4 ms·

https://www.vice.com/en/article/m7bv4b/windows-for-gamers-rolls-dice-with-your-security-atlasos https://www.vice.com/en/article/m7bv4b/windows-for-gamers-ro...

https://www.vice.com/en/article/m7bv4b/windows-for-gamers-rolls-dice-with-your-security-atlasos https://www.vice.com/en/article/m7bv4b/windows-for-gamers-ro... >An operating system marketed to gamers disables a host of Windows security features enticing users with promises of a smooth gaming experience which they may not realize is opening them up to potential attack.

minkles 2y ago
Most of the virtualization based security measures it disables are, well, described here nicely: https://xkcd.com/1200/ https://xkcd.com/1200/
- acdha 2y ago
  You might want to read the article more carefully. Disabling Defender is a real risk, and the virtualization-based security is used by things like Credential Guard precisely to _prevent_ the problem in that xkcd cartoon. It’s not perfect but when you have a billion PC users each risk mitigation can be preventing a lot of people from having a very bad day.
  - minkles 2y ago
    I think you miss the point. Literally all the documents and information I need to protect are not protected by credential guard or virtualisation based security.
    - acdha 2y ago
      You probably do care about your saved credentials and application secrets, CNG keys, and passkeys, though, and VBS can protect those. I appreciate the humor in xkcd but a cartoon over a decade old is not an accurate depiction of the current state of the art, and while Microsoft may not have gotten as far as Apple has (backwards compatibility for the enterprise is a tar pit) it’s not like the security engineers didn’t laugh bitterly at that when it came out and decide to do better.
  - gruez 2y ago
    AFAIK Credential Guard only protects enterprise login details (think kerberos tickets or NTLM hashes). I don't think any browser or password manager uses it.
    - acdha 2y ago
      It can also protect application domain secrets and CNG private keys, and it looks like they are starting to use it for Windows Hello, too: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security https://learn.microsoft.com/en-us/windows-hardware/design/de... It’s definitely a work in progress but I mostly found it disappointing when someone uses a comic from 2013 to argue against the kind of tools which have been getting built in the subsequent decade to prevent those kinds of failures. I wish we’d go further sooner but at least we’ve broken the assumption many people had in the 2000s that there was nothing you could do about it.
      - gruez 2y ago
        >but I mostly found it disappointing when someone uses a comic from 2013 to argue against the kind of tools which have been getting built in the subsequent decade to prevent those kinds of failures Practically speaking everything in the comic is still correct. The fundamental problem is that apps aren't sandboxed from each other, so once a malicious program gets on the machine it's game over. VBS tries to protect specific parts of the system, but without app sandboxing it's useless. For instance even if you use VBS to protect a service that can encrypt/decrypt on behalf of apps, all of that's useless when the system can't be assured which app is asking to decrypt the secrets. Even in the case of windows hello, I'm not sure what VBS is trying to protect. If a malicious program is running on your system, it doesn't need to bypass the lock screen. I guess it's better for privacy because your biometrics are more protected, but it can always control the camera to capture a fresh set of images next time you sit in front of it.
        acdha 2y ago
        > Practically speaking everything in the comic is still correct. The fundamental problem is that apps aren't sandboxed from each other, so once a malicious program gets on the machine it's game over. On Windows, perhaps. On Apple and some Linux configurations, it hasn’t been correct for years because they implement app level sandboxing. Windows Sandbox, App Containers, etc. show that the Windows team isn’t ignoring that even though their backwards compatibility problem is much harder. > For instance even if you use VBS to protect a service that can encrypt/decrypt on behalf of apps, all of that's useless when the system can't be assured which app is asking to decrypt the secrets. There’s no technical reason why it can’t verify the app - indeed Chrome just started to do this to prevent infostealers from grabbing cookies – but also note that it’s still an advantage if malware can’t get the private key because that’s protected by VBS. Things like what password managers have done for years to require a handshake or rate-limit help to shift from the attacker getting everything effortlessly to only getting some things they specifically request or the first n things they try.
Sysreq2 2y ago
Look, I am not going to install it on my machine and I think a business would be insane to allow it on their servers, but I can also recognize that I am not exactly their market. If I want 10% more performance I can make that happen using my AMEX. I read this and I think “14 year old with a hand me down who wants to be epic” and I can respect that. I remember being a kid and wanting just a little more out of my machine to run the latest and greatest.
scrlk 2y ago
So AltasOS is the 2024 equivalent of Windows XP Gold Edition? Granted, it does appear to have a nicer theme. https://crustywindo.ws/Gold_Windows_XP_2016 https://crustywindo.ws/Gold_Windows_XP_2016
- deleted 2y ago
  [deleted]
- gruez 2y ago
  Not really. Atlas contains a bunch of non-visual windows tweaks that so far as I can tell windows xp gold edition doesn't have. The only two they have in common is that they're both modded versions of windows.
  - scrlk 2y ago
    That's true. My comment was made in jest at both being questionable Windows mods. The privacy tweaks (changing GPO policies to disable telemetry) have some merit, but IME "performance tweaking" Windows is in placebo territory. I went through that phase in my teen years when trying to squeeze more performance out of a Athlon 64 box so that I could play Team Fortress 2 at a reasonable frame rate... :^)

minkles 2y ago

Most of the virtualization based security measures it disables are, well, described here nicely: https://xkcd.com/1200/ https://xkcd.com/1200/

acdha 2y ago
You might want to read the article more carefully. Disabling Defender is a real risk, and the virtualization-based security is used by things like Credential Guard precisely to _prevent_ the problem in that xkcd cartoon. It’s not perfect but when you have a billion PC users each risk mitigation can be preventing a lot of people from having a very bad day.
- minkles 2y ago
  I think you miss the point. Literally all the documents and information I need to protect are not protected by credential guard or virtualisation based security.
  - acdha 2y ago
    You probably do care about your saved credentials and application secrets, CNG keys, and passkeys, though, and VBS can protect those. I appreciate the humor in xkcd but a cartoon over a decade old is not an accurate depiction of the current state of the art, and while Microsoft may not have gotten as far as Apple has (backwards compatibility for the enterprise is a tar pit) it’s not like the security engineers didn’t laugh bitterly at that when it came out and decide to do better.
- gruez 2y ago
  AFAIK Credential Guard only protects enterprise login details (think kerberos tickets or NTLM hashes). I don't think any browser or password manager uses it.
  - acdha 2y ago
    It can also protect application domain secrets and CNG private keys, and it looks like they are starting to use it for Windows Hello, too: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security https://learn.microsoft.com/en-us/windows-hardware/design/de... It’s definitely a work in progress but I mostly found it disappointing when someone uses a comic from 2013 to argue against the kind of tools which have been getting built in the subsequent decade to prevent those kinds of failures. I wish we’d go further sooner but at least we’ve broken the assumption many people had in the 2000s that there was nothing you could do about it.
    - gruez 2y ago
      >but I mostly found it disappointing when someone uses a comic from 2013 to argue against the kind of tools which have been getting built in the subsequent decade to prevent those kinds of failures Practically speaking everything in the comic is still correct. The fundamental problem is that apps aren't sandboxed from each other, so once a malicious program gets on the machine it's game over. VBS tries to protect specific parts of the system, but without app sandboxing it's useless. For instance even if you use VBS to protect a service that can encrypt/decrypt on behalf of apps, all of that's useless when the system can't be assured which app is asking to decrypt the secrets. Even in the case of windows hello, I'm not sure what VBS is trying to protect. If a malicious program is running on your system, it doesn't need to bypass the lock screen. I guess it's better for privacy because your biometrics are more protected, but it can always control the camera to capture a fresh set of images next time you sit in front of it.
      - acdha 2y ago
        > Practically speaking everything in the comic is still correct. The fundamental problem is that apps aren't sandboxed from each other, so once a malicious program gets on the machine it's game over. On Windows, perhaps. On Apple and some Linux configurations, it hasn’t been correct for years because they implement app level sandboxing. Windows Sandbox, App Containers, etc. show that the Windows team isn’t ignoring that even though their backwards compatibility problem is much harder. > For instance even if you use VBS to protect a service that can encrypt/decrypt on behalf of apps, all of that's useless when the system can't be assured which app is asking to decrypt the secrets. There’s no technical reason why it can’t verify the app - indeed Chrome just started to do this to prevent infostealers from grabbing cookies – but also note that it’s still an advantage if malware can’t get the private key because that’s protected by VBS. Things like what password managers have done for years to require a handshake or rate-limit help to shift from the attacker getting everything effortlessly to only getting some things they specifically request or the first n things they try.

Sysreq2 2y ago

Look, I am not going to install it on my machine and I think a business would be insane to allow it on their servers, but I can also recognize that I am not exactly their market. If I want 10% more performance I can make that happen using my AMEX. I read this and I think “14 year old with a hand me down who wants to be epic” and I can respect that. I remember being a kid and wanting just a little more out of my machine to run the latest and greatest.

scrlk 2y ago

So AltasOS is the 2024 equivalent of Windows XP Gold Edition? Granted, it does appear to have a nicer theme. https://crustywindo.ws/Gold_Windows_XP_2016 https://crustywindo.ws/Gold_Windows_XP_2016

deleted 2y ago
[deleted]
gruez 2y ago
Not really. Atlas contains a bunch of non-visual windows tweaks that so far as I can tell windows xp gold edition doesn't have. The only two they have in common is that they're both modded versions of windows.
- scrlk 2y ago
  That's true. My comment was made in jest at both being questionable Windows mods. The privacy tweaks (changing GPO policies to disable telemetry) have some merit, but IME "performance tweaking" Windows is in placebo territory. I went through that phase in my teen years when trying to squeeze more performance out of a Athlon 64 box so that I could play Team Fortress 2 at a reasonable frame rate... :^)