Ug. Running untrusted executables on any platform can be trouble. The problem is that by blaming the platform, people keep putting the onus on these OS's, distros, etc to build walls around carefully curated gardens. Gotta take the good with the bad. Either you accept that people can run untrusted executables or you give up the flexibility to build/use/distribute untrusted executables yourself. Sadly it seems as devs grow into larger companies and prefer the latter, they forget their indie beginnings enabled by the former. "What's $100?" they say. "Getting a cert is easy" they say. "If you aren't building anything dangerous, why do you have a problem with curation?" they say. The same anti-freedom arguments are always there in the name of safety.
If you downloaded untrusted Filezilla and executed it raw on any platform it could be an issue. If users required Filezilla to be distributed in the Windows app store, it could be less of an issue. One could argue the fact that installing Windows software is sometimes still like this is because of the lack of restrictions against it. But as users keep complaining and devs stay silent, all platforms including Windows will continue to reduce liberty in the name of safety and you'll feel better.
Many who have mainly used windows haven't experienced what typical software installation is like on systems like Linux. One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites. That is just not how Linux software is distributed. It doesn't abridge freedom, either - if you want to run I trusted executables, nothing is trying to stop you, either.
Then, if you do have an executable to install from, the installation process is more likely to be one command run in a terminal then a GUI 'wizard' that takes 10 minutes, frequent attention and 20 clicks, and tries to convince/trick you to install a bunch of other software.
> One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites
That's just not true if you want up to date software. I can list a ton of software to the contrary and lots of installing that includes just extracting tarballs, or installing their deb/rpm you download, or if they use the distro package manager, they just have you add their server and cert.
> GUI 'wizard' that takes 10 minutes, frequent attention and 20 clicks
Well if you're just gonna give false impressions with hyperbole, a rational discussion can't be had.
Regardless, the issues with installation are primarily the choice of the devs, not the OS. These days they more look like the installation of Nodejs, Go, PgAdmin, VSCode, etc (i.e. minimal MSI's or just zip extracts) than complicated adware of yore. That this is not clear and you think 10 minute wizards with 20 clicks is normal makes it seem like you are not familiar with the platforms you talk about.
Not in practise. The Linux version of Filezilla will usually be sourced from a package manager:
$ apt show filezilla
Package: filezilla
Version: 3.28.0-1
…
Description: Full-featured graphical FTP/FTPS/SFTP client
A huge portion of the software a typical user requires is available in the standard repository of a Linux distribution. I have one extra Apt repository configured that would be reasonable for a normal user to install: Skype.
They could publish updates to the program, publish new dependencies, or even publish updates to packages you normally get from your main distro repository. If you're doing apt-get update (or equivalent) how closely do you scrutinize the list of changes?
My problem is that I prefer Debian stable, which is very conservative about package updates. But sometimes I end up using Ubuntu, because its repo includes newer packages.
Also, my core systems do not include anything except stable Debian. I only use third-party repos in project-specific VMs. I even use Oracle's MySQL Workbench in an Ubuntu VM. And even Windows 10 VMs, when I need Excel or other Windows-only apps. That is, compartmentalization.
I don't think the comparison of the "wizard" to installing from apt or similar is hyperbole. I'm familiar with the typical Windows apps install process, and I do indeed warrant that that is a realistic comparison. GUI software is more difficult to automate and presents information in a way that's difficult to absorb at a glance, for me.
The 'wizard' does not require a steady 10 minutes of attention, but I don't think 20 clicks is an exaggeration. How many sounds right to you? If you want, I can write an essay contrasting software installation on these platforms because what I wrote sounds right on to me. The fact is that standard procedure to install software on Windows involves clicking "next" over and over again after downloading a binary from some random website.
And this is considerably better than the “this app was downloaded from the internet do you want to open it” message that OSX provides which Windows provides by default also to all files downloaded from the internet.
Well, it shouldn't really be called "bundled". It's more a "drive-by download". What is bundled is only a downloader (so the checksum remains the same). And it offers and downloads what the other party sees more profitable today.
In this sense they really don't know what they bundle.
You think this is bad, you should try the Windows 10 auto updater.
Disclaimer: It's broken on my brand new PC and no helpful on-line fix has worked so far. So I might hold hate in my heart.
It tries to update -- it downloads several GB of patches, reboots and spends about 20 minutes installing -- then it tells me something along the lines of my system being "incompatible" with Windows (I forget the details, it's been a while) and rolls everything back.
Every six months or so I let it try again, in vain hope that the latest version will have fixed the problem. At some point I should get around to doing a clean reinstall, but that means taking the risk that my old Win7 product key would no longer validate.
The worst part is when windows will start ignoring my request to delay updates to the weekend, and will begin restarting my computer during the week whenever I walk away from it for too long.
In Win10 Pro, you can postpone an update for max 35 days (windows update - advanced options - pause updates), but never indefinitely. If a pending update will break your machine (and you know because you already had to uninstall it), there's nothing you can do; it will install in five weeks no matter what. It's a timebomb.
Adding insult to injury is that these are primarily "feature" updates, and the features are for Microsoft's benefit. The April 2018 update enabled "Timeline" in the Task View (Win + Tab). All session activity is now shared with Microsoft by default. It must be disabled in Settings - Security & Privacy - Activity Sharing... so I disable all the new less-privacy things I don't want, and there are a lot of them... a week later, they are all switched on again, without notification or consent, after a subsequent Tuesday update.
And this is the reboot I can't postpone, on the OS I purchased. It's part Heller, part Kafka.
Even better with mine. It rolls the updates back one at a time, rebooting and failing each time then rolling back another in a process which takes several hours to complete
Now the vendors who sell software that doesn't have hidden functionality lose competition to such "free" products monetized with adware, data collection or other shady behaviours. It is easy to see in mobile game market.
#9 Post by botg » 2018-01-05 09:11
The connections are for fetching offers and, if the user
accepts the offer, the offered file. What the file is
for is written in the offer text. The network requests
to fetch offers are done only after the user has agreed
to it by accepting the privacy policy.
#10 Post by TigheW » 2018-01-05 16:55
Sorry man, this isn't "bundled software that people
want" and no amount of repeating it will make it true.
This is a malware downloader bundled with your software
and hosted on your page and you're intentionally
misleading the users who are here directly asking you
if it's safe to run this bundle on their machines. ...
There was a pattern where articles about nasty android apps would always include some idiotic line about "Security experts say do not install apps you don't trust."
Who the hell knows anything about the apps they even trust, for all you know they sold out to malware companies yesterday.... there's no way to know.
Let alone that would also mean you never try any new software...
I HATE that line.
Never any malware on other platforms? Do you not remember Sourceforge?
And let’s not forget that so much Linux software installs these days via curl|sh...
Actually virtually everything is packaged for at least the major linux platforms an exhortation on a web site saying you can install foo via curl |sh can in fact normally be reasonably followed by apt install foo or insert gui/cli package manager of your choice.
When I use curl|sh, I could execute hidden text, e.g. through a Javascript command, which automatically executes the code and then deletes it from my history. At a future date, there is no way for me to know whether something malicious was executed, since the website may remove the malicious code when they get called out.
It would be trivial to integrate a hidden Monero or other coin miner in the source of the main Filezilla program that only runs when the program itself is running. I know I often leave my FTP going overnight for uploading big files (I have really fast downstream but painfully slow upstream) and that's a lot of time for my machine to be surreptitiously mining for someone else. Multiply that by the hundred of thousands if not millions of Filezilla users across all platforms, and you have the potential for a ton of illicitly gained virtual money at your users' expense.
People in glasshouses shouldn’t throw stones...
It doesn't have to be that way, since there is a Windows/Microsoft Store since plenty of years now.
But then you have gamers and game devs spreading FUD about UWP and the the MS Store, while they praise 3rd party platforms like Steam and GoG that actively refuse UWP apps in their store, while allowing Spyware like this.
https://www.reddit.com/r/Steam/comments/8pud8b/psa_red_shell...
Yet, nobody dares to hold those platforms responsible.
https://www.reddit.com/r/Games/comments/8sg294/16_studios_re...
> The long term solution is to get off the platform.
No, the long term solution is to embrace the MS Store, or at the very least modern platforms like WinRT/UWP that would prevent most types of malware attacks.
Why do we still accept the violation of the principle of least privilege in this day and age?
All: Agenda-driven and single-purpose accounts aren't allowed on Hacker News because they're incompatible with the intellectual curiosity this site exists for. Double that when the agenda or single purpose is advancing corporate interests. It doesn't matter what corp it is, btw; the last time we banned an account for doing this it was a different one.
And do you really think someone working for Microsoft would post something like this? https://www.reddit.com/r/Surface/comments/7of68m/surface_pro...
I'm the most vocal about this pen issue, that could potentially cost MS billions of dollars if they need to recall those devices. I once posted a pen issue thread that got banned from /r/Microsoft once. https://www.reddit.com/r/microsoft/comments/82ilso/the_worka...
There is a perpetual hostility towards Windows users on this site, maybe you should address that first.
They also collect information on files that are " part of an app and either have a block in the compatibility database or are part of an anti-virus program.".
How can we trust Microsoft after this?
[1] https://docs.microsoft.com/en-us/windows/privacy/basic-level...
If you're already on Windows 10, at the very least embrace UWP to get some control over your privacy.
This is reasonable. And, at this point it's important to note that the first comment in the chain advocated for moving off the platform.
Giving the party running the store 30% of all revenue is a hard sale to start with.
More importantly it gives MS the position to impose whatever dictates it or even more likely every government in existence the right to impose whatever restrictions they like on any app maker in existence with the threat of instant non existence.
Want a social media platform to ban anyone who disagrees with the king no problem do it or you can't do business. Want your browser to censor whatever your locality wants? No problem if it doesn't it doesn't get distributed. Want your OS to refuse to install apps that don't follow the store rules? No problem its in the governments interests and the companies.
Linux package management works like an app store with an official source and the ability to add whichever sources you choose. A search of available packages shows results giving sources the priority set by the user. Updating the system updates packages from 3rd party sources same as others. The major limitation is the labour required to create packages for all the different platforms users prefer not artificial limits or money paid to the platform "owner".
On windows nothing much is on the store mostly because people don't want to give Microsoft 30% on Linux charging 30% is downright impossible because people would trivially publish an alternative source instead.
Basically your cure is worse than the disease and since Microsoft wont fix the situation in a reasonable fashion so the only solution is to move off their platform.
> On windows nothing much is on the store mostly because people don't want to give Microsoft 30% on Linux charging 30% is downright impossible because people would trivially publish an alternative source instead.
Most package managers on Linux do not provide any sort of revenue stream. The comparison only holds when the software is free, at which point '30%' is $0.
The main exception I'm aware of, the elementaryOS app center, provides a worse deal. Same 70/30 split for $2 charges, but it's 50/50 on a $1 charge.
On that note, Apple now distributes iTunes for Windows through the Microsoft Store.
Very soon it won't be 30% anymore.
https://blogs.windows.com/buildingapps/2018/05/07/a-new-micr...
> Linux package management works like an app store with an official source and the ability to add whichever sources you choose. A search of available packages shows results giving sources the priority set by the user. Updating the system updates packages from 3rd party sources same as others.
There exist 3rd party package repositories on Windows too.
> On windows nothing much is on the store mostly because people don't want to give Microsoft 30%
There is plenty of stuff in the MS Store. https://youtu.be/GCVhmKVRkk0
All my software, except for some dev tools and some games are from the MS Store.
> on Linux charging 30% is downright impossible because people would trivially publish an alternative source instead.
Steam is on Linux and charges 30%.
> Basically your cure is worse than the disease and since Microsoft wont fix the situation in a reasonable fashion so the only solution is to move off their platform.
Microsoft already provided a fix, called UWP.
The MS store does NOT have user configurable repos for consumer versions of windows.
Me: No solution which gives a single party absolute control over what software a user is allowed to run is a long term solution.
I install and update from Chocolatey whenever possible.
Personally I have come to the conclusion that the best solution is virtual machines with a linux base system. Put every game that is sticky to windows into its own little container and just have hardware passed through. That way every form of sticky platform only exist in a small pocket of virtual space. The tricky part is getting all this working as smoothly as if it was just one system that just happen to have really good sandboxing for untrustworthy platforms.
For home users perhaps. Enterprise users are often locked into ERP clients, for instance, that are Windows only.
But the real killer reason enterprises use Windows is Active Directory. Simple GUI SSO and policy based management. For instance I could have a white-list that didn't have this adware on it and could apply it by group-policy...
I don't quite agree, Active Directory is an easy to learn and deploy implementation of LDAP, Kerberos, and DNS (often in combination with CIFS) with a friendly GUI interface. It also adds Group Policy, which is less simple to replicate on Linux. Then it adds a huge pool of admins which have been through the vendor supplied training process. I can show people how to create a user and add them to my company defaults in minutes, and not just because they are familiar with Windows, but because they are familiar with the desktop metaphor
I am a keen Linux user, I am typing this on Linux in fact. We have lots of processes running on Linux in fact. But I cannot replace the ease of AD in Linux. And more than that, our ERP client only runs on Windows...
If you're using Red Hat/Fedora GNOME desktops, you can pair that with Fleet Commander to set up desktop policy: https://fleet-commander.org/
At some point soon, I expect it to work for SUSE and Mageia systems, too.
I currently run this on a Fedora Server setup to pair with some Fedora Workstations I manage.
This is a big plus for locking down mostly untrusted users (eg average employees in a larger enterprise).
Edited to fix stupid autocorrect.
Is there a Windows license available to consumers that allows simultaneous installation on multiple VMs under a non-Windows-based hypervisor?
The question about "how many installations does one license allow" does not seem to be much explored by the courts, so I am not that worried for personal setup like this. One could argue that multiple VM is just technical details for what is in practical terms a single user and a single machine.
This stopped being true from like Windows 7. Please stop spreading FUD.
Just to be clear, at home, I run GNU/Linux, too. But it's not like catching a virus is inevitable fate on Windows.
This is only true if you're careless or technically inept.
> of course the hour(s) of lost productivity per day compared to linux
I don't lose any productivity by using Windows. Not sure where you're getting this from.
>They have decided that tricking people into downloading malware is a reasonable alternative to charging money for their software or soliciting donations.
If you would be so kind enough as to show them how to make money perhaps they'll stop doing it.
>Its truly amazing to me that installing windows software is still like this.
Eh? Which OS platform are you using that does not allow a user to execute binaries?
You CAN install binaries on other platforms but on for example linux distros their is a curated platform of packages where you can get most/all software.
The fact that this is the default way to install software and regular users don't need to look beyond the official repos is why installing software on linux isn't this kind of shit show.
>You CAN install binaries on other platforms but on for example linux distros their is a curated platform of packages where you can get most/all software.
Sure, but things often work better when you pay people upfront rather than get something for free and let them fend for themselves. In the case of Linux packaging, there is no mechanism for monetization or advertising, so the point doesn't come up.
>The fact that this is the default way to install software and regular users don't need to look beyond the official repos is why installing software on linux isn't this kind of shit show.
I'd use Linux if it had the software that I want to use. So a bit of apples-oranges here...
Whoah, for a second I thought this was 1999.
Yes, Linux won the server side, it is hard to fight against free beer.
Now getting desktop software companies to invest in such market is another story.
Yes, it is indeed proven that when you pay people to develop software, it works great. (Linux, FF, Chrome, Photoshop, Windows, etc, etc). The license doesn't seem to make much of a difference.
When you don't - (your typical freeware on download.com) - they have to figure out a revenue stream after the fact, and the choices they end up making cause them to be on the front page of HN where people line up to call them "scum".
Obviously this is not about hobbyist/part-time developers with a github repo, who are already getting paid through an external job, etc.
Just to point out, there are commercial versions of Linux (Red Hat, SUSE Linux, likely others). Both with workstation and server variants.
Only for some other unscrupulous company to replace them? Ideally, the most profitable method should be ethical by nature, unlike the current situation in software (and games, of course) where the most profitable methods are among the least ethical.
I don’t get why microsoft isn’t pushing all these vendors really hard to distribute through the windows store. The windows store is a graveyard compared to the mac app store, despite having a head start and a bigger target audience, and it’s basically impossible to use windows without sideloading apps. Microsoft is pushing windows S at people, where you can’t sideload software, but the windows store just isn’t ready for that and all it will do is push people to the mac when they inevitably have a bad experience.
No, that is a false statement.
> I'm not going to tell someone how they should make their living
Be consistent. Don't tell apple how to make their living.
I didn't.
https://blogs.windows.com/buildingapps/2018/05/07/a-new-micr...
A fully descriptive answer is that they don't have a checksum for the bundled package but botg doesn't want to say this.
" Dangerously ignorant user. Not matching filename = the checksum is NOT for that file. Checksums can only be provided for the non-bundled packages, because they're static. Bundled installers are not."
Dangerously ignorant person here what they are actually saying is that they have no way on earth to be sure what's even IN the bundled packages nor what it will do to the users computer.
They have decided that tricking people into downloading malware is a reasonable alternative to charging money for their software or soliciting donations.
Its truly amazing to me that installing windows software is still like this.
The obvious and immediate solution is to abandon vendors who behave like this. This is challenging because you have to track the reputation of each individual vendor and users have proven unable to even consistently download the software from the right page let alone judge individuals vendors track record.
The long term solution is to get off the platform.