22 ms·
Any sufficiently advanced uninstaller is indistinguishable from malware
- hooby 3y agoReading stuff like that, just makes me love package managers even more :)
- deleted 3y ago[deleted]
- el_benhameen 3y agoAny time I see a Microsoft link with a cheeky title, I assume it’s a great Raymond Chen deep dive. Haven’t been wrong yet!
- s-video 3y agoHah, I had the same experience. Saw microsoft.com and thought "it's gonna be a Raymond, I can feel it"
- _hao 3y agoAs an aside every time I come across a Raymond Chen article I remember this post from Joel Spolsky - https://www.joelonsoftware.com/2005/05/11/making-wrong-code-look-wrong/ https://www.joelonsoftware.com/2005/05/11/making-wrong-code-... I remember very distinctly this quote about him: > The only person in the world who leapt to my defense was, of course, Raymond Chen, who is, by the way, the best programmer in the world, so that has to say something, right? So in my mind I've made the connection that Raymond Chen = best programmer in the world since then haha.
- saagarjha 3y agoThis is an interesting article, because it's a product of its time: modern languages solve a lot of these exact problems. I think this is a resounding success that they have correctly identified a genuine problem that people used to struggle with (safe types, exceptions) and make it standard and correct and ergonomic.
- beckerdo 3y agoIt is a very provocative title. I guessed Raymond Chen as well. Of course he delivers an interesting deep dive behind the title.
- bdamm 3y agoAnd today I learned that Windows supports running Javascript as shell script. huh
- parasti 3y agoIt's technically JScript.
- jraph 3y agoYes, the same way one could write VBS (Visual Basic Script). I think Windows 98 already had this ability. Possibly Windows 95 as well. It's a variant of the language called JScript, which is what was used in old versions of IE too.
- p_l 3y agoIt was about Windows 98 that Windows Scripting Host ended up prominent. WSH btw allowed you to run any language that you had interpreter for - they had to support necessary COM interfaces (and to be truly usable, allow you to call COM objects), and register their interpreter class with ActiveScripting (WSH internal) engine. Then you could use them not just for desktop automation, but also for scripts inside Internet Explorer (essentially, classic IE used WSH engines to implement scripts, iirc) I've seen WSH (including HTAs) used with Perl, Python, Tcl, Rexx...so long as you install the interpreter with compatible COM service, you could use it.
- mark_and_sweep 3y agoBeen using this for years. Mostly really useful. Sometimes tricky to get right since the available APIs are semi-well documented and it's JScript, which is some sort of old Internet Explorer-ish version of JavaScript. By the way, there are also HTAs, which are Microsoft HTML Applications. You can create a simple double-clickable GUI with these using only HTML and JScript.
- jeroenhd 3y agoPretty crazy how Microsoft basically invented the Electron app as HTAs all the way back in 1999. Of course we browsers weren't as capable as they are today, but "I just want a HTML+CSS GUI" had been a solved problem for over ten years when Electron first came out.
- jusssi 3y agoInstalling / uninstalling / updating software should be a service provided by the OS. Letting vendors do it themselves just gives them an opportunity to mess it up, and they frequently do.
- all2 3y agoThis makes me think of the recent changes to pip on Arch Linux that recommend installing modules with pacman. Pacman is ok, but I recently destroyed the Ruby installation on a computer while trying to use Vagrant and other Ruby packages. I still haven't figured out how to fix it. Lesson learned, stick to AUR and pacman repo.
- notpushkin 3y agoVirtualenvs are your friend. I use pipx for Python utils not in my OS repos, never had a problem with that. (`pipx install yt-dlp` creates a venv in ~/.local/pipx/venvs, installs yt-dlp there, then symlinks the executables to ~/.local/bin.) For per-project dependencies, Poetry is pretty good, although there are other options too. For Ruby, I think Bundler is the venv/Poetry counterpart. Not sure what you could use for installing global tools though.
- deleted 3y ago[deleted]
- kevingadd 3y agoI can't speak for whether Apple gets it right, but my experiences with the various package managers on Linux have not been any better than my experiences with installers on Windows. I've settled for avoiding system packages for anything I can build from source since system packages are always outdated and often Strange, and I try to avoid third party package sources and weird stuff like Snap or Flatpak since it's also historically been a source of problems for me. Maybe life is better outside of the Debian sphere though, since I've only dealt with Ubuntu and Debian. Windows does have installer/uninstaller infrastructure called MSI (https://learn.microsoft.com/en-us/windows/win32/msi/windows-installer-portal https://learn.microsoft.com/en-us/windows/win32/msi/windows-...), but ultimately it's up to developers to choose to use it.
- gostsamo 3y ago[flagged]
- bippihippi1 3y agointeresting investigation and js. Though I'm wondering why does windows rely on the software to uninstall itself?
- kevingadd 3y agohistorically all windows software has either been unzipped into a folder or installed using an installer created by the vendor, so as a result the vendor has to provide their own uninstaller too. uninstallers are complex enough that the OS can't completely take their place, though Windows has shipped with an install/uninstall framework called MSI for a long time.
- pjmlp 3y agoSince Windows 2000, to be precise.
- dolmen 3y agoINF files were (are?) also available (but quite undocumented) as an install/uninstall framework. I used to bundle an INF file in a CAB archive (converted to self-extract executable) to distribute software. Using only Microsoft's own tools.
- TremendousJudge 3y agoWhat they never shipped is understandable docs and tools for devs to create .msi installers, which caused the deluge of custom installers such as the one being discussed.
- eddythompson80 3y agoThat’s kinda like asking “why does Linux rely on `curl | sudo bash`” It doesn’t rely on it. It’s just something that’s possible.
- pbhjpbhj 3y agoSo there's a way to have Windows uninstall a program that doesn't offer an uninstaller? Where do I look in the OS for the manifest of all installed files from an installer? Thanks, I'm mostly a Linux user and I've sorely missed a `dpkg -L` on MS Windows for ages.
- cafxx 3y ago...or maybe Windows should just offer an API for marking a file for deletion once it's not in use anymore (I understand unlink semantics may not be possible, but that's not what my suggestion above is saying)
- deleted 3y ago[deleted]
- fodkodrasz 3y agoI thought I'll be the guy to point out that once again mandatory file locking is to blame, but you beat me to it. I never digged into the question, but why is it used, what benefits did it provide over the UNIX unlink behaviour?
- dataflow 3y ago> I never digged into the question, but why is it used, what benefits did it provide over the UNIX unlink behaviour? How do you defragment/move files that are unreachable on the file system? How do you shrink volumes when you can't move files that need to be moved? Edit: Actually, hmm... as I type this, I suddenly recall you can also open a file by its ID on NTFS. And you can enumerate its streams as well. So presumably this could work on NTFS if you loop through all file IDs? Though then that would make these files still accessible, not truly unreachable.
- tedunangst 3y agoUsing the same API that lets you move file blocks around at will.
- dataflow 3y agoHuh? That API requires a file handle. Which you get by opening a file. Which you can't do because you can't find it on the filesystem when it's not there. Edit: Actually, hmm... see edit above.
- turndown 3y agoI had never heard of detours before, but I guess it isn’t any different that a good old fashioned LD_PRELOAD
- kevingadd 3y agoit's a little more general, I think, since one common use case for it is to use it on your own process in order to intercept calls to stdlib/OS code from libraries you don't control. For example, in the bad old days I used detours to virtualize the windows registry so that I could do "fake installs" of COM components inside of a VB6 app, allowing it to run without an install and without administrator permissions. This worked by detouring all the Win32 registry APIs, which was sufficient to intercept registry accesses performed by the COM infrastructure.
- cornel_io 3y agoFor those of us who don't Windows, can you explain what a detour is?
- coldtea 3y agoDetours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary. Detours preserves the un-instrumented target function (callable through a trampoline) as a subroutine for use by the instrumentation. Our trampoline design enables a large class of innovative extensions to existing binary software. https://www.microsoft.com/en-us/research/project/detours/ https://www.microsoft.com/en-us/research/project/detours/
- IshKebab 3y agoInteresting. Has anyone done the same thing on Linux?
- WeylandYutani 3y agoI've seen Malwarebytes flag uninstallers a few times.
- 3seashells 3y agoOn a tangent to the title: We meet again Mr WIX.
- deleted 3y ago[deleted]
- senectus1 3y agofunny because any application without a sufficiently advanced uninstaller should also be considered malware.
- eru 3y agoIf you can just delete its directory (or its single file) and everything works, that should be fine?
- senectus1 3y agoI guess so... but then you're assuming that the user isn't saving data in that directory :-P but honestly, please Windows Dev's.. use MSI's please it make me love you and i have so much love to give.
- eru 3y agoYes. But if you stick everything into a single .exe, the user can't interfere.
- NoZebra120vClip 3y ago> Yes. But if you stick everything into a single .exe, the user can't interfere. Alright cowboy, so where are you storing preferences and settings?
- Narishma 3y agoIn the .exe, obviously.
- NoZebra120vClip 3y agoSelf-modifying code is the most exciting type of user preference!
- eru 3y ago
- JaDogg 3y agoI love articles by Raymond Chen. very good.
- brunorsini 3y agoKudos to MSFT for the blog post title of the year... Regardless of whether those GPU fleets came up with it or not :)
- deleted 3y ago[deleted]
- 8organicbits 3y agoHere's the codeproject link the code came from. https://www.codeproject.com/Articles/17052/Self-Deleting-Executables#Whereartthou,Oh%20greatentrypointoftheremoteprocess2 https://www.codeproject.com/Articles/17052/Self-Deleting-Exe... > Whether they follow the licensing terms for that code I do not know. I'm guessing they didn't ship the binary with a link pointing back to this page? These's also another codeproject example that uses a bat file, which is fairly similar to the recommendation in the post. I guess that's the better example. https://www.codeproject.com/Articles/4027/Writing-a-self-destructing-exe-file https://www.codeproject.com/Articles/4027/Writing-a-self-des...
- xg15 3y agoAt least the author seems to agree with Raymond Chan on the similarities between his approach and malware... > shellcode is the technical term (in security circles) for binary machine code that is typically used in exploits as the payload. Here's a quick and dirty way of generating the shellcode from the obj file generated when you compile your source files. In our case, we are interested in whipping the shellcode up for the remote_thread routine. Here's what you've got to do: The whole article has the vibes of some questionable DIY blog along the lines of "Your house is infested by vermin? Here is an easy way to get rid of them using a small, homebuilt neutron bomb!"
- lloydatkinson 3y agoUnfortunatelt CodeProject is full of code like this.
- Arainach 3y agoNit: Raymond Chen, not Chan
- xg15 3y agoAh, I'm sorry. That happens when you write messages on the go... seems too late to edit the message though unfortunately.
- 3y ago
- snvzz 3y agoImagine knowing where each file in the system comes from. Imagine having a package system, instead of that crap.
- deleted 3y ago[deleted]
- anticristi 3y agoFor someone who is in the OS business since ... 1990? ... it's kind of sad that Microsoft didn't make package management a first-class citizen.
- knallfrosch 3y agoImagine having 2,000 different config file formats you have to edit within a terminal instead of a central registry hive. Imagine a file explorer that doesn't simply prompt for admin rights when you need them, instead silently failing.
- snvzz 3y agoImagine having a central registry hive, yet have programs do whatever they want, including saving config files in random locations and formats. Imagine using a file explorer you don't like.
- KronisLV 3y agoSnark aside, when it comes to nix boxes, I've personally basically given up - for all of the "system" software I trust apt or other package managers, whereas in the case of any "services" I want to run (mail servers, web servers, backup services, databases, APIs) everything is run in containers with custom bind mount directories, to not pollute the host file system with crap that might get left over when removing a service or putting it on another node. So something like "/var/lib/postgresql/data" in the container becomes something like "/app/my-postgres-service-12/var/lib/postgresql/data" on the host. I have just one directory to backup, I can also move it to different nodes entirely and OS upgrades don't break anything either due to the running software being decoupled from the OS somewhat. But my Linux and Windows desktops? It's absolute Wild West over there and I just reinstall the entire OS every few years - they're beyond saving.
- dataflow 3y agoYou can't rely on JScript being present unfortunately. It can be disabled.
- deleted 3y ago[deleted]
- OtomotO 3y agoCan't spell unfortunately without fortunately.
- deleted 3y ago[deleted]
- hardware2win 3y agoWhat can you rely on then?
- dataflow 3y agoUhm, for uninstallers? How about Windows Installer? If you mean in other contexts... I think the point is you're not intended to be able to do this? Outside of uninstallers, running code that only exists in RAM is... the type of thing malware typically wants to do more than anything else. But in terms of what's physically possible, I suppose there's the command prompt, PowerShell, and scheduled tasks? I'm not sure if all of those can be disabled.
- dataflow 3y agoEdit: I forgot about this, but there's also the official solution of MOVEFILE_DELAY_UNTIL_REBOOT. But (as with scheduled tasks) the delay can cause problems: https://marc.durdin.net/2011/09/why-you-should-not-use-movefileex-with-movefile_delay_until_reboot-2/ https://marc.durdin.net/2011/09/why-you-should-not-use-movef...
- doloputer 3y agoIt probably should be disabled on most machines. The last time I heard about it was @swiftonsecurity complaining about it being an easily overlooked malware vector. I'd be surprised if this capability is only available from jscript though. (and sad, I don't think jscript has been updated in years)
- kelnos 3y agoIt's still entirely ridiculous that Windows doesn't allow you to delete open files.
- deleted 3y ago[deleted]
- iancmceachern 3y agoI love the reference to the Arthur C Clark quote (It's weird that this comment was upvoted twice, now down voted twice) This is the quote I'm referring to: https://en.m.wikipedia.org/wiki/Clarke%27s_three_laws https://en.m.wikipedia.org/wiki/Clarke%27s_three_laws It's the third of his 3 laws
- deleted 3y ago[deleted]
- fergie 3y agoWhy is the recommended javascript way of doing it var fso = new ActiveXObject("Scripting.FileSystemObject"); rather than var fs = require('fs') // (or the appropriate ES6 incantation) ?
- tedunangst 3y agoWindows doesn't ship with node.js.
- deleted 3y ago[deleted]
- casselc 3y agoBecause it’s JScript, which was abandoned prior to ES6.
- thangngoc89 3y agoIt’s JScript. Not JavaScript and definitely not Node.JS
- coldtea 3y agoThe latter is not "javascript" in general, it's just a Node.js (a specific v8 Javascript runtime + native integration and libs like fs bundle) API. And the former windows version is JScript which is an implementation Javascript just using an different name for trademark reasons, but tied to an old version of the JavaScript standard (which is confusingly called "ecmascript" officially), plus some Windows-specific integrations, like ActiveXObject and COM/OLE support. (There's also a later .NET version of JScript to add to the confusion).
- vbitz 3y agoBecause JScript was introduced back in Windows 98 and the modern APIs were introduced 10 years later (in the case of Node.js).
- terabytest 3y agoI’m probably missing something but why is an uninstaller allowed to inject code into explorer.exe? That seems like a massive security flaw?
- eddythompson80 3y agoWhat’s the difference between an uninstaller and any other process running as root?
- josephcsible 3y agoIt's never a security flaw that a program running with administrator privileges is allowed to do something.
- colordrops 3y agoIt's a security flaw that too many programs have too many privileges. Windows should have pervasive fine grained permissions like any other modern OS.
- Kuinox 3y agoWindows has a very fine grained permission system. But as you can see, the issue isn't a lack of this system.
- pjmlp 3y agoWindows pervasive fine grained permissions is better than UNIX, it goes all the way down to OS resources. The OS isn't to blame when people give root access left and right. Actually this is why macOS got SIP.
- wongarsu 3y agoYes and no. Windows has a very fine grained permissions system, including at the admin level. The problem is that it was designed for multi-user systems in the 90s, so the permission and security systems are mostly concerned about keeping users safe from each other, and having administrator roles for managing those users and doing system-wide tasks. Preventing a process from injecting code into another process by the same user running in the same session just isn't in the original threat model, since it's just the user screwing with their own stuff. The shift towards protections from malware happened mostly as a consequence of Windows XP. There are now better controls, like assigning low-trust processes like a browser's renderer a low integrity level to prevent them from doing that. But it's also late enough that it's hard to rock the boat too much without breaking existing applications. Microsoft tried to make a clean break and offer more sandboxed applications with a user-friendly package manager (called the Microsoft Store) but this wasn't well received by app developers: most didn't use it at all, and those that did often opted out of the sandboxing.
- PreInternet01 3y agoI can only imagine the Win32 API team meeting prior to this... A: So, people are resorting to injecting code in Explorer to delete in-use files in such numbers that it shows up in our top-100 crash report reasons B: Well, maybe we should add a public API to Windows to support this incredibly common functionality that apparently has been missing so far? A: Nah, let's just write a mildly condescending blog post that recommends using an unreliable workaround that is pretty much guaranteed to trigger any client-side intrusion detection software, that will set them straight B: Right on! (Meanwhile, somewhere, a third-party developer is gearing up to ship a kernel-mode driver to directly manipulate file system structures from their uninstaller, since their old solution kept crashing: can't wait to read the postmortem once the crash dumps from that one hit the Microsoft servers!)
- bux93 3y agoWell, they kinda had to rush that meeting because they spent too much time on the previous meeting listing all the reasons why the microsoft store is a functioning package system and not at all a din of inequity.
- eddythompson80 3y agoThere are already many services and APIs for doing this. It’s more like: A: There are a dozen ways to do this correctly. Which right way should we pick? B: I don’t know, I found this code on the internet. Should I just use it? A: Sure, if it’s on the internet it must be the right way.
- PreInternet01 3y ago> There are already many services and APIs for doing this I... don't think so? The particular problem here, is that an uninstaller executable needs to delete itself from disk after doing its main job. Other than using MoveFileEx with a NULL destination file and the MOVEFILE_DELAY_UNTIL_REBOOT flag, then suggesting/forcing a reboot, I can't think of a straightforward solution. And that solution instantly lights up your JIRA with 2 tickets: #1: We MUST not suggest/force a reboot! Users hate it! #2: CRITICAL BUG: uninstaller.exe still present after uninstalling product So, then you try things like 'create a Task Scheduler job to delete the file', which then adds: #3: PRIO 1: uninstaller.exe crashes if Windows Task Scheduler disabled #4: SHOWSTOPPER: uninstaller.exe still not always deleted after uninstall. Why is this so hard? Et cetera, ad absurdum. This then escalates to code injection (as described in the linked article), and (you heard it here first) kernel-mode drivers. So, if you're aware of a reliable solution, feel free to share in a comment here, for the betterment of the world!
- tankenmate 3y agoI keep forgetting Windows-isms that won't allow you to delete the executable file of a running process. I guess that's also why the arcane .dll upgrade process / WoW is so necessary.
- deleted 3y ago[deleted]
- xxs 3y ago>won't allow you to delete the executable file Any open file
- anticensor 3y agoTne kernel actually allows for that, but Win32 apparently does not.
- spatulon 3y ago> Any open file Any file that was opened without specifying FILE_SHARE_DELETE in the call to CreateFile[1] (the Win32 equivalent of open(2)). Unfortunately, most language runtimes that wrap CreateFile tend not to pass that flag. [1] https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew https://learn.microsoft.com/en-us/windows/win32/api/fileapi/...
- nextaccountic 3y agoCan a running executable start with this flag, so that its file can be removed?
- dist-epoch 3y agoProbably not, since Windows uses the executable file as backing for memory mapping.
- xxs 3y agoindeed - also reminds me that languages like go[0] and java[1] did disagree to even attempt using it [0]: https://github.com/golang/go/issues/32088#issuecomment-537590826 https://github.com/golang/go/issues/32088#issuecomment-53759... [1]: https://bugs.openjdk.org/browse/JDK-6607535 https://bugs.openjdk.org/browse/JDK-6607535 So to me it's just not there...
- OtomotO 3y agoSoftware shouldn't uninstall or update itself. There should be a package manager to do this. Then at least you have one attack vector less per application.
- zdragnar 3y agoThe upshot of a gated garden is that it is walled and gated. The downside is that it is walled and gated.
- OtomotO 3y agoI don't feel gated at all by my linux installation. If I want I can customize everything, but at least I don't have to deal with a thousand installers and update processes on a day by day basis.
- random_mutex 3y agoThere are custom repositories and the ability to install packages from disk
- herbst 3y agoAnyone can create a compatible repository to any open package manager. No gates, no walls.
- Kuinox 3y agoAnd package manager provides hooks to run custom logic when uninstalling. Your arbitrary constraints doesn't solve the problem. Also system wide package manager almost never have the option to install easily multiple time the software.
- mixtieboo 3y ago[dead]
- eptcyka 3y agoTheir Teams uninstaller isn't quite as good - it just doesn't uninstall all the crap that the Teams malware has left behind. I still have a stray MS Teams audio device left on my macOS machine.
- Kuinox 3y agoDid you considered filling a bug report ?
- jurynulifcation 3y agoI actually believe in filing as few bug reports to Microsoft as possible, that way they don't have any signals about what to research. Hopefully it'll waste some amount of their resources, no matter how few.
- eptcyka 3y agoI didn't consider to file a bug report, I sent one.
- deleted 3y ago[deleted]
- snkline 3y agoThe Skype for Business "installer" is too good at removing stuff. Skype for Business stop working, I run "Repair" on the installation, progress bar zips to completion. Skype for Business is now gone. Oh, and so is the rest of Microsoft Office.
- wolfendin 3y agoThis tracks, I’ve flagged the nvidia uninstall for hours work because it code injected and flagged behavioral consistent with malware
- u8_friedrich 3y agoWindows IS an anti-pattern change my mind
- deleted 3y ago[deleted]
- ploum 3y agoAny Microsoft code is indistinguishable from malware
- asmnzxklopqw 3y agoWhy is the stack marked as executable? This is no longer 1995.
- deleted 3y ago[deleted]
- sim7c00 3y agoyou could with anti-exploit techniques (or within windows itself) hook VirtualProtect and such functions to check if its not making the stack executable. Also you could check it on process startup. However, it won't solve much, because then you simply slap it on the executably mapped heap region and do it from there? There are cases for allowing memory protections to be changed, and because of that, it's possible and people use it. (code-generation / JIT etc.) the stack being executable used to be a big problem, for example in 1995 with things like stack overflows running wild, but I think those have been largely mitigated by having things like stack canaries/checks stop stack overflows from being done (stack smashing detected!). those canaries were introduced around 1999 or so, and yes there are ways around it (rops/jops etc.), but not through the simple overflows from 1995. I am all for not allowing it, but admittedly, that's likely some impractical utopian stance on the matter regarding the current use of operating-systems. Perhaps in 2995 :)
- hoseja 3y agoMicrosoft makes Explorer an integral, unremovable, ever-present part of Windows. Raymond Chen gets very upset when people modify it. Smells of hypocrisy to me. Let go of the de-facto Explorer monopoly and you won't have to deal with these types of problems.
- arghwhat 3y agoThis is just a report of terrible and broken hacks, not hypocrisy.
- weinzierl 3y agoOn Windows any sufficiently advanced uninstaller is indistinguishable from malware, but so are many other things on Windows.
- deleted 3y ago[deleted]
- jonplackett 3y agoIf Microsoft just made uninstalling work properly themselves maybe people wouldn’t have to resort to uninstallers in the first place
- deleted 3y ago[deleted]
- pjmlp 3y agoThey did, vendors have to provide a MSI package, or more recently a MSIX package. Now they aren't Apple, in telling developers "use this or get lost".
- INTPenis 3y agoHonest question, how come I can install Steam, Signal, Teams and other "modern" apps on linux without the same issues that Microsoft Windows has? I know RPMs and DEBs follow a fairly strict patter, in that they keep track of everything installed so it can easily be cleaned up. Why can't Microsoft launch its own set of standards that achieve the same goal?
- deleted 3y ago[deleted]
- blackpill0w 3y agoWhy do Windows programs need special installers/uninstallers? Why isn't this handled by Windows itself?
- highwaylights 3y agoI don't think any major desktop OS handles this well. I suspect the final form for software installation is probably where iOS and Android are going in the EU, where there's a single means of installing software to the device so that everything can be sandboxed properly, but the acquisition/update process can be pointed to a URL/Store that the user has pre-approved. macOS comes pretty close to what I'd ideally want in an OS with regards to installation - independent packages that are certified/notarised, but I'd like to see the OS allow for user-specified authorities beyond just Apple. That being said, I'm not sure I'd ever use them as it's part of what I'm paying Apple for, I'm really thinking more of Linux there. A kind of flatpak/snap approach, but that has signing of the package and centralised management of the permissions for the sandbox at an OS level would be ideal in my view. That way it's still free-as-in-speech as the user can specify which notarisation authority to use (or none at all). I really don't understand why seperate programs are handling removing their mother program in 2023, that's registry spaghetti messy.
- tobias3 3y agoYou are basically describing what Windows has as appx/msix. The decentrialized notarization authorities are the code signing certificate providers.
- highwaylights 3y agoI had not seen this, but it absolutely does (on the surface) seem like a solution to this problem. Thanks! I’d need to educate myself a bit more in terms of whether there are third-party authorities beyond Microsoft for the packages. Found this introductory video for anyone else interested: https://www.youtube.com/watch?v=phrD081sMWc https://www.youtube.com/watch?v=phrD081sMWc Note: I didn’t intend the Surface pun above, but it happened and we can all be glad that it did.
- fragmede 3y agoThere was a bug in an uninstaller, once, that deleted all of the files on the disk. Sounds like malware to me!
- grishka 3y agoThere was a bug in some Linux driver installer that accidentally /usr, the whole thing.
- SettembreNero 3y ago"Totally uncool dude!!!"
- ikekkdcjkfke 3y agoWhy does a third party app have rights all files without asking? The Android app rights system integration into linux and windows is way overdue
- TheHappyOddish 3y agoI'm fairly sure Android apps running as root (like this driver installer probably was) will also have access over all files without asking. That's the danger of root.
- grishka 3y agoAndroid apps themselves can't run as root. The apps that do perform operations "as root" do so by spawning a shell process running as root, usually using `su -c`. That's on a rooted device. Normally, all privileged actions are done by system daemons that run with appropriate permissions and that apps communicate with through the "binder" IPC mechanism. Those daemons also handle access control — both the regular Android permissions and the god mode for "system privileged" apps.
- TheHappyOddish 3y ago
- alexvitkov 3y agoThe idiomatic way write an uninstaller 1. Clean up whatever you can in the uninstaller. If you're a decent human being this includes the registry, appdata, temp, and a toggle to delete wherever your app spews its config. The only thing left should be the uninstaller .exe and the directories leading up to it, since Windows doesn't allow you to unlink a exe/dll that's loaded in memory. Your uninstaller should be static linked so it doesn't need to clean up its own .dlls. 2. Figure out how to delete the uninstaller. This can either be some stack smashing butt clenching fuckery, like the guys from the article did or you can be a normal fucking person and just atexit() a batch script in that does SLEEP 5 RMDIR program_dir /whatever /flags /needed The SLEEP is to ensure the uninstaller is closed You can put the batch script in %TEMP% and hope something will clean it up, or if you're feeling extra nice you can set up an action to get it cleaned up at next boot. After that you're also equipped to write self-deleting malware, which is a far more applicable skill.
- elaus 3y agoThat is pretty much the suggested solution at the end of the article. There, the author also removes the temporary script. The solution really isn't that hard, it might just feel a bit "dirty" (using a scripting language to do some work). But all that "stack smashing butt clenching fuckery" surely is much worse and less stable, so I'm not sure why one would even go that way...
- tmpX7dMeXU 3y agoProgramming language elitism.
- quietbritishjim 3y ago> You can put the batch script in %TEMP% and hope something will clean it up, or if you're feeling extra nice you can set up an action to get it cleaned up at next boot. If you can set an action to get something deleted at next boot why not use that to delete your uninstaller itself, rather than adding an extra layer of indirection?
- 3y ago
- unnouinceput 3y agoDoes that means the corollary: "Any sufficiently advanced malware is indistinguishable from an uninstaller" would be true as well? I mean can you write a simulation of an uninstaller to create havoc on target's system and still remain "the good guy, the OS is at fault" type of situation when you write a malware?
- doloputer 3y agoI've heard this before, about cryptolockers. It's hard for the OS to know if you're encrypting all of your files on purpose, because you might actually want to do that.
- omnicognate 3y agoBader-Meinhof phenomenon [1][2] "Any installer that is distinguishable from malware is insufficiently advanced." [1] https://en.m.wikipedia.org/wiki/Frequency_illusion https://en.m.wikipedia.org/wiki/Frequency_illusion [2] https://news.ycombinator.com/item?id=37479407 https://news.ycombinator.com/item?id=37479407
- humanlity 3y agoFight fire with fire
- WesSouza 3y agoI love how it goes from hardcore x86 assembly right into beautiful JavaScript lol.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- Zambyte 3y agoHow do I uninstall Windows?
- marvinblum 3y agohttps://fedoraproject.org/wiki/Migrating_From_Microsoft_Windows https://fedoraproject.org/wiki/Migrating_From_Microsoft_Wind...
- Zambyte 3y agoThat's not uninstalling it though. For example on Fedora I can uninstall Linux with sudo dnf remove linux, or even remove the package manager (arguably what makes Fedora: Fedora) with sudo dnf remove dnf So not quite what I'm looking for :D
- sim7c00 3y agokilldisk->wipe_disk - should allow you to thoroughly purge it ;)
- arrowsmith 3y agoDelete your System32 file.
- hospitalJail 3y agoI'll let someone else figure it out, but after leaving M$ a few months ago, I love linux. Its so fast, no annoying reboots, no annoying Edge. Sure Nvidia is a headache on Linux, but once you solve that, its all fun and games.
- deleted 3y ago[deleted]
- jcarrano 3y agoThe guys at MS are smart enough to decompile assembly but still not enough to have a proper inode-based filesystem where you can delete files that are in use.
- ChrisSD 3y agoIt has little to do with the filesystem. Windows has OS level locks. In the case of a running executable, the mapped memory holds a lock on the exe file to prevent deleting it. This is intentional. If it didn't hold the lock then it would be possible to delete the exe file on modern versions of Windows. Edit: since there still seems to be confusion I'll try to be clearer. On NTFS you can delete an open file. This is a solved problem. The DeleteFile API even does this by default now. The thing that prevents deletion is an OS lock. This lock only prevents deletion. Renames are still allowed.
- crabbone 3y ago[flagged]
- pc86 3y agoThere are some brilliant people at Microsoft. Maybe not in the product end of things, but there are very few brilliant product people anywhere ;)
- crabbone 3y agoObviously I cannot know everyone working for Microsoft. But I do know few people. Also, since I would never work for Microsoft, at the times I spent many years working for the same employer and either wanted to practice interviewing because I thought I might be headed for the door soon, or just to keep things fresh, I'd apply for jobs with Microsoft. And invariably I'd hit the most bonedeaded interviewers I'd ever talk to. Arrogance is common to all interviewers in the tech giants, Microsoft is no exception of course. But in the context of glaring lack of any kind of ability, arrogance hits a lot harder... What also stands out is that programmers working for other companies would typically know something about the platform their company didn't use. Like, if you talk to a person at Google RSE department, they'd still know something about how things are on MacOS or on MS Windows. Microsoft programmers are completely oblivious to anything outside Microsoft. They believe that whatever garbage they came up with is the best thing there is never trying alternatives. But, in rare cases when they do, their knowledge is very distorted and superficial. Here's a real case of someone who worked for Microsoft for about ten years and branded himself a "visual C++ programmer". This guy started about the same time with me in a company which was transitioning from a bunch of Windows tools to Linux. Part of the transition was to move away Perforce and to Git. It was the time when even small companies would self-host Git, and the typical way to do that was to create Linux users on the server hosting Git repo and give programmers SSH access to it. The sysadmin there was new to Linux, but we were kind of friends, especially since I had more Linux experience, so he'd come and chat with me about his job. One evening he comes to me and starts asking about how'd I set up Wine. Intrigued by why he'd need that... soon I discover that the "visual C++ programmer" guy requested that the sysadmin install an FTP client on the server, so that he can access Git repo... and that FTP client has to be some Windows-only junk, and so the sysadmin though that maybe it would run on Wine. It was so many stupid things and of such magnitude all at once... I almost had a spasm laughing. And that's, basically, how my experience with Windows programmers usually went. I never had a moment of "hey, this guy may be OK, not like the others" or anything close. Somehow it was always bizarrely otherworldly comedically stupid.
- Narishma 3y agoThese days Windows itself is becoming indistinguishable from malware.
- hospitalJail 3y agoAt work, I opened a link, despite firefox being my default, it opened in Edge. OneNote also hijacks your filesystem, giving Microsoft full control over it via the internet. Not to mention, many of the windows defaults are impossible to uninstall, and if you figure out how to, it will reinstall. Seriously, Windows has gone full malware/bloatware. I didn't want to, but I switched to Linux. The strange part, despite linux being 'rough', I'm saving a ton of time. Multiple times a week Windows would automatically reboot, causing me to reopen everything(which is slow), figure out what to do with autosaved files, and I might have lost some data. On linux, I don't waste time on these reboots, and can spend those 5-10 minutes solving the 2 issues I ran into. Now those issues are solved and now Linux just works.
- deleted 3y ago[deleted]
- dorianmariefr 3y agoWriting this from my macOS :)
- amelius 3y agoWhy do we still need to install stuff? Why can I run webpages just fine without installing anything? Installation shouldn't exist, at least not from the user's point of view.
- n4r9 3y agoLots of people need to work offline sometimes.
- broast 3y agoI'm not sure if the suggestion is that all work should be online, or if all desktop apps should be portable.
- sh4rks 3y agoA lot of people in the finance world prefer native apps to web apps. It's bizarre.
- a13o 3y agoLoad a sufficiently large and complex spreadsheet in Excel vs Sheets and you'll have your answer. Sheets will freeze and Excel will open in seconds. There's also a feature gap that Google will probably never close, because why bother if you can't load the volume of data those power users are working with in the first place.
- mratsim 3y agoAren't Excel sheets still limited to 1M rows or so?
- hospitalJail 3y agoMy company doesnt let data leave the premises. It makes for some painful moments, but the data is worth tens of billions of dollars.
- gear54rus 3y ago
- marcodiego 3y agoUninstaller should not exist. Installers should not exist either. Every OS should have a package manager. The name clearly implies what it does: it manages packages; this task should be left to a specialized software, not to the user. Linux distros were pioneers in this aspect and "stores" of the modern world are just a clothed versions of package managers. of course, a power user should should have the right to change software sources (repositories). It should be possible to add decentralized package managers like it is possible with flatpack. Installers and uninstallers are a relic of a time were most software people used were proprietary running under a proprietary environment. Many windows users are still locked in that proprietary closed world. If "Any sufficiently advanced uninstaller is indistinguishable from malware", I'd say that most (all?) microsoft software comes with extremely advanced uninstallers.
- threatofrain 3y agoI find that Linux software culture also leaves stuff behind and leaves it up to the assumed system mastery of the user to clean things up.
- koiueo 3y agoThat's too broad and misleading. Package manager tracks every single file installed by a package, preventing overwrites by other packages. Strict permissions prohibit software from littering all over the place. What are you taking about? Do you want package manager to remove yourb personal data of it was created by an application your decided to remove?
- deleted 3y ago[deleted]
- kroltan 3y agoMaybe I do! Many Windows custom uninstallers have an option to remove "settings" while uninstalling. I sure have lots of junk in ~/.config I don't use anymore and probably never will.
- 3y ago
- sim7c00 3y agoThe author says the binary looks like malware because it self-deletes, sleeps and touches this uninstaller thing. But the script he proposes, which would be triggered by this same thing, does the same. I am ignoring the injection thing since he guesses at it (likely correct) and also because, lots of things inject into processes without being malware. (monitoring stuff like AV etc.) Additionally, binaries which terminate with a run some script via a scripthost... this could just as well be some malware? (stage1 malware downloads script, runs it via scripthost?) my question(s): How is the proposed solution better than the original thing? Isn't this a case of using bad heuristics to determine maliciousness? In the end, he goes a bit further, and sees its non-malicious. So, with a more elaborate rule or heuristic, wouldn't it be clear its not malicious?
- PcChip 3y ago>How is the proposed solution better than the original thing? I'm only assuming here, but maybe because it won't crash explorer and it's just a few lines of self-documenting code?
- sim7c00 3y agoHaha, well fair enough the crash is bad indeed, good point! This isn't intended behavior though and presumably, it doesn't crash on in cases of this technique being implemented in uninstallers. (a bit of a guess i admit!)
- ChrisSD 3y agoThe fact it injects into another process means they can't know if it'll crash or not. You're just one Explorer update away from things changing enough for the hack to crash it. I guess they could do this more robustly. I.e pause the entire explorer process, save all its state, remotely allocate new memory to inject their code, remotely create a new thread, run only that thread using the injected code, restore all the process' state and finally start it running where it left off. A script would be easier though.
- 3y ago
- drbig 3y agoI still long for the approach many software used on the AmigaOS - the app is a folder, the folder has the main exec and any assets it needs (libraries, images, etc.) and documentation and... That's it. Install? Copy the directory to where you like. Uninstall? Delete the directory. And if you wish you could keep any files used/generated with such an app in the same folder, making it 100% self-contained. I remember being rather grossed out when I learnt Windows has "a registry" (that was a long time ago). "Why would you have a global registry? Whatever preferences a piece of software has they should live where the exe is". (and yes, I am aware AmigaOS had an installer and dir structure not that unlike of Unix, with `sys:`, `devs:` and so on)
- deleted 3y ago[deleted]
- robinsonb5 3y agoI still love most aspects of the Amiga user experience, but a lot of Amiga applications would need libraries installed to Libs: and deleting the application's "drawer" would leave those libraries behind. (Having said that, by default libs: is assigned to sys:libs but you could assign extra targets, so that libraries would be sought from application-specific directories.) Also, it suffers from the same problem as Windows here, in that you can't delete a file or directory which is currently open. The executable itself wouldn't be open after launch is complete (with the possible exception of overlay executables, but they were pretty rare) but the directory would be locked for as long as it was the program's current directory. If a subdirectory with app-specific libraries was assigned to Libs: that would also prevent deletion.
- realslimjd 3y agoThis is how a lot of apps on MacOS still work.
- justusthane 3y agoSort of. They still leave garbage behind in ~/Library though.
- 3y ago
- RajT88 3y agoAllow me to name drop the single worst uninstaller I have ever seen: Doxillion Document Converter by NCH software. It has been 4+ years, and I am still manually cleaning up stuff it left behind on my machine. Do not use anything by this company, unless you intend to reimage after.
- deleted 3y ago[deleted]
- darklycan51 3y agoI had an old hacky community program basically ruin my Windows install so I agree, it was a BLP viewer it automatically added previews on windows explorer, but if yo u removed a file while previewing a blp it'd crash your explorer and all your open tabs would close, really annoying.
- alerighi 3y agoWell I like the "workaround" that Microsoft proposes for a limitation of Windows that shouldn't really be to this day. UNIX resolved this decades ago: the filename is just a link to a structure on disk. You can delete a file even if it's used, since the file is there but you only delete the reference (filename pointing to the inode) that it has. Programs that have the file open can continue using it. When the file is no longer open by any programs the reference count is checked: if it's zero it means that the file can be safely deleted. Not a difficult thing to implement, since they did it in the 70s... still Widnows doesn't get it.
- frankchn 3y agoIsn't that what the second line in the JavaScript snippet does: delete itself while the script is still in use (i.e. running?) In any case, I am not sure the Unix way is the best API design here. Sure, it does help in these scenarios, but now you can have hidden files lying around in the filesystem being used that I can't easily tell are even there.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- sjsdaiuasgdia 3y agoThere's pros and cons both ways, it's an implementation decision. Under Linux, I have occasionally had the challenge of figuring out what process is holding open a large file that has been 'deleted'. This starts with recognizing that you're getting disparate values from different tools you might use to look at disk utilization. It's confusing as hell the first time you run into it without some established context as to why that might happen. On deletion of a file that is open by another process, Linux does not warn me about that. Windows will give me a clear error message that the file is open by another process. Linux chooses to let the problem sit because it might just take care of itself once the process ends, but that decision kinda sucks when your disk is full and you're scrambling to get some space back. Windows forces me to deal with the conflict right now. That adds work in some cases while avoiding the confusion and risk factors of multiple perspectives about a volume's utilization. It's not "Widnows (sic) doesn't get it". Windows made different choices. As another comment expressed, Windows has all it needs to do this at the FS layer, but chooses to use OS locks on top of that.
- tgtweak 3y agoDropping wscripts is a good way to get malware profiled too, and no way to code sign it or verify it's integrity before executing.
- javajosh 3y agoIf your program creates the script and executes it, is verification necessary? This would be like verifying your 1st party scripts in a webpage that you wrote. It won't really hurt anything, but I'm not sure there's a point.
- intrasight 3y agoI think much grief would have been avoided if microprocessor architectures, from the get-go, had separated data and instruction.
- jdeaton 3y agoThat would be less fun though
- readyplayernull 3y agoReminds me of a simple app I made for Windows 95/98 to add every directory including System32 to the uninstallers' lists. No AV, neither Norton or McAfee, saw that timebomb comming. Good times.
- tgma 3y agoAll sufficiently advanced programs are indistinguishable from malware by sufficiently dumb malware detectors.
- deleted 3y ago[deleted]
- sim- 3y agoImagine if Windows just allowed DeleteFile() even if the file was open, like unlink() on almost any other OS...
- nikanj 3y agoImagine all the "WinBLOWZ is bullshit, I deleted 200 gigs of shit and my C: still has no more free space" posts if Windows started doing soft deletes
- ChrisSD 3y agoIt does. But this issue arises because of file locks. Running an executable holds a lock that prevents deletions (but not renames). Many OSes have file locks, though they often don't use them as liberally as Windows.
- fennecfoxy 3y agoWell maybe if Windows applications were packaged similar to MacOS (one of the few things I like) with the application data and user data for the application in 2 folders then it wouldn't be such an issue. Most Windows apps sit under program files, some sit directly on drive root. But all spray configuration/user data files for themselves all over the damn place, requiring unique uninstallers. MS, build app install/uninstall into Windows directly...