This is what happens when people don't understand group policy and are a little too paranoid. This is just a broken version of Windows 10 as far as I'm concerned. You will have far more problems with this than any "forced" Windows update people love to complain about.

It’s an educational release, and one that raises awareness about the issues of Microsoft collecting PII and other telemetry. Even if it’s provably broken in the ways you say, it still serves the stated goals of the creators in these ways.

That's not at all what they say. It's advertised as "a stable, non-intrusive yet fully functional build of Windows 10 to anyone that requires [it]" in which "great effort has been invested in maintaining the subsequent system’s stability, bug-free operation and user experience".

The entire site screams "download this and use it in production". They have big friendly ISO download buttons front and center, with absolutely no disclaimer anywhere that it might be a terrible idea. If it truly is merely "educational", then this is highly irresponsible.

It [being an education release of Win10] is exactly what they say.

> AME is developed for educational purposes only, which emphasizes an effort to reverse engineer, disable or replace components of the Microsoft Windows 10 operating system. The goal is an endeavour to better understand and mitigate the collection of Personally identifiable information (PII), as has been clearly outlined by numerous outlets covering the topic, including comments by famed whistle-blower Edward Snowden. Another goal is to replace included proprietary Windows software, such as the Edge web-browser, with ethically verifiable alternatives using open-source licenses.

https://wiki.ameliorated.info/doku.php?id=faq#legal_consider...

Yeah my cracked version of Logic is an educational release too, lmao

DMCA literally has an exemption for reverse engineering for educational and interoperability purposes.

This isn’t the pwn you think it is, lol

Releasing a cracked version of an application is not covered under that exemption. I'm honestly flabbergasted to hear you suggest it might be.

There is literally a link titled "ISO Download" at the top of the web site.

Claiming that "oh, that web site isn't actually offering the download, it's actually a torrent file hosted on a Telegram channel" is not the defense you think it is.

You literally can’t download any content from that site: neither ISOs nor torrents. You’re reaching.

> Your legal argument is clearly false, or else torrent sites themselves wouldn’t exist. The Pirate Bay is legal!

Yes, so legal that Gottfrid, Fredrik and three more guys who founded the site got a fine of roughly 3 million USD and one year in jail for helping people commit copyright infringement. So very legal. Wtf dude?

If you think the existence of a site is proof of legality then I don't know what to tell you. Do you believe child porn is legal as well because such sites exists?

As for personal attacks, I'm sorry but this is not a debate. I'm sharing facts with you and you're sharing your ignorance.

Flamewar comments like this are not ok on HN and will get your account penalized and eventually banned.

If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.

Flamewar comments like this are not ok on HN and will get your account penalized and eventually banned.

If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.

It's a cracked version of Windows with updates disabled, there's nothing "educational" about it.

Using group policy or registry edits does NOT fully remove Windows spyware or telemetry. Windows Ameliorated is different in this regard, as it actually gets rid of the spyware on an executable level, meaning the functionality of the spyware is not just disabled, but completely removed.

Also, as a personal testimony, my whole family and I have been running AME as a daily driver for awhile now, and haven't run into any significant issues (funnily enough, I've had less issues with Windows Ameliorated than I have with Windows). From my experience it really is stable, and IMO even more stable than stock Windows.

I ask that you actually try out a project before making claims about it.

It'll probably still work better than some of the insane and dubious things my Citrix customers manage to do to windows in the name of stability and privacy...

Secure from PII telemetry phoning home: perhaps, likely better than stock Win10 or even LTSB/LTSC in that regard

Secure in literally any other way: outside the scope of the project

Do you understand why people might get confused? They don't qualify what they mean by "more secure," and it seems reasonable to criticize the project if their idiosyncratic definition of "secure" actually excludes one of the biggest advances in consumer software security in the last 20 years...

The biggest advance I can think of is using security as an excuse to gather and monetize data.

Different people have different attacker models. I can imagine something like this would be perfect for keeping a mostly airgapped machine to access archives of documents created by Windows. (Or to use legitimately licensed, pre-everything as a service software in perpetuity)

I’m not a dev on the project, fwiw.

In any case, if you wanted security in the way you describe, how would you justify running Windows 10 at all? The onus isn’t on this project to secure Windows when they had no part in making it insecure to begin with. If Windows were open source, these measures wouldn’t be necessary, and wouldn’t result in less security. This is the current best effort that the devs can do to accomplish their goals. It’s fair to criticize the goal or the results, but issues you’re describing are present in stock Windows 10 to begin with.

I’m sure that some kind of auto build script could be created, so that whenever new Windows Updates are released, a new build is created.

Telemetry is a non issue if your network has a good nat in front… software updates on the other hand…

>"has a good NAT"

What is a good NAT as opposed to a bad one?

"Dude the DHCP on this network is AWESOME" lol

the configuration? what the fuck is this comment.

What configuration is there? You're either NATing or you're not. There's no "good". It's on or off. What situations have you been in where you weren't NATing between LAN and WAN?

Does VPN subnet translation count as NAT? Because I've definitely seen some footguns come from that.... I've also seen instances where poorly configured NATs ended up allowing victims to be used as proxies. So I'd say there are definite security questions to take into account.

Oh my that's so cute... not everything runs on a home router. lmao

I'm not talking about home routers. I'm taking about NAT, which I can tell you don't understand. Toodles.

Confidently incorrect, see my other comment for some examples.

Give me an example of a parameter you need to configure for NAT.

Take your pick:

https://docs.netgate.com/pfsense/en/latest/nat/index.html

I do agree removing Windows Update does pose some security risk, however I don't think said risk is nearly as bad as some make it out to be, and I personally think the benefits of Windows Ameliorated greatly outweigh any security downsides.

Also, AME does greatly help to mitigate the attack surface of Windows:

Windows Ameliorated ships with a non-administrator user account by default, which mitigates ~70% of Windows vulnerabilities. (Source: https://web.archive.org/web/20210618023509/https://www.beyon...). Of course you can still do admin actions, it just requires the admin password.