitimately licensed, pre-everything as a service software in perpetuity)
alar44 5y ago
This is what happens when people don't understand group policy and are a little too paranoid. This is just a broken version of Windows 10 as far as I'm concerned. You will have far more problems with this than any "forced" Windows update people love to complain about.
- aspenmayer 5y ago
  It’s an educational release, and one that raises awareness about the issues of Microsoft collecting PII and other telemetry. Even if it’s provably broken in the ways you say, it still serves the stated goals of the creators in these ways.
  - fckgw 5y ago
    It's a cracked version of Windows with updates disabled, there's nothing "educational" about it.
  - dTal 5y ago
    That's not at all what they say. It's advertised as "a stable, non-intrusive yet fully functional build of Windows 10 to anyone that requires [it]" in which "great effort has been invested in maintaining the subsequent system’s stability, bug-free operation and user experience". The entire site screams "download this and use it in production". They have big friendly ISO download buttons front and center, with absolutely no disclaimer anywhere that it might be a terrible idea. If it truly is merely "educational", then this is highly irresponsible.
    - aspenmayer 5y ago
      It [being an education release of Win10] is exactly what they say. > AME is developed for educational purposes only, which emphasizes an effort to reverse engineer, disable or replace components of the Microsoft Windows 10 operating system. The goal is an endeavour to better understand and mitigate the collection of Personally identifiable information (PII), as has been clearly outlined by numerous outlets covering the topic, including comments by famed whistle-blower Edward Snowden. Another goal is to replace included proprietary Windows software, such as the Edge web-browser, with ethically verifiable alternatives using open-source licenses. https://wiki.ameliorated.info/doku.php?id=faq#legal_considerations https://wiki.ameliorated.info/doku.php?id=faq#legal_consider...
JoeMamaAME 5y ago
I do agree removing Windows Update does pose some security risk, however I don't think said risk is nearly as bad as some make it out to be, and I personally think the benefits of Windows Ameliorated greatly outweigh any security downsides. Also, AME does greatly help to mitigate the attack surface of Windows: Windows Ameliorated ships with a non-administrator user account by default, which mitigates ~70% of Windows vulnerabilities. (Source: https://web.archive.org/web/20210618023509/https://www.beyon https://web.archive.org/web/20210618023509/https://www.beyon...). Of course you can still do admin actions, it just requires the admin password.

aspenmayer 5y ago

Secure from PII telemetry phoning home: perhaps, likely better than stock Win10 or even LTSB/LTSC in that regard Secure in literally any other way: outside the scope of the project

throwmeariver1 5y ago
Telemetry is a non issue if your network has a good nat in front… software updates on the other hand…
- alar44 5y ago
  >"has a good NAT" What is a good NAT as opposed to a bad one? "Dude the DHCP on this network is AWESOME" lol
  - throwmeariver1 5y ago
    the configuration? what the fuck is this comment.
    - alar44 5y ago
      What configuration is there? You're either NATing or you're not. There's no "good". It's on or off. What situations have you been in where you weren't NATing between LAN and WAN?
      - throwmeariver1 5y ago
        Oh my that's so cute... not everything runs on a home router. lmao
        alar44 5y ago
        I'm not talking about home routers. I'm taking about NAT, which I can tell you don't understand. Toodles.
        Forbo 5y ago
        Confidently incorrect, see my other comment for some examples.
        alar44 5y ago
        Give me an example of a parameter you need to configure for NAT.
        Forbo 5y ago
        Take your pick: https://docs.netgate.com/pfsense/en/latest/nat/index.html https://docs.netgate.com/pfsense/en/latest/nat/index.html
      - Forbo 5y ago
        Does VPN subnet translation count as NAT? Because I've definitely seen some footguns come from that.... I've also seen instances where poorly configured NATs ended up allowing victims to be used as proxies. So I'd say there are definite security questions to take into account.
clucas 5y ago
Do you understand why people might get confused? They don't qualify what they mean by "more secure," and it seems reasonable to criticize the project if their idiosyncratic definition of "secure" actually excludes one of the biggest advances in consumer software security in the last 20 years...
- aspenmayer 5y ago
  I’m not a dev on the project, fwiw. In any case, if you wanted security in the way you describe, how would you justify running Windows 10 at all? The onus isn’t on this project to secure Windows when they had no part in making it insecure to begin with. If Windows were open source, these measures wouldn’t be necessary, and wouldn’t result in less security. This is the current best effort that the devs can do to accomplish their goals. It’s fair to criticize the goal or the results, but issues you’re describing are present in stock Windows 10 to begin with. I’m sure that some kind of auto build script could be created, so that whenever new Windows Updates are released, a new build is created.
- hedora 5y ago
  The biggest advance I can think of is using security as an excuse to gather and monetize data. Different people have different attacker models. I can imagine something like this would be perfect for keeping a mostly airgapped machine to access archives of documents created by Windows. (Or to use legitimately licensed, pre-everything as a service software in perpetuity)

alar44 5y ago

This is what happens when people don't understand group policy and are a little too paranoid. This is just a broken version of Windows 10 as far as I'm concerned. You will have far more problems with this than any "forced" Windows update people love to complain about.

aspenmayer 5y ago
It’s an educational release, and one that raises awareness about the issues of Microsoft collecting PII and other telemetry. Even if it’s provably broken in the ways you say, it still serves the stated goals of the creators in these ways.
- fckgw 5y ago
  It's a cracked version of Windows with updates disabled, there's nothing "educational" about it.
- dTal 5y ago
  That's not at all what they say. It's advertised as "a stable, non-intrusive yet fully functional build of Windows 10 to anyone that requires [it]" in which "great effort has been invested in maintaining the subsequent system’s stability, bug-free operation and user experience". The entire site screams "download this and use it in production". They have big friendly ISO download buttons front and center, with absolutely no disclaimer anywhere that it might be a terrible idea. If it truly is merely "educational", then this is highly irresponsible.
  - aspenmayer 5y ago
    It [being an education release of Win10] is exactly what they say. > AME is developed for educational purposes only, which emphasizes an effort to reverse engineer, disable or replace components of the Microsoft Windows 10 operating system. The goal is an endeavour to better understand and mitigate the collection of Personally identifiable information (PII), as has been clearly outlined by numerous outlets covering the topic, including comments by famed whistle-blower Edward Snowden. Another goal is to replace included proprietary Windows software, such as the Edge web-browser, with ethically verifiable alternatives using open-source licenses. https://wiki.ameliorated.info/doku.php?id=faq#legal_considerations https://wiki.ameliorated.info/doku.php?id=faq#legal_consider...

JoeMamaAME 5y ago

I do agree removing Windows Update does pose some security risk, however I don't think said risk is nearly as bad as some make it out to be, and I personally think the benefits of Windows Ameliorated greatly outweigh any security downsides. Also, AME does greatly help to mitigate the attack surface of Windows: Windows Ameliorated ships with a non-administrator user account by default, which mitigates ~70% of Windows vulnerabilities. (Source: https://web.archive.org/web/20210618023509/https://www.beyon https://web.archive.org/web/20210618023509/https://www.beyon...). Of course you can still do admin actions, it just requires the admin password.