5 ms·

Company offers unofficial security patches for Windows 10 until 2030

74 points by tgol 2y ago

silisili 2y ago
I'm guessing 0Patch doesn't have access to source - does anyone know what method they're using to provide said patches?
- conception 2y ago
  They do in memory patching. Most folks think it’s as dicey as it sounds.
  - deleted 2y ago
    [deleted]
  - StressedDev 2y ago
    Thank you for pointing this out. I doubt that their patches always (or even frequently) fix the underlying security issue. It is a lot harder to patch something when you don't have access to the source code, and to a test team which can verify the fix.
  - tripplyons 2y ago
    They also say their patches use only consist of a few instructions. I hope that is enough to cover all possible system configurations.
- constantlm 2y ago
  Just whip out W32DASM like in the old days.
  - userbinator 2y ago
    Ghidra is very popular now.
- thayne 2y ago
  It probably involves some level of reverse engineering. Which last I checked violates the windows license. Regardless of my feelings on whether such reverse engineering should be legal (I think it should), this line of business seems like it is inviting a lawsuit from MS, unless they have some kind of agreement with MS (which is possible).
  - toomuchtodo 2y ago
    It’s possible reverse engineering is potentially fair use if Microsoft is no longer offering security patches, although a court case would be the ultimate test. I’d be willing to donate a payment to the EFF for an attorney opinion on the topic to add to my citation (their FAQ) to cover the professional time expense. https://www.eff.org/issues/coders/reverse-engineering-faq https://www.eff.org/issues/coders/reverse-engineering-faq
    - userbinator 2y ago
      RE has always been "fair use" since the very early days. Look at the books and other work published by Andrew Schulman, Matt Pietrek, Mark Russinovich, etc. AFAIK no one has gotten unwanted legal attention from MS from it (and look at what happened to that last person...), and it's only when you want to be a competitor, like ReactOS/WINE, that they start paying attention. Also notable is that Ilfak Guilfanov (IDA author) published a free patch for the infamous WMF RCE before MS did.
      - toomuchtodo 2y ago
        I’m simply erring on the side of caution. Everyone has a plan until they’re punched in the face.
  - RachelF 2y ago
    Ironic, because MS are now saying that anything on the Internet can be used to train AI, and their ISO's are available. Perhaps using AI in the process of making these patches will make it OK ;-)
bongodongobob 2y ago
Guarantee that's going to void your support contract with MS if you have one (or worse). I also cant imagine any win 10 software not working on 11. It's not that different under the hood. You've also had plenty of time to test with your vendors. And yes, legacy niche software blah blah, been there done that, but win 10 -> 11 isn't like XP -> vista. It's like win 10 to 10.5. Terrible idea on a number of levels. Best of luck to anyone who tries it.
- TylerE 2y ago
  The problem with Windows 11 is that you have to run Windows 11.
  - bongodongobob 2y ago
    Which most businesses have to use. The idea that medium to large businesses even have the option to drop the MS suite is laughable.
    - Alupis 2y ago
      Except Big Business is exactly the type that does drop the MS Suite. Using Microsoft products becomes a liability on a certain level. It's SMB's that are stuck with MS products... If you think about it, most of us just tolerate Microsoft products. They're often not amazing to use (Teams, Sharepoint, etc), but we put up with them because they're mostly sufficient and/or you just already know how to deal with the warts. That's not a glowing review of MS stuff. GSuite (or whatever they call it these days) is popular with many smaller companies and startups because they don't need traditional locally-installed office apps.
      - bongodongobob 2y ago
        This is 100% backwards. Big business loves MS, they don't tolerate it. It's one simple ecosystem that every sysadmin and IT helpdesk person knows. Let's consider a 1000 person org with 5 offices. Here's their stack: 1 (or 2) DC's at each site Active directory with 30 OU's and 100 security groups A datacenter A dozen LAN file shares with spaghetti permissions 1000 workstations (with paid licenses) 1000 email accounts (with paid licenses) 25 Sharepoint sites 100 Teams 20 Shared mailboxes 30 Distribution groups 100 GPO's defining server and workstation behavior/logon scripts/etc AAD controlling user licensing, SSO, auth, dynamic groups, one way sync to local AD 7+ years of M365 and server backups (prob in the 100TB+ range) 40 TB of active data across the org 15 Hardware servers 50 Windows server VMs 20 Windows 10/11 VMs 15 Different industry specific softwares that REQUIRE Windows Switches/routers/firewalls/VPNs using LDAP to auth Dozens of automations using email/sharepoint/PowerApps/Flow/ToDo And 40 years of inertia. Tell the CTO/CIO that you think they should move to Linux and Gsuite and find open source programs to replace literally everything they do. Tell them they need to retrain their entire IT staff. They also need to redo every single workflow and SOP they have. You'll never be taken seriously again if you don't immediately start laughing and say "Just kidding, that would be insane!". That's not even a "big" business. I don't mean to be rude but you have no idea what you're talking about.
RedCardRef 2y ago
If anyone is exploring options, Windows 10 IoT LTSC has official support till 2032. Added benefit is that it doesnt come with preloaded bloatware from MS. I have recently installed W11 IoT LTSC on a 3rd gen Intel, the TPM requirement in this version is optional.
- bluish29 2y ago
  The problem with LTSC is that it is very hard/impossible to get it legally as an individual. You can do it in unofficial way but that has its own problems.
  - toast0 2y ago
    It's not that hard. Give CDW a call. You'll need to setup a volume licensing agreement, which means buying at least 5 licenses, but there's some $10 licenses you won't use if you need filler. Also, this is an upgrade license, you need an underlying windows license on each PC to upgrade it. Too much $ for me, I'm just using home/pro. https://www.cdw.com/product/windows-enterprise-ltsc-upgrade-license-1-device/3800620 https://www.cdw.com/product/windows-enterprise-ltsc-upgrade-...
    - nerdbaggy 2y ago
      That is a different product. LSTC != IoT LSTC, it is so confusing. To get the IoT you have to sign lots of contracts, Microsoft sends you stickers to put on each stuff, stuff like that.
- lousken 2y ago
  did you manage to obtain a second hand key?
  - RedCardRef 2y ago
    massgrave[dot]dev The activation scripts are open source and available on github. I personally take the HWID route, which you only need to do it once and the license persists between disk wipes and clean reinstalls.
userbinator 2y ago
I suspect as people start realising that the majority of these security patches are for bugs in things they never wanted nor needed on their system[1] or outside their threat model and thus present only to make their lives worse, thirdparty services like these will become more popular. Especially when they see what Win11 has become. There have long been communities providing unofficial contributions (including drivers for newer hardware) for MS OSes going back to DOS, and their existence has always seemed to puzzle the FOSS advocates. [1]https://news.ycombinator.com/item?id=28449607 https://news.ycombinator.com/item?id=28449607
- StressedDev 2y ago
  "Especially when they see what Win11 has become." Windows 11 works great. In fact, it works as well as Windows 10, Windows 7, etc. One thing I always find amusing is people are constantly claiming the latest version of windows is "bad", and the last version of Windows is soooo much better. This has been happening at least since Windows XP was released.
  - userbinator 2y ago
    Tried moving the taskbar, getting it to show more than uninformative icons, or getting rid of all the fucking adverts and other hostility? Or anything else from this list, for that matter: https://en.wikipedia.org/wiki/List_of_features_removed_in_Windows_11 https://en.wikipedia.org/wiki/List_of_features_removed_in_Wi... This has been happening at least since Windows XP was released. Because that's when Peak Windows was for a lot of people. ... but looking at your previous comments, it's clear what I'm arguing against.
  - _imnothere 2y ago
    > Windows 11 works great Sorry, what? It's unstable, it's slow, how is that great? > people are constantly claiming the latest version of windows is "bad" Never heard that when Windows 7 or any other version older than Vista is the latest version of Windows tbh.
  - rpgwaiter 2y ago
    Windows 11 has so much bloatware, ads, unwanted ai “features”, constant resetting of defaults, and forced use of an MS account that I reinstalled win10 a few months ago. Very happy with my decision (as happy as one can be with Windows). I am missing absolutely nothing from the latest windows. I can’t say the general performance is much different between the two, but the rest of the complaints hold true
StressedDev 2y ago
I suspect that these patches frequently do not fix the security bug. Basically, if you care about security, you should use software supported by the vender, or open-source team which produces the software.
- userbinator 2y ago
  Stop spreading FUD.
  - saltymug76 2y ago
    I don't think he's spreading FUD. It's a lot of trust you're placing in a 3rd party who doesn't have the source code to patch your system. Independent reviews and A B testing would help sway a lot of people, IMO.
    - userbinator 2y ago
      Source code isn't necessary. How do you think the security researchers find them vulnerabilities? They can fix them the same way too.
      - Starman80 2y ago
        You can find vulnerabilities using a variety of techniques, but to properly patch them you do need access to the source code. These "updates" don't even modify the executables, so would have to be applied every time you turned on your P.C.
        userbinator 2y ago
        Wrong. Look at the other comment I made here about Ilfak Guilfanov.
      - Vilian 2y ago
        urr durr just programm in assembly
boring-alterego 2y ago
A strategy that was used in my industry to address obsolescence like this was to embrace whitelisting software and a least function mentality.
Yawrehto 2y ago
As a Windows 10 user who hates the idea of installing Windows 11 and its AI and Microsoft-Edge bullshit, I like the idea, but what I'm worried about is the existence of a free and paid tier. What if the company (which seems to be for-profit) starts pressuring users to upgrade to the paid tier by limiting what sorts of updates they provide, e.g., only doing the 'most important' ones, leaving users who can't afford to pay in the lurch?

74 points by tgol 2y ago

silisili 2y ago

I'm guessing 0Patch doesn't have access to source - does anyone know what method they're using to provide said patches?

conception 2y ago
They do in memory patching. Most folks think it’s as dicey as it sounds.
- deleted 2y ago
  [deleted]
- StressedDev 2y ago
  Thank you for pointing this out. I doubt that their patches always (or even frequently) fix the underlying security issue. It is a lot harder to patch something when you don't have access to the source code, and to a test team which can verify the fix.
- tripplyons 2y ago
  They also say their patches use only consist of a few instructions. I hope that is enough to cover all possible system configurations.
constantlm 2y ago
Just whip out W32DASM like in the old days.
- userbinator 2y ago
  Ghidra is very popular now.
thayne 2y ago
It probably involves some level of reverse engineering. Which last I checked violates the windows license. Regardless of my feelings on whether such reverse engineering should be legal (I think it should), this line of business seems like it is inviting a lawsuit from MS, unless they have some kind of agreement with MS (which is possible).
- toomuchtodo 2y ago
  It’s possible reverse engineering is potentially fair use if Microsoft is no longer offering security patches, although a court case would be the ultimate test. I’d be willing to donate a payment to the EFF for an attorney opinion on the topic to add to my citation (their FAQ) to cover the professional time expense. https://www.eff.org/issues/coders/reverse-engineering-faq https://www.eff.org/issues/coders/reverse-engineering-faq
  - userbinator 2y ago
    RE has always been "fair use" since the very early days. Look at the books and other work published by Andrew Schulman, Matt Pietrek, Mark Russinovich, etc. AFAIK no one has gotten unwanted legal attention from MS from it (and look at what happened to that last person...), and it's only when you want to be a competitor, like ReactOS/WINE, that they start paying attention. Also notable is that Ilfak Guilfanov (IDA author) published a free patch for the infamous WMF RCE before MS did.
    - toomuchtodo 2y ago
      I’m simply erring on the side of caution. Everyone has a plan until they’re punched in the face.
- RachelF 2y ago
  Ironic, because MS are now saying that anything on the Internet can be used to train AI, and their ISO's are available. Perhaps using AI in the process of making these patches will make it OK ;-)

bongodongobob 2y ago

Guarantee that's going to void your support contract with MS if you have one (or worse). I also cant imagine any win 10 software not working on 11. It's not that different under the hood. You've also had plenty of time to test with your vendors. And yes, legacy niche software blah blah, been there done that, but win 10 -> 11 isn't like XP -> vista. It's like win 10 to 10.5. Terrible idea on a number of levels. Best of luck to anyone who tries it.

TylerE 2y ago
The problem with Windows 11 is that you have to run Windows 11.
- bongodongobob 2y ago
  Which most businesses have to use. The idea that medium to large businesses even have the option to drop the MS suite is laughable.
  - Alupis 2y ago
    Except Big Business is exactly the type that does drop the MS Suite. Using Microsoft products becomes a liability on a certain level. It's SMB's that are stuck with MS products... If you think about it, most of us just tolerate Microsoft products. They're often not amazing to use (Teams, Sharepoint, etc), but we put up with them because they're mostly sufficient and/or you just already know how to deal with the warts. That's not a glowing review of MS stuff. GSuite (or whatever they call it these days) is popular with many smaller companies and startups because they don't need traditional locally-installed office apps.
    - bongodongobob 2y ago
      This is 100% backwards. Big business loves MS, they don't tolerate it. It's one simple ecosystem that every sysadmin and IT helpdesk person knows. Let's consider a 1000 person org with 5 offices. Here's their stack: 1 (or 2) DC's at each site Active directory with 30 OU's and 100 security groups A datacenter A dozen LAN file shares with spaghetti permissions 1000 workstations (with paid licenses) 1000 email accounts (with paid licenses) 25 Sharepoint sites 100 Teams 20 Shared mailboxes 30 Distribution groups 100 GPO's defining server and workstation behavior/logon scripts/etc AAD controlling user licensing, SSO, auth, dynamic groups, one way sync to local AD 7+ years of M365 and server backups (prob in the 100TB+ range) 40 TB of active data across the org 15 Hardware servers 50 Windows server VMs 20 Windows 10/11 VMs 15 Different industry specific softwares that REQUIRE Windows Switches/routers/firewalls/VPNs using LDAP to auth Dozens of automations using email/sharepoint/PowerApps/Flow/ToDo And 40 years of inertia. Tell the CTO/CIO that you think they should move to Linux and Gsuite and find open source programs to replace literally everything they do. Tell them they need to retrain their entire IT staff. They also need to redo every single workflow and SOP they have. You'll never be taken seriously again if you don't immediately start laughing and say "Just kidding, that would be insane!". That's not even a "big" business. I don't mean to be rude but you have no idea what you're talking about.

RedCardRef 2y ago

If anyone is exploring options, Windows 10 IoT LTSC has official support till 2032. Added benefit is that it doesnt come with preloaded bloatware from MS. I have recently installed W11 IoT LTSC on a 3rd gen Intel, the TPM requirement in this version is optional.

bluish29 2y ago
The problem with LTSC is that it is very hard/impossible to get it legally as an individual. You can do it in unofficial way but that has its own problems.
- toast0 2y ago
  It's not that hard. Give CDW a call. You'll need to setup a volume licensing agreement, which means buying at least 5 licenses, but there's some $10 licenses you won't use if you need filler. Also, this is an upgrade license, you need an underlying windows license on each PC to upgrade it. Too much $ for me, I'm just using home/pro. https://www.cdw.com/product/windows-enterprise-ltsc-upgrade-license-1-device/3800620 https://www.cdw.com/product/windows-enterprise-ltsc-upgrade-...
  - nerdbaggy 2y ago
    That is a different product. LSTC != IoT LSTC, it is so confusing. To get the IoT you have to sign lots of contracts, Microsoft sends you stickers to put on each stuff, stuff like that.
lousken 2y ago
did you manage to obtain a second hand key?
- RedCardRef 2y ago
  massgrave[dot]dev The activation scripts are open source and available on github. I personally take the HWID route, which you only need to do it once and the license persists between disk wipes and clean reinstalls.

userbinator 2y ago

I suspect as people start realising that the majority of these security patches are for bugs in things they never wanted nor needed on their system[1] or outside their threat model and thus present only to make their lives worse, thirdparty services like these will become more popular. Especially when they see what Win11 has become. There have long been communities providing unofficial contributions (including drivers for newer hardware) for MS OSes going back to DOS, and their existence has always seemed to puzzle the FOSS advocates. [1]https://news.ycombinator.com/item?id=28449607 https://news.ycombinator.com/item?id=28449607

StressedDev 2y ago
"Especially when they see what Win11 has become." Windows 11 works great. In fact, it works as well as Windows 10, Windows 7, etc. One thing I always find amusing is people are constantly claiming the latest version of windows is "bad", and the last version of Windows is soooo much better. This has been happening at least since Windows XP was released.
- userbinator 2y ago
  Tried moving the taskbar, getting it to show more than uninformative icons, or getting rid of all the fucking adverts and other hostility? Or anything else from this list, for that matter: https://en.wikipedia.org/wiki/List_of_features_removed_in_Windows_11 https://en.wikipedia.org/wiki/List_of_features_removed_in_Wi... This has been happening at least since Windows XP was released. Because that's when Peak Windows was for a lot of people. ... but looking at your previous comments, it's clear what I'm arguing against.
- _imnothere 2y ago
  > Windows 11 works great Sorry, what? It's unstable, it's slow, how is that great? > people are constantly claiming the latest version of windows is "bad" Never heard that when Windows 7 or any other version older than Vista is the latest version of Windows tbh.
- rpgwaiter 2y ago
  Windows 11 has so much bloatware, ads, unwanted ai “features”, constant resetting of defaults, and forced use of an MS account that I reinstalled win10 a few months ago. Very happy with my decision (as happy as one can be with Windows). I am missing absolutely nothing from the latest windows. I can’t say the general performance is much different between the two, but the rest of the complaints hold true

StressedDev 2y ago

I suspect that these patches frequently do not fix the security bug. Basically, if you care about security, you should use software supported by the vender, or open-source team which produces the software.

userbinator 2y ago
Stop spreading FUD.
- saltymug76 2y ago
  I don't think he's spreading FUD. It's a lot of trust you're placing in a 3rd party who doesn't have the source code to patch your system. Independent reviews and A B testing would help sway a lot of people, IMO.
  - userbinator 2y ago
    Source code isn't necessary. How do you think the security researchers find them vulnerabilities? They can fix them the same way too.
    - Starman80 2y ago
      You can find vulnerabilities using a variety of techniques, but to properly patch them you do need access to the source code. These "updates" don't even modify the executables, so would have to be applied every time you turned on your P.C.
      - userbinator 2y ago
        Wrong. Look at the other comment I made here about Ilfak Guilfanov.
    - Vilian 2y ago
      urr durr just programm in assembly

boring-alterego 2y ago

A strategy that was used in my industry to address obsolescence like this was to embrace whitelisting software and a least function mentality.

Yawrehto 2y ago

As a Windows 10 user who hates the idea of installing Windows 11 and its AI and Microsoft-Edge bullshit, I like the idea, but what I'm worried about is the existence of a free and paid tier. What if the company (which seems to be for-profit) starts pressuring users to upgrade to the paid tier by limiting what sorts of updates they provide, e.g., only doing the 'most important' ones, leaving users who can't afford to pay in the lurch?