289 points

similarly, I’ve removed Microsoft from my system.

permalink
report
reply
71 points

Probably a good move on your part. When they try to force windows 11 on me, that’s when I will be moving to Linux.

permalink
report
parent
reply
34 points

Why wait, do it now.

I jumped ship to Linux when Win 7 died, cause I’d rather be fucked by a rusty fencepost than be forced to use 10, and 11 is right out.

permalink
report
parent
reply
11 points

Looking to move an older Windows 7 laptop to Linux this week, any suggestions? Feels like there’s so much.

permalink
report
parent
reply
-9 points

Why wait, do it now.

Because Linux is a giant pain in the ass for anyone who is not a software engineer.

permalink
report
parent
reply
2 points
*

My new hardware is literally incompatible with Windows 11. They’re doing me a kindness I don’t want all this AI shit on my PC

permalink
report
parent
reply
-4 points

Excuses.

permalink
report
parent
reply
11 points

Haha, I had a partition on my pc for the longest time to put Linux on it. But I do a lot of game dev stuff, so I’ve been reluctant to switch from windows.

permalink
report
parent
reply
4 points

How well will my Index work on Linux?

permalink
report
parent
reply
12 points

That’s the real trojan.

permalink
report
parent
reply
4 points

Me too !! Been loving Ubuntu the last couple of months. Had very few issues other than one time my Gui stopped working and it would only boot into terminal, if anyone knows how to fix that it would be great incase it happens again . Last time I just did a fresh install.

permalink
report
parent
reply
4 points

I recently went to Kubuntu and it’s been good.

permalink
report
parent
reply
196 points

I’m not sure about the browser, but a lot of malware used to ship with the tor binary and used it to connect to the CNC. I can totally see it ending up in the indicator list.

I love bashing MS as much as the next guy, but this is not completely indefensible behavior given typical user use cases and needs. As long as it’s easy to add an exception of you installed it on purpose.

permalink
report
reply
81 points

Yeah I’m guessing this is a false positive based on heuristic analysis, i.e. the TOR program has a lot of the same behaviors as malicious programs. Of course it is more accurate to say that the malicious programs are copying TOR behavior or just straight using TOR code, whatever the case may be.

My main issue is that it kind of shows a lack of due diligence. I assume the official TOR binaries are signed, so the official TOR binaries should be exempted from these heuristic positives. If the binaries are unsigned/have no valid certificates, then I can totally understand the false positive. At that point, the user should know they are installing software that cannot be automatically verified as being safe, and antivirus should never assume that something is safe otherwise. Like you said, for typical users this should be the expected behavior. Users can always undo Windows Defender actions and add exemptions.

permalink
report
parent
reply
-25 points

I still don’t understand why Windows doesn’t use .exe whitelisting instead of bothering with endless blacklists and heuristics and antiviruses.

On any given system there’s a handful of legit .exe while out there there’s like a billion malware .exe, and more created every minute.

Or at least switch to an explicit “executable” flag like on MacOS and Linux.

permalink
report
parent
reply
18 points

Windows has both WDAC and Applocker for allowlisting, not just for exes, but stuff such as powershell scripts and what drivers run in the kernel as well.

https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/

In it’s strongest form (a signed WDAC policy) even admin access can’t easily override it, and a well written policy can even enforce stuff such as downgrade protection (example: only allow firefox.exe signed by Mozilla at or above a certain version) which prevents an attacker from loading older versions of an executable.

The problem is that it’s not so easy to use in practice - an installer will often drop loads of unsigned files. Tor Browser ironically enough is a prime example, and any WDAC policies allowing it have to fallback on hash rules, which are fragile and must be regenerated every update, or filepath rules which are not so robust.

Microsoft is trying to make allowlisting more accessible with Smart App Control, which runs WDAC under the hood. It does save the hassle of managing one’s own policies (and also blocks certain filetypes like lnks commonly used for malware), but it is not very customizable.

permalink
report
parent
reply
4 points

From my experience, Windows by default completely blocks non-Microsoft-verified .exes. It’s called S mode and usually requires a Microsoft account to exit.

permalink
report
parent
reply
-4 points
*

Because it makes it the easiest thing to spoof an .exe which enables attacks of which you will never get out of. A legit.exe vs a spoofed legit.exe will be the exact same in every way except the coding in spoofed fucks you.

Edit: you’re trading security risk for security risk that makes it easier to hide. Not worth it.

Edit 2: their is nothing 100% secure MD5 and Sha1 are both spoofable. Checksums and anything is capable of being man in the middle. You people act like you just found something that can’t be broken. This is the real world the moment you switch most black hatters and white hatters will switch too…

permalink
report
parent
reply
11 points

Oh god I hate that spelling of C2 lol

permalink
report
parent
reply
4 points

I have other associations too 😈

permalink
report
parent
reply
4 points
*

Same here. Totally talking about Computer Numerical Control of course, absolutely no other association. Nope, definitely not. 😇

permalink
report
parent
reply
8 points

It’s defensible only from the perspective that it’s safer to flag many innocent apps than to miss something harmful. That said, it heavily punishes many legitimate developers and creators, as documented here. I was personally affected on many occasions and there hasn’t been a single one where Microsoft wouldn’t admit to false-flagging upon a manual review.

permalink
report
parent
reply
128 points

At this point, Microsoft Windows itself can basically be classified as malware

permalink
report
reply
10 points

If we define malware as something having functions to harm the user and not only things build soley for this purpose, then of course Windows is malware.

https://www.gnu.org/proprietary/malware-microsoft.html

permalink
report
parent
reply
3 points

When Windows 95 was in beta I would install it and next day it was dead. We finally realized that the BIOS was killing it.

permalink
report
parent
reply
11 points

Wat?

permalink
report
parent
reply
9 points

95 is kill

permalink
report
parent
reply
0 points

Windows updates are literally harder to stop than actual viruses.

permalink
report
parent
reply
-37 points

it is - by everyone with half a brain cell or more. Unfortunately, that’s not the majority of users by a long shot.

permalink
report
parent
reply
6 points

Incredible the downvotes you get. It’s true. Windows literally spies on you

permalink
report
parent
reply
3 points

oh noes, my karma! Oh wait - there’s no such thing on lemmy :) In all honesty, I think most people downvoting did not fully understand my comment in relation to the one I was replying to. I think they misread it as “people with half a brain cell or more don’t use windows” and pushed the arrow down.

permalink
report
parent
reply
3 points

It forces software on your system you don’t want and when you try remove it it reinstall itself just like a virus. Windows 11 especially is trash.

permalink
report
parent
reply

Hope they’re having fun watching me become Emperor of the HRE as Japan then. Cause I’m stuck with windows

permalink
report
parent
reply
88 points

Dude ms defender used to delete my “Hello World” executables built using visual studio just because they were made by an unknown publisher.

permalink
report
reply
24 points

Well maybe you should have become a known publisher before writing any programs.

/s

permalink
report
parent
reply
7 points

It flagged your program for being dissident propaganda.

permalink
report
parent
reply
5 points

Microsoft Defender moment

permalink
report
parent
reply
3 points
Removed by mod
permalink
report
parent
reply
2 points

Wow, do you need to have your apps signed by Microsoft now, like macOS’s Gatekeeper makes you do?

permalink
report
parent
reply
70 points

I’ve run into antiviruses blocking code I’ve written just because I pulled in certain cryptographic libs. Literally pulling in some Microsoft cryptography libraries in c# made it think I was writing a crypto locker.

permalink
report
reply
22 points

Imo, compared to how prevalent viruses were on older versions of windows, this type paranoia seems to be working

permalink
report
parent
reply
4 points

It blocked my lousy dll injector that was made for debugging.

permalink
report
parent
reply

Technology

!technology@lemmy.world

Create post

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


Community stats

  • 17K

    Monthly active users

  • 12K

    Posts

  • 554K

    Comments