5 ms·

Good point re. Windows’s default configuration being less secure due to file extensions being hidden. This is another manifestation of the continuous tax paid f

Good point re. Windows’s default configuration being less secure due to file extensions being hidden. This is another manifestation of the continuous tax paid for Windows’s insane level of backward compatibility. I think the root cause is that Microsoft thinks files ending in .EXE are ugly (but they don’t want to stop using this convention, which I don’t think is strictly required by the kernel or filesystem, but would probably break other things in the OS and 3rd party tools), so they hide that and all other file extensions (which maybe they also think are ugly, but I don’t see an alternative since files with multiple data streams are not handled well for interchange). Not sure why the default isn’t just to hide the extension of executable files, though I think this is more trouble than it is worth, for the reasons demonstrated by this attack. I would also consider disabling USB ports in air-gapped systems. You can still buy PS/2 keyboards and mice. Server and maybe some workstation motherboards still have PS/2 ports (and there are PS/2 PCI cards). For sneakernet file transfer you can allow use of an SD card. That way, if you see a USB cable or other device in an air-gapped environment, it should be an immediate red flag.

hulitu 2y ago
> This is another manifestation of the continuous tax paid for Windows’s insane level of backward compatibility Well, no. This bulshit was introduced later by Microsoft to make Windows more "user friendly". In the same line like truncating URLs in briwser bars by Google and Mozilla.
zahlman 2y ago
>This is another manifestation of the continuous tax paid for Windows’s insane level of backward compatibility. I think the root cause is that Microsoft thinks files ending in .EXE are ugly (but they don’t want to stop using this convention, which I don’t think is strictly required by the kernel or filesystem, but would probably break other things in the OS and 3rd party tools), so they hide that I don't think they're think the extension is "ugly". I think they expect their users to think that way, on average, and don't want to deal with being told such (or getting support requests because ignorant users tried to remove that part of the filename and now can't open Word or whatever). I wouldn't call it the result of backwards compatibility, either - although Windows' level of backwards compatibility is insane and does impose a continuous tax. But in the current case, there would need to be a new system for inferring executability before we could talk about removing the existing one. AFAIK Windows uses file headers to determine the format of an executable file (i.e. how to load it), but not to decide whether a given file should be deemed executable at all. And the attrib bits, also AFAIK, don't include anything for execution either. >I would also consider disabling USB ports in air-gapped systems. I assume they aren't worried about "BadUSB" type attacks because they're in control of the physical media used for transfer.
- Arch-TK 2y ago
  > or getting support requests because ignorant users tried to remove that part of the filename and now can't open Word or whatever Funny side story, windows pops an error confirmation message if you change or remove the extension of a file name as part of a rename operation. There's no way to disable this message outside of writing an autohotkey script to check for the prompt and auto-accept it. (I did this once, no I don't have the AHK script, but I don't recall it being hard to write.) On on a similar funny side note, there's no way to tell windows to always open files with no extension in a specified application (e.g. gvim). But you can edit the registry to do it.
  - hulitu 2y ago
    > Funny side story, > On on a similar funny side note, Those things are only funny if you don't have to use this "Operating System" hours a day. Because then it becomes a PITA.
    - zahlman 2y ago
      Having to deal with other people using it is far more obnoxious than actually personally using it, IMX. For sophisticated users it's not hard to learn these details, and then one naturally just doesn't hit the pitfalls. Teaching the details to someone less sophisticated, and making them stick, is a whole other ball game.
mcculley 2y ago
But a lot of the systems that are air-gapped are controlling some other piece of hardware, increasingly by USB.

hulitu 2y ago

> This is another manifestation of the continuous tax paid for Windows’s insane level of backward compatibility Well, no. This bulshit was introduced later by Microsoft to make Windows more "user friendly". In the same line like truncating URLs in briwser bars by Google and Mozilla.

zahlman 2y ago

>This is another manifestation of the continuous tax paid for Windows’s insane level of backward compatibility. I think the root cause is that Microsoft thinks files ending in .EXE are ugly (but they don’t want to stop using this convention, which I don’t think is strictly required by the kernel or filesystem, but would probably break other things in the OS and 3rd party tools), so they hide that I don't think they're think the extension is "ugly". I think they expect their users to think that way, on average, and don't want to deal with being told such (or getting support requests because ignorant users tried to remove that part of the filename and now can't open Word or whatever). I wouldn't call it the result of backwards compatibility, either - although Windows' level of backwards compatibility is insane and does impose a continuous tax. But in the current case, there would need to be a new system for inferring executability before we could talk about removing the existing one. AFAIK Windows uses file headers to determine the format of an executable file (i.e. how to load it), but not to decide whether a given file should be deemed executable at all. And the attrib bits, also AFAIK, don't include anything for execution either. >I would also consider disabling USB ports in air-gapped systems. I assume they aren't worried about "BadUSB" type attacks because they're in control of the physical media used for transfer.

Arch-TK 2y ago
> or getting support requests because ignorant users tried to remove that part of the filename and now can't open Word or whatever Funny side story, windows pops an error confirmation message if you change or remove the extension of a file name as part of a rename operation. There's no way to disable this message outside of writing an autohotkey script to check for the prompt and auto-accept it. (I did this once, no I don't have the AHK script, but I don't recall it being hard to write.) On on a similar funny side note, there's no way to tell windows to always open files with no extension in a specified application (e.g. gvim). But you can edit the registry to do it.
- hulitu 2y ago
  > Funny side story, > On on a similar funny side note, Those things are only funny if you don't have to use this "Operating System" hours a day. Because then it becomes a PITA.
  - zahlman 2y ago
    Having to deal with other people using it is far more obnoxious than actually personally using it, IMX. For sophisticated users it's not hard to learn these details, and then one naturally just doesn't hit the pitfalls. Teaching the details to someone less sophisticated, and making them stick, is a whole other ball game.

mcculley 2y ago

But a lot of the systems that are air-gapped are controlling some other piece of hardware, increasingly by USB.