8 ms·

If this is true (and frankly I know for a fact it is, as I just downloaded the linked file containing Disable_Windowsupdate.exe, which is signed by Samsung Elec

If this is true (and frankly I know for a fact it is, as I just downloaded the linked file containing Disable_Windowsupdate.exe, which is signed by Samsung Electronics CO and downloaded from Samsung's own servers) then Microsoft should pick up the phone and threaten the heck out of Samsung, Microsoft while somewhat neutered by anti-trust still has a great deal of power over OEMs and stuff like this is a perfect time to [ab]use it.

tantalor 11y ago
Yet, Microsoft is responsible for allowing such software to run in the background with no notification or authorization by the user or means to disable it.
- monochromatic 11y ago
  Yes, it's almost as if executable code is... executable.
  - orestisfl 11y ago
    intel's fault for developing x86
- pilif 11y ago
  It's really hard to find the correct middle-ground. Would you prefer if Windows worked like iOS where there are serious limitations on what apps can do in the background and where every application has to go through a central authority for vetting? Or do you propose a solution that gives both freedom to the user while also not allowing something like this to happen? Yes, there are whitelisting solutions (built into the OS by MS, btw), but they are a real pain in the ass to use - there's just too much stuff running on your machine at any given time.
  - ninkendo 11y ago
    > Would you prefer if Windows worked like iOS where there are serious limitations on what apps can do in the background and where every application has to go through a central authority for vetting? I've thought about this for a while, and honestly, for desktops/notebooks/tablets? Yes. Maybe not just one App Store like iOS, but at least sandbox all possible non-os code similarly to ChromeOS, in a way that's on by default and requires a boot-time flag to disable (and users should be allowed to do this, but OEMs shouldn't.) Recently my dad bought a new $300 toshiba laptop because his old machine was just "slow", as in he had so much spyware on his computer that it was easier to just buy a new one than going through the hassle of cleaning up his old one. Even though his old laptop was perfectly good and of a recent hardware generation. I'm 100% positive he's going to have the same issues on his new laptop, and his response was that he uses his iPad so much that it doesn't matter anyway. The role of the modern day OS has changed immensely over the years. Nowadays there's simply no reason for legitimate applications to have the level of access to the underlying system that they used to have. Apps really don't need arbitrary filesystem access. They don't need to be able to overwrite core system files. They should be run in a sandbox or a container with as restricted of a set of permissions as possible. For servers and development workstations the story is a little bit different, but those are exceptions to the rule, and with the proper release hatches like boot-time enabling of un-sandboxed code it's a good tradeoff IMO.
    - geon 11y ago
      I like the way OS X handles it. Unsigned software won't run by default, but the user can override the limitation.
      - daemin 11y ago
        Yes, you can do this on Windows too, but the problem is this update disabler executable was signed, so it would have run anyway.
        reacweb 11y ago
        There are two problems: how on earth samsung may have the idea to produce this kind of software and who is signing software without giving a look at what he is signing. A problem of software development mentality (on windows) and a problem of responsability.
  - developer1 11y ago
    Or you know, place the ability to disable Windows Update behind policy restrictions and UAC rather than being openly editable in the registry? With policy restrictions, corporate installations could deny all attempts to disable the service. In non-corporate environments, this should at least require a UAC prompt. While too many users would likely click through without understanding, at least knowledgeable users would understand and be able to deny the change. Windows Update is a serious security requirement for any Windows install. Disabling it should clearly require explicit consent from the user.
    - pilif 11y ago
      Changing the windows update policy requires admin rights and UAC prompting. The Samsung installer would also run as admin (either started from a service running as admin and deployed by the samsung initial image, or by the user allowing UAC when launching the samsung installer), so it can change the registry.
      - developer1 11y ago
        True. To be more specific: while UAC is great for requiring admin privileges, it would be nice if UAC prompts would enumerate the permissions being asked for. The prompt should be asking you if you wish to allow the program to disable Windows Update as opposed to "admin privileges to do anything whatsoever with your operating system". That said, it's a difficult system to implement properly. Android went that route, and it almost works - almost. Android's available permissions are too plentiful, and yet certain permissions are too broad in scope. I wouldn't want a desktop application to have to ask for separate privileges for every little piece of functionality, but for certain critical actions it would be nice to have some clue as to what is going on. Perhaps in another 20 years someone will finally invent a privilege escalation system that somehow manages to be both very specific and yet not time consuming for the customer to manage. What a dream. :)
  - pjc50 11y ago
    In the early days of multi-user OS security, applications were trusted because they were installed by the admin and users were untrusted. Today, we have systems which are mostly single-user, but where the applications are incredibly untrustworthy. Hence the popularity of jails and app-store systems. You can't easily retrofit this on Windows because there is very little security between windows running on the same desktop, but what I think we'll end up with is each application having its own SID and a default-restricted view of the user profile. But in this case it's a hostile OEM, and there really isn't much that can be done in software against that.
    - pjmlp 11y ago
      This is the direction with app containers in WinRT model.
- zamalek 11y ago
  > means to disable it. 1. Right click on the taskbar. 2. Click "Startup". 3. Disable what you want. 4. Click "Services" 5. Disable what you want. This omits "Scheduled Tasks" (cron jobs) which can be set to execute on user logon. This is the single one that Microsoft still need to address. Does whichever operating system you are comparing to Windows have a one-top-shop for the vast majority of startup configuration? Of the "big 4" (Mac, Linux, BSD, Windows) as far as I know this is a unique feature. Proof-of-point: I have a copy of Linux, without telling you what the distro is, tell me how to disable the firewall (just an example of background software on most Linux distros). > no notification or authorization Does that operating system of yours do this? Which of the "big 4" do? I know that Linux and BSD don't. > Microsoft is responsible for allowing such software to run in the background So Microsoft is responsible for everything every Microsoft-stack developer on earth does? Does that mean that RMS is responsible for closed source software because some of it is made with GCC?
  - chc 11y ago
    > Proof-of-point: I have a copy of Linux, without telling you what the distro is, tell me how to disable the firewall (just an example of background software on most Linux distros). This isn't comparing operating systems to operating systems. "Linux" could refer to a number of operating systems, such as Yellow Dog, Ubuntu and Fire OS. The Microsoft version of this question would be more like: "I have a copy of a Microsoft OS. Without telling you what version it is, tell me how to disable the firewall."
- serge2k 11y ago
  If they didn't they would probably get sued and bashed on HN for promoting walled gardens and abusing OEMs. Google has a similar problem with Android. They solved it by having anyone who wants to include Google services to fall into line. Apple goes to extremes on iOS to prevent things like this.
crdoconnor 11y ago
Honestly, as a Linux user this kind of makes me chuckle. Microsoft has spent so much time abusing their market dominance, trying to cripple linux on the desktop that it's kind of funny for once to see a company which they can't strong-arm doing the same thing back to them.
- electic 11y ago
  Let the past be the past. The new MS is making some good moves. However, this is not MS's fault. When you operate in an OEM type environment, you will run into situations like this. For example, if OSX was an OEM offering, companies would disable services and make unsavory modifications. The reality, is like Lenovo, we have a bad vendor here and probably think twice before buying PCs from Samsung.
  - crdoconnor 11y ago
    Their new PR line is they've changed and they are sorry, but they have certainly NOT changed and they are NOT sorry: http://techrights.org/2015/05/29/microsoft-vs-india/ http://techrights.org/2015/05/29/microsoft-vs-india/ Their recent "good moves" (open sourcing .NET, etc.) are simply an attempt to maintain relevance in the face of declining market share. If it results in regained market-share, they will likely bait and switch, and of course, they might as well get some good PR out of it.
    - Aloha 11y ago
      First, why would you expect Microsoft to not lobby against laws that prevent it from effectively competing? Second, Why is Microsoft lobbying for non-restrictive purchasing standards bad? It's very clear to me that this has little to do with weather the competition is FOSS - and more to do if the competition can only be indian made software. Buy $country First laws have long been recognized as anti-competitive, protectionist and generally a cause of increasing acquisition costs. FOSS of more often then not superior on its merits alone, why does it need a protectionist anti-competitive law to help it compete?
na85 11y ago
Ultimately it's just another item on the long long list of why anyone should not buy Microsoft and Samsung products. Samsung's terrible engineers coupled with a proprietary OS means users lose.
- mariusmg 11y ago
  Yes, it's clearly Microsoft's fault here. Geez.....

tantalor 11y ago

Yet, Microsoft is responsible for allowing such software to run in the background with no notification or authorization by the user or means to disable it.

monochromatic 11y ago
Yes, it's almost as if executable code is... executable.
- orestisfl 11y ago
  intel's fault for developing x86
pilif 11y ago
It's really hard to find the correct middle-ground. Would you prefer if Windows worked like iOS where there are serious limitations on what apps can do in the background and where every application has to go through a central authority for vetting? Or do you propose a solution that gives both freedom to the user while also not allowing something like this to happen? Yes, there are whitelisting solutions (built into the OS by MS, btw), but they are a real pain in the ass to use - there's just too much stuff running on your machine at any given time.
- ninkendo 11y ago
  > Would you prefer if Windows worked like iOS where there are serious limitations on what apps can do in the background and where every application has to go through a central authority for vetting? I've thought about this for a while, and honestly, for desktops/notebooks/tablets? Yes. Maybe not just one App Store like iOS, but at least sandbox all possible non-os code similarly to ChromeOS, in a way that's on by default and requires a boot-time flag to disable (and users should be allowed to do this, but OEMs shouldn't.) Recently my dad bought a new $300 toshiba laptop because his old machine was just "slow", as in he had so much spyware on his computer that it was easier to just buy a new one than going through the hassle of cleaning up his old one. Even though his old laptop was perfectly good and of a recent hardware generation. I'm 100% positive he's going to have the same issues on his new laptop, and his response was that he uses his iPad so much that it doesn't matter anyway. The role of the modern day OS has changed immensely over the years. Nowadays there's simply no reason for legitimate applications to have the level of access to the underlying system that they used to have. Apps really don't need arbitrary filesystem access. They don't need to be able to overwrite core system files. They should be run in a sandbox or a container with as restricted of a set of permissions as possible. For servers and development workstations the story is a little bit different, but those are exceptions to the rule, and with the proper release hatches like boot-time enabling of un-sandboxed code it's a good tradeoff IMO.
  - geon 11y ago
    I like the way OS X handles it. Unsigned software won't run by default, but the user can override the limitation.
    - daemin 11y ago
      Yes, you can do this on Windows too, but the problem is this update disabler executable was signed, so it would have run anyway.
      - reacweb 11y ago
        There are two problems: how on earth samsung may have the idea to produce this kind of software and who is signing software without giving a look at what he is signing. A problem of software development mentality (on windows) and a problem of responsability.
- developer1 11y ago
  Or you know, place the ability to disable Windows Update behind policy restrictions and UAC rather than being openly editable in the registry? With policy restrictions, corporate installations could deny all attempts to disable the service. In non-corporate environments, this should at least require a UAC prompt. While too many users would likely click through without understanding, at least knowledgeable users would understand and be able to deny the change. Windows Update is a serious security requirement for any Windows install. Disabling it should clearly require explicit consent from the user.
  - pilif 11y ago
    Changing the windows update policy requires admin rights and UAC prompting. The Samsung installer would also run as admin (either started from a service running as admin and deployed by the samsung initial image, or by the user allowing UAC when launching the samsung installer), so it can change the registry.
    - developer1 11y ago
      True. To be more specific: while UAC is great for requiring admin privileges, it would be nice if UAC prompts would enumerate the permissions being asked for. The prompt should be asking you if you wish to allow the program to disable Windows Update as opposed to "admin privileges to do anything whatsoever with your operating system". That said, it's a difficult system to implement properly. Android went that route, and it almost works - almost. Android's available permissions are too plentiful, and yet certain permissions are too broad in scope. I wouldn't want a desktop application to have to ask for separate privileges for every little piece of functionality, but for certain critical actions it would be nice to have some clue as to what is going on. Perhaps in another 20 years someone will finally invent a privilege escalation system that somehow manages to be both very specific and yet not time consuming for the customer to manage. What a dream. :)
- pjc50 11y ago
  In the early days of multi-user OS security, applications were trusted because they were installed by the admin and users were untrusted. Today, we have systems which are mostly single-user, but where the applications are incredibly untrustworthy. Hence the popularity of jails and app-store systems. You can't easily retrofit this on Windows because there is very little security between windows running on the same desktop, but what I think we'll end up with is each application having its own SID and a default-restricted view of the user profile. But in this case it's a hostile OEM, and there really isn't much that can be done in software against that.
  - pjmlp 11y ago
    This is the direction with app containers in WinRT model.
zamalek 11y ago
> means to disable it. 1. Right click on the taskbar. 2. Click "Startup". 3. Disable what you want. 4. Click "Services" 5. Disable what you want. This omits "Scheduled Tasks" (cron jobs) which can be set to execute on user logon. This is the single one that Microsoft still need to address. Does whichever operating system you are comparing to Windows have a one-top-shop for the vast majority of startup configuration? Of the "big 4" (Mac, Linux, BSD, Windows) as far as I know this is a unique feature. Proof-of-point: I have a copy of Linux, without telling you what the distro is, tell me how to disable the firewall (just an example of background software on most Linux distros). > no notification or authorization Does that operating system of yours do this? Which of the "big 4" do? I know that Linux and BSD don't. > Microsoft is responsible for allowing such software to run in the background So Microsoft is responsible for everything every Microsoft-stack developer on earth does? Does that mean that RMS is responsible for closed source software because some of it is made with GCC?
- chc 11y ago
  > Proof-of-point: I have a copy of Linux, without telling you what the distro is, tell me how to disable the firewall (just an example of background software on most Linux distros). This isn't comparing operating systems to operating systems. "Linux" could refer to a number of operating systems, such as Yellow Dog, Ubuntu and Fire OS. The Microsoft version of this question would be more like: "I have a copy of a Microsoft OS. Without telling you what version it is, tell me how to disable the firewall."
serge2k 11y ago
If they didn't they would probably get sued and bashed on HN for promoting walled gardens and abusing OEMs. Google has a similar problem with Android. They solved it by having anyone who wants to include Google services to fall into line. Apple goes to extremes on iOS to prevent things like this.

crdoconnor 11y ago

Honestly, as a Linux user this kind of makes me chuckle. Microsoft has spent so much time abusing their market dominance, trying to cripple linux on the desktop that it's kind of funny for once to see a company which they can't strong-arm doing the same thing back to them.

electic 11y ago
Let the past be the past. The new MS is making some good moves. However, this is not MS's fault. When you operate in an OEM type environment, you will run into situations like this. For example, if OSX was an OEM offering, companies would disable services and make unsavory modifications. The reality, is like Lenovo, we have a bad vendor here and probably think twice before buying PCs from Samsung.
- crdoconnor 11y ago
  Their new PR line is they've changed and they are sorry, but they have certainly NOT changed and they are NOT sorry: http://techrights.org/2015/05/29/microsoft-vs-india/ http://techrights.org/2015/05/29/microsoft-vs-india/ Their recent "good moves" (open sourcing .NET, etc.) are simply an attempt to maintain relevance in the face of declining market share. If it results in regained market-share, they will likely bait and switch, and of course, they might as well get some good PR out of it.
  - Aloha 11y ago
    First, why would you expect Microsoft to not lobby against laws that prevent it from effectively competing? Second, Why is Microsoft lobbying for non-restrictive purchasing standards bad? It's very clear to me that this has little to do with weather the competition is FOSS - and more to do if the competition can only be indian made software. Buy $country First laws have long been recognized as anti-competitive, protectionist and generally a cause of increasing acquisition costs. FOSS of more often then not superior on its merits alone, why does it need a protectionist anti-competitive law to help it compete?

na85 11y ago

Ultimately it's just another item on the long long list of why anyone should not buy Microsoft and Samsung products. Samsung's terrible engineers coupled with a proprietary OS means users lose.

mariusmg 11y ago
Yes, it's clearly Microsoft's fault here. Geez.....