Can you or anyone else help resolve this?

1 - https://nim-lang.org

2 - https://forum.nim-lang.org/t/7885

3 - https://forum.nim-lang.org/t/8196#53855

Think that Microsoft could do better with its false-positive review process, particularly doing something more for open-source developers and projects.

As long as you guys are not going the route of google's approach to messaging, I'm sure we will forgive you. Nor the route of an NFC pay/wallet/money app that...

You know what? Just don't do the thing where you launch products to consumers so that someone achieves a promotion internally, and then abandon the product.

Frankly, MS has a long history of backwards compatibility, so signs are already positive.

Anything being worked on the IO performance side of Defender? I’m still using a paid third party AV for this sole reason. The impact is so huge with NPM packages as an example…

Microsoft really needs to make this easier to turn off too. Right now, I have to use an undisclosed privilege escalation hack-around to force things my way.

Perhaps one ought to have live scanning enabled when updating packages, then disabled when not.

I look forward to seeing other replies.

What we really need is the ability to disable real-time scanning on one set of folders/extensions, while still including them with scheduled system-wide scans.

https://docs.microsoft.com/en-us/powershell/module/defender/...

https://docs.microsoft.com/en-us/powershell/module/defender/...

Or, even just run said folders as a custom scan!

`Start-MpScan -ScanType CustomScan -ScanPath PATH\TO\FOLDER-FILES`

Would you mind naming it? AFAIK most third party anti-malware solutions act like rootkits, possibly introducing new attack vectors, or have become basically ad-ware and malware themselves trying yo bait you in various subscriptions.

All AV somehow have to hook into low level system calls so can’t really avoid the kernel driver. Nonetheless, nod32 has been an install and forget AV with no interruption nor bait/nag screen at all. It’s a no bullshit AV and it does well.

I supposedly get the same protection as Defender (according to various AV tests review) and most importantly I get the IO performance back.

While I don’t doubt this true for Windows, on macOS Apple is phasing out kernel modules with APIs that allow software to hook into those low level calls without actually running in the kernel. For AV vendors there’s the Endpoint Security System Extension: https://developer.apple.com/documentation/endpointsecurity

All the AV/endpoint security solutions I’ve seen have switched to this.

It overall seems like a more complex solution that has more chances of being wrong. I would bet the core reason Apple did it was control to lock down their own control of your OS, not any security reason. Perhaps it also simplifies their development somewhat, if they can rid of some stability guarantees for some in-kernel APIs that AV would have needed.

I don't know much about the Endpoint Security extension, but for Apple's network filtering extension they actually DO address this!

The code that runs on every network call is heavily sandboxed and can't communicate at all with the outside. Its only action is emitting some basic signal like "block" or "accept". This means that while the system extension can evaluate all your network communication, and block what it chooses, it can't exfiltrate the specific content. I might have the details wrong, but that's the general intention.

But the security benefits aside, I think the real reason for preventing code from running in the kernel is about stability and not security. Buggy code won't crash the system anymore. They can also enforce stricter performance requirements.

(And at the moment, you can still run kernel extensions on your own system if you really want by disabling SIP and other things, it's just infeasible for any AV vendor to have their customers step through that very onerous process.)

McAfee is by far the worst offender IMO when it comes to file IO. We eventually dropped it in part to it's insistence on locking files in App Data which is a common scratch space for almost every Windows App.

These facts together mean that it should be really rare that any application needs to be waiting for any scanning - since scanning can happen anytime between a data write and a read of the same data.

Something like ZFS where hashing is baked into the cost of the FS operation could optimise this.

I know this because I did a bunch of reading on the topic after encountering catastrophic halts inside of CloseHandle, deep inside the kernel. And even with administrator privileges I could not kill the process, or the attached debugger, and the machine was unable to shutdown because even it could not kill the stuck process. I had to hard power cycle to get back to a usable system. Near as I can tell this was because of the AV product the company was using that crashed or deadlocked or something.

Note this product was not Windows Defender.

https://www.bleepingcomputer.com/news/microsoft/malicious-np...

I don't want to minimize that, but I do want to (gently, good-naturedly) say that I think it's kinda funny.

As someone who once worked at a big tech company I think it's totally hilarious how telling people "I work on X product at Y company" totally evokes this sort of response. Tell enough people where you work and you'll see some non-zero percentage of people respond like this.

Like, when I was talking with a mover who was unloading my stuff and he asked "So, what brings to you these parts?" and I told him his first response was "Really? Y'know, I've got that software and it doesn't work for me under these very specific conditions. Why is that?" (At the time I think I mumbled something about "I don't know". In retrospect I was moving to start work there so I realistically couldn't have known yet).

So - I hope you get your problem sorted out, thank you for giving me the opportunity to talk about this, and I think I'm gonna go chase some kids off my lawn now :)

"Sure I can look at that, bring it into the shop, we're open eight to five Monday through Friday, eight to two on Saturday, and open until eight PM on Wednesday and Thursday, but only for drop off, pick up, and tire changes."

In all cases there are workarounds - I'm not using the Windows version (I'm on a mac) but when I had a performance issue it ended up being a script that created and deleted thousands of files quickly and tweaking it was fairly simple.

PS: And that function makes sense for "the public" don't you think?

Thats an awfully low standard to set don't you think?

I don't think it makes sense for the public. Stealing files from unsuspecting users without as much as a popup saying "hey, we just snatched this file without you knowing this is even a possibility" is just sad.

EDIT: i just realized you are being ironic

Im saying dubiously authorized because I bet no more than 5 out of a 100 windows users are aware this is even happening...

https://en.wikipedia.org/wiki/NSAKEY

So no, this is not proof. At this point the lack of proof is near proof no backdoor existed.

At the risk of sounding tin hatty, not true. (In)Famy doesn't equal success or money, anyone attempting to post state secrets without the help of another state is probably not hard to intercept and buy off...

Anyways, there doesn't need to be proof - a (forced) system update straight from the source (Microsoft), targeted to your machine, is all it takes to make all security redundant, and there are enough publicly known phone home systems in Windows that we don't really need to prove they don't already dragnet.

I'll grant you, subverting corporate sec is a bit harder, but usually boils down to a bit of carfully targeted infil, put the right exceptions in the right corporate solutions, and corp security is also nill.

Recently I looked at M365 business premium and thought that would only include Defender for O365 (why not M365?) and require a separate subscription for Defender for Endpoint, but now it looks like Defender for Business is included.

From reading the article everything "sounded right" but that's hardly an educated opinion since I only worked on _some_ parts of the product.

Actually - I think I'll ask our red team or security guid - that's also probably a good source.

It is absolutely embarrassing and horrible. A bad, unusable system.

Fortunately I replaced all Windows machines with actual operating systems, so I do not have to use that ugly joke system too much.

But bloody please add an option to turn off hunting for "hack tools". As an advanced user, SMB admin and private programmer I use NirSoft tools and also keygens for my own apps but Windows vigorously deletes NirSoft (and perhaps some SysInternals also, but I'm not sure) tools and every keygen it would notice. So I have to disable it. It has even deleted qBitTorrent once although it is a perfectly legitimate app and I use it to download legal things like Linux distros and legitimately purchased Humble Bundle stuff.

Why can't I [with reasonable ease] configure it to only watch for real viruses/spyware/ransomware which really threatens to infect the PC?

In my opinion we even have to consider actual pirates using really illegal keygens because this simple fact: there are many of such in mediocrely developed countries, they get confused, disable the protection, get infected and join the botnets. Even when there is a criminal we dislike to support and want to punish, we don't want them to get infected with anything and spread the infection further.

There should be clear distinction between unquestionable malware everyone wants and needs to be protected from for everyone's good vs questionable apps some people (justifiably or not) actually want to use for sake of their pragmatic interest.

A state level attacker can likely acquire 0-day exploits that are not patched and bypass defenses.

Microsoft's offering does some really cool stuff like:

- Automatically detecting anomalous behavior in the network and isolating suspected devices/ips/machines/programs.

- Have real time security engineers constantly monitoring your network and hunting attackers and suspicious activity.

- Tools that automatically isolate possible attackers and help measure the impact of attacks.

> Can we trust Microsoft to be neutral and offer security patches in a timely manner

Yes, that for sure. Once an exploit is discovered it is typically very quickly identified. A lot of the times security patches don't come from Microsoft though - if you consider something like Log4Shell (the Log4J vulnerability) for example.

> defend the interests of their consumer customers above all?

I'm... not sure about "above all" since I am not sure what "all" is but if the implication is that Microsoft won't patch a security flaw for a state level APT then "yes". At least - if it ever happened it happened _way_ above my pay grade and if employees would learn of it there would be outrage.

> With the whole conflict in Europe, the issue of state level adversaries is raring its head again.

I think state level actors have consistently been a problem.

Note again as already mentioned none of this represents the opinion of my employer, just my thoughts.

cough NSAKEY cough

Provided a backdoor for state security forces. Did it in NT, and then even after they were caught, did it again in Win2k.

You underestimate people's moral flexibility, especially that of "patriots."

I'm sure on enterprise systems MS is pretty hands off. They've got a very stable cash cow there they don't want to scare away, but home users are probably screwed and you should expect that. MS has been making their opinion of their user's right to privacy and to control what their own computer very clear over the years. They've repeatedly demonstrated a willingness to leverage their OS against the users and their wishes for power and profit. Act accordingly.

Maybe things will be better with windows 11?

The name changes don't hurt anything. I just say Windows comes with AV built in and it does a fine job all on its own.

MS really did well with it.

If you need to point this out, I get the feeling it's not. You are only saying this because a boss told you to do so. Is what I'm feeling from this.

Let's be fair, naming is not a strength of Microsoft. It seems that every product other than Windows and Office is renamed every couple of weeks; and even in those two examples, explosions of SKUs manages to muddle the waters just as well (Apple's "Choose a Vista" was very much on-point, even if you preferred Windows over Mac).

iPhone 10, Galaxy S7, RX470, such product names are significantly easier to keep track of.

Regardless, numbers are easier to work with, easier to remember, and it's immediately apparent what's going on with them. "debootstrap focal target" is more difficult to remember than a hypothetical "debootstrap ubuntu 20.04 target" would be. In practice I have to consult a chart almost every time.

https://en.wikipedia.org/wiki/Debian_version_history

If it wasn't "Monterey" and was just MacOS 12 there would've been no confusion. I feel like it's always an exercise of looking up the code name to find the version whenever someone is like "Yeah, I'm on Big Sur" .... ok one sec, let me google what that even means.

But as someone in the UK random californian landmarks are inpossible to remember.

Numbers are best. Years are fine. Names are... Cute but Impractical.

Everything else is mostly reserved to Windows, including dotnet CLI tooling outcomes like trace and dump files debugging.

For tracing, well that means very different things to different people. One can capture most of the CLR level events that would go through ETW on windows with the `dotnet-trace` tool, which can also function as a primitive sampling profiler. But despite its name it does not use the profiling apis to implement a tracing profiler.

The analysis side of the dotnet-trace tool is subpar, but honestly even the best tools I can find often leave me underwhelmed on the analysis side.

Searching "Github Azure Edition" brings up this page[0]. That's the name of this promo page, and it talks about Github integrations into various Azure products. The very first product it talks about is Azure DevOps. Direct quote:

"Simplify deployment from your repository with seamless access to the Azure portal and Azure DevOps using your GitHub account credentials."

I can confirm that the parent comment you replied to is correct, as I used to work at Microsoft during the time when the renaming from Visual Studio Team Services to Azure DevOps was happening internally. As in, not that I was involved in it, but that we used VSTS, and then we noticed that the name was changing to Azure DevOps everywhere. All while we were still accessing the same service and all as before.

0. https://azure.microsoft.com/en-us/products/github/

Though the parent point still stands valid, as Visual Studio Team Services indeed became Azure DevOps. Github hosted on Azure is just self-hosted Github and has nothing to do with VSTS/Azure DevOps.

An actual name of a product I worked on at Microsoft

…and “Windows” as well.

I’m going to call you out on that. Microsoft lost my trust to act in good faith with personal data when they started capturing my private OS user input (e.g. the history from Windows R (run) and forced me to link it to my personal identity.

Source? Searching for "windows run dialog telemetry" on google turns up this thread https://news.ycombinator.com/item?id=28598474, which has multiple people saying they can't reproduce it, and the author retracting the post: https://news.ycombinator.com/item?id=28608540

It’s also quite easy to observe that when you type anything into the start search interface you are steered or defaulted to searching Microsoft internet services.

1. Okay, but how's that relevant to my original question? Is the history being broken supposed to be smoking gun evidence that windows is sending your "history from Windows R (run)" to microsoft?

2. I just tried and failed[1] to reproduce this on a VM with a fresh install of Windows 10 Enterprise LTSC 2019 with "telemetry disabled". There isn't an universal standard for "telemetry disabled", but at the very least I have the "Allow Telemetry" and various search related group policies activated. I suspect what's happening is that you ran one of those "disable telemetry scripts", and that unintentionally broke it.

[1] https://i.imgur.com/WkbnBlM.png

>It’s also quite easy to observe that when you type anything into the start search interface you are steered or defaulted to searching Microsoft internet services.

but we were talking about the run (windows-R) dialog, not the start menu?

I am 100% certain that’s not the case. — Yes - the point is when setting all the most private privacy options on Windows 10 stops keeping a win+r run history. I didn’t go as far as installing a custom root CA and intercepting binary telemetry data to prove that the data was being sent. I think the fact that the MRU list is disabled strongly suggests that the product team assumed or new that it was collected.

If your experience is based on LTSC Windows/Office you probably have a different experience.

If they are doing a keystroke logger (ie, capturing typed private user data) where are they logging this keystroke log too? Or is the run command history sent up?

Are you talking about folks with Send my activity history to microsoft checked?

I have a script that sets default privacy preferences to my own preference when I start using a machine, you might consider that.

Then you will probably notice that you no longer have a history for Win+R run history.

It’s not unique to Windows to mine user input but it’s more recent than for example the search in iOS and less obvious than Google search.

I believed that the “personal” in Personal Computer meant that it belonged to me, and that used to be true. We are sliding down the slippery slope of allowing the software vendors to own our devices.

I think the staring point with Windows was product activation in XP, and that was quite legitimately intended to stop software licence abuse. I am still comfortable paying for closed source software but Microsoft seem to have given up on that business model.

This certainly makes debugging production issues much much much harder - there are certain environments whose data you simply can't access (either as a user or as an administrator) and you have to rely on telemetry (much of which you can't gather since it can possibly be used for PII - this is all an audited process) to debug issues (attaching a debugger is also prohibited since you can read data that way and the port is closed).

Instead of trusting me - think of the corporate incentive to do well here. Consider how much it would cost a company like Microsoft if employees were exposed to confidential customer data (our customers can work with medical data, so a fairly expensive legal nightmare) vs. what the company gains (engineers have a slightly easier time debugging). At Microsoft scale I guess it simply makes sense to be super strict about this.

Unfortunately, when it comes to anything Microsoft related, due diligence research and logical thinking is rarely employed by the HN crowd, and instead replaced with anger and FUD. I've lost count of the amount of comments saying Microsoft is forcing TPM to spy on us.

Not saying that the alphabet agencies or nation states couldn't misuse Microsoft's reach to get more private customer data, but that would apply to all US based corporations, not just Microsoft. And since AFAIK, Microsoft seems to never have been hacked for its customers' data to be leaked like it happened to Sony and Facebook, it seems they're doing a good job so far of keeping the amateur bad actors out and their customers safe.

So thanks for commenting and sharing inside infos, as some big companies ban their employees from doing the same.

Thanks, no one said otherwise....but then it's no a quality standard per se ;)

The last 3 decades of big players misbehaving taught us they usually get a slap on the wrist for pretty much everything at worst, and a fine of half the money they made from the feature at best.

I'm not sold.

Not sold too ;)

Your employer has been caught twice providing NSA backdoors in its operating system and its "home" edition makes it impossible to disable a stunning and completely unnecessary level of telemetry data.