Windows 10 AME

Hey lain, a group of us have been working on a build of Windows 10 focusing on privacy and stability. All telemetry and windows update functionality has been entirely deleted from the system (about 2GB removed). We also removed all default apps (Edge, Cortana of course, Windows Media Player etc…) and replaced them with FOSS alternatives. Give it a try: https://actrons.info/ame.html

Inspired me to do the same, I really appreciate it.

>>5131 A clonezilla image is provided, simply clone it to a disk and expand C to the rest of the disk.

>>5132 thanks ;)

>>5131 the default USER and PASSWORD are test

>>5131 That's an interesting idea, but I don't think distributing a clonezilla image is a good idea. It would be better to distribute it in a script form that could automatically apply the changes to an official installation media or to a running system. This way it wouldn't distribute copyrighted software, and would be easier for users inspect what is actually being changed, otherwise it can't be claimed that this have more privacy than the official distributions, as far as anyone know this might have extra backdoors installed in its current form.

>>5137 It's not possible to make these changes in a running windows system. The file-system needs to be mounted and edited remotely to apply these changes.

>>5137 >and would be easier for users inspect what is actually being changed Good that you ask! There is a pdf on the site (op) with documentation of everything.

>>5137 >>5138 >>5139 OP is panhandling proprietary spyware on a site they knew would like seeing the buzzword of "FOSS" for. Saying that others here can't make the changes themselves and that they should just read a PDF about what you supposedly did is NOT a valid justification. But let's say you aren't trying to botnet the retards on this site; what does your ~ S H I T I F I E D W I N D O W Z ~ have over a generic linux+wine install?

>>5141 As a side note, your blog is not soykaf, pleasantly surprised.

>>5141 Panhandling infers that one is asking for money. linux+wine does not even come close to having the functionality of a windows installation.

>>5143 Aesthetic flare since the word "s h i l l" is not allowed to be used here. And what functionality does windows have again that you can't get anywhere else? I mean the use of FOSS replacements for all windows applications mentioned on the site seem to counter the notion that FOSS doesn't have stuff windows has...

You should add a torrent option.

>>5145 Functionality that Windows has, lets see...Games.....Games.....more games..... But really Music authoring applications and Video Editing, those two alone encompass a large number of programs that have no comparable Linux alternative.

>>5146 We are working on that.

You should make some registry tweaks. For example, you can opt in to increasing the maximum filepath limit. Also, what about replacing ribbon-paint with the old vista paint? I do that on my installations.

>>5147 Almost any DAW works on linux (with wine) and all of CS6 works with wine, so I'm not sure how this is off-limits for linux? I will give you games, but considering that is the /only/ thing to give to windows, it would make more sense to have windows as a side-operating system purely for games, no?

>>5150 Premiere CS6 does not work in wine at all and audio is a crash riddled nightmare with any Windows DAW

>>5151 I don't use premier, so idk what to tell you for that, but let's say all of CS6 was garbage on linux and every major industry-standard program died on linux, I STILL don't see the point in saying, "well we could force companies to port to FOSS OS's but we'll keep letting them walk all over us and force us to use proprietary spyware instead for ultimately baseless reasons."

That is dumb and if you care about surveillance at all you should not be using Windows or anything closed source at all. ...that said, I really do appreciate what you guys are doing. A lot of people are forced against their will to use Windows at work or school. Thank you and god speed.

>>5152 This is for people who have a reason to use windows, not as their main OS but for a purpose of which that cannot be fulfilled in any reasonable sense using FOSS. I cannot provide reasons for people whom I haven't met obviously. Evidently this is not for you since you would never use it. >>5149 I did not know you could do that! Will look into it.

>>5131 you got laughed out of /g/, why wage slave that soykaf here too?

>>5156 So a bunch of random sh*tposts in a thread, next to an otherwise constructive conversation, constitutes as "laughed out" now?

>>5155 yea there are a lot of tweaks you should be adding another essential one is making wallpapers have 100% quality. By default MS lowers their visual quality but this can be fixed with registry.

>>5139 >>5138 I still think distributing copyrighted software is a bad idea, but at least all the modifications are documented. Maybe this should become automated with a bash script that you could run from a live CD. That way you'll get full access to the disk in order to do the cleanup, and you won't get a dmca letter from Microsoft. I could see having a bare bones version of windows 10 to be useful for using as VMs when software isn't compatible with wine.

>VLC >Telegram >documentation is not in html >distributing copyrighted software >not just a single script >not a bash script to run on mounted VM image You Had One Job

Wow this project looks very cool I but I wonder how Macroshaft will reach to this

>>5131 What do you do about Windows update? Windows update is essentially a backdoor that lets Microsoft push arbitrary code to your machine. Not very secure. On the other hand, disabling Windows update means your machine will have unpatched security vulnerabilities that anyone can exploit. Personally I don't think you have thought this project through properly but I'll wait for your response.

>>5159 This is already on the checklist of thngs to do for those exact reasons. >>5162 Gave up on this due to the shear number of files, it could be done but I only have one lifetime. If you would like to help the list of files can be gleaned from the instructions in the PDF and I would have taken the bash script approach had I infinite time to work on this. I would really like more people to help out on getting the list since that is something able to be vetted by anyone. >>5165 It's gone and by gone I mean Windows update execuatables have been deleted entirely. The (lack of) security updates do not effect users who practice safe browsing/computing technics and have a proper firewall.

>>5167 >It's gone and by gone I mean Windows update execuatables have been deleted entirely. I think you need to be more explicit about that and make your users aware of the risks involved with removing all security updates. >The (lack of) security updates do not effect users who practice safe browsing/computing technics and have a proper firewall. What specific security configurations have you added to the project? Presumably this includes a "proper firewall"? Do you have any documentation on what constitutes "safe browsing/computing technics"? Because I do not think everyone knows this and it seems to be a very important prerequisite for anyone how wants to use your product safely.

>>5168 >I think you need to be more explicit about that and make your users aware of the risks involved with removing all security updates. There is section devoted to that in the link from the op. It clearly states security concerns.

>>5163 It does not come with all the software you see in the image. The documentation is in pdf form in the link from the op, and I invite you to go through the steps yourself. >not just a single script see -> >>5138 as well as the aforementioned documentation on the site, however this is an understandable concern. >not a bash script to run on mounted VM image Thats interesting, we might look into that. However this distribution is also very reasonable.

>>5171 PDF is a proprietary format that can execute arbitrary code in viewer software. Compile your documentation in html, tex or markdown and publish it directly on the website. >blah-blah where is the soarce kode rapo?

>>5131 Seeing dismissal of the copyright industry via projects such as this is lovely. Should your site gain any traction, surely your provider would receive copyright notices so it'd be best in advance to provide a torrent of the necessary files or host a Tor hidden service mirror. >>5172 PDF isn't a proprietary format[1] but a project of this nature should probably publish source where you can. If OP used PostScript to generate the PDF, that should be provided as well. Alternatively, you could use something like texinfo[2] to produce a variety of formats. There's no reason for the documentation to be solely tied to PDF. [1] https://en.wikipedia.org/wiki/Portable_Document_Format#History_and_standardization [2] https://www.gnu.org/software/texinfo/

>>5174 >Seeing dismissal of the copyright industry via projects such as this is lovely. Should your site gain any traction, surely your provider would receive copyright notices so it'd be best in advance to provide a torrent of the necessary files or host a Tor hidden service mirror. Thank you, I will immediately look into that, as this topic has been of concern.

>>5174 So the less important point was dismissed, cool, but >>5172 still makes the more relevant point that PDF is an INSECURE entity in this sphere. The whole project's stated purpose was to make a system more secure, so why overtly compromise that by forcing the downloads of PDFs?

>>5182 The projects is actually not about security, and this is explicitly stated. The project is about stability and privacy. However, I will work on publishing the documentation differently, thank you for the comment.

Amazing project. An OS like this would be perfect for those of us whose hobbies sometimes depend on the broad popularity of Windows and some software limited to it (personally, game development and music making). As other anons have pointed out, not having updates (by "updates" I mean the useful part, not the (((updates))) part) could be a real problem. If, say, I have not had a single virus/malware on my wangblows in about ten years, would it be safe for me to use your version of dicksoykafs ten? Do you know about Spybot Search & Destroy? It has this "immunize" feature that seems to greatly increase the system's resistance to all of the malicious software by immunizing your connection to the internet. Though I only ever use the 1.6.2 version, it still gets applicable updates for immunization. Also: >telegram >vlc >mozilla Ishiggy

>>5184 Telegram is not pre-installed, and the default software is equivalent to something found in most linux distros, replacing the core windows applications (as these have been removed entirely). >Do you know about Spybot Search & Destroy I do not recommend the use of proprietary anti-virus software, as their main business model revolves around selling your data. Security concerns, which are reasonable to have considering updates have been eliminated, are addressed on the page in the OP.

>>5183 Privacy isn't a part of security?

>>5185 >I do not recommend the use of proprietary * software Neither do I. My point was that the immunization feature (which could surely be replicated) seems to be a very useful one and I thought you might find it relevant.

>>5185 >>5188 Now that I think about it, not one Windows update has brought me anything useful to me at all. I might aswell use your project

>>5189 op here, let me know if you have any issues. Also: keep an eye on the site if you are interested in the project, we are changing a bunch of stuff based on feedback from these threads.

There's already a build of Windows 10 focusing on privacy and stability. LTSB.

>>5196 Unfortunately that couldn't be farther from the truth. It is well established that LTSB spies on you with the same malicious intent as any other edition of Windows 10. I wish that meme would die.

>>5196 Isn't that an official version of windows 10 that only promises you privacy? Really?

>>5131 Free pape

>>5172 >PDF ... can execute arbitrary code in viewer software. Actually it is sandboxed just like the JavaScript in your browser so "arbitrary" is an incorrect word to use. >>5183 >The projects is actually not about security, and this is explicitly stated. The project is about stability and privacy. Privacy without security it like windows with curtains but no locks. But ok, the risks are documented, no one is being mislead. Good luck with your project.

>>5150 >Almost any DAW works on linux (with wine) Are you sure? Protools doesn't, and although Reaper runs in wine (and even has a native linux build now that works well), it is still a huge pain, and some times (practically) impossible, to get certain VSTs to run on Linux. >>5167 >The (lack of) security updates do not effect users who practice safe browsing/computing technics and have a proper firewall. What about zero days? And "safe browsing," while effective, is not a 100% effective strategy for malware prevention. You could go on [insert favorite legitimate news site] after its been hacked and it could load malware to your machine. There should be some effort to push out only Window's security updates. They do publish the security patches online at https://technet.microsoft.com/en-us/security/bulletins.aspx so it should be possible to maintain your own list of updates. And if you're going to play the "users should be secure" card, consider adding in some security-related programs, like sandboxes and anti-virus.

>>5203 Wrong link: https://portal.msrc.microsoft.com/en-us/security-guidance/summary

>>5203 I agree with you. Solely Security updates would be cool.

>going to news site where you read news in textual form with javascript left on or even without adblocker >security-related programs, like anti-virus What is this, facebook.com/lainchan group?

Why would anyone want to use a proprietary operating system like Windows at all? The only way to make it user-friendly would be to install something else, which anyone can do. It's also a hell of a lot better than using a modified version of Windows full of undocumented changes.

>>5213 Impossible without updating everything else, we really wanted to do this but it did not work >>5224 Please read the documentation. https://actrons.info/pdf/win10_ame_15-10-2017_doc.pdf

>>5224 One word: Gaming. Hopefully Vulcan will take off and this won't be as much of a problem, but as of right now, Linux is not the gaming powerhouse Windows is.

Weird threat model where you trust millions of lines of existing Windows code but don't trust the updates.

>>5213 The very first paragraph of the documentation it is stated that if you want privacy or security, do not use windows. The only the trust there is, is in that windows will continue to have a monopoly on high performance graphics drivers and games.

>>5227 Are you sure it's actually impossible? From the pdf, you're not removing DISM which means that given a .msu file containing a security update, you extract the .cab files from it and run DISM, you could install the updates that way.

>>5270 Hay, maybay, will try it out. Currently testing if 1709 is viable but will make sure if that us even necessary first.

>privacy and stability >windows pick one

my nigga zoro how do I install driver soykaf if I don't have updates ? t. haven't used windows in like 10 years and I'm planning on putting this on my brother's pc for gaymes since I can't run all the soykaf he wants in wine.

>>5270 I successfully installed all the security updates for 1511 while offline, next build will have them. Should only take a few days to complete. >>5314 Updates are not necessary for driver installation. You just install the drivers from manufacturer websites.

>>5312 >>5262 Please read.

wow it doesnt boot good job op

>>5411 >didn't work hurr durr No context, no reproducible steps, no debugging. wtf are you doing on /tech/?

>>5412 it's a fuarrrking clonezilla image, there's not much to it I restore it, it doesn't boot

>>5414 >it's a fuarrrking clonezilla image, there's not much to it >I restore it, it doesn't boot Oh god. To get away from people like you is the reason we have /tech/ boards. >No matter what the bug is, we will always want to know the same information: >What did you try to do? >What steps did you take to do that? >What did you expect to happen? >What happened instead? See you are stuck on step one. There is nothing anyone can do about "wow it doesnt boot good job op". Here is an example: >What did you try to do? Boot the image, it doesn't work. >What steps did you take to do that? I downloaded the ISO from (url). Created a new virtual machine with virt-manager Added the ISO as a virtual disk and added it to the boot menu Clicked the big "run" button on the GUI. >What did you expect to happen? I expected qemu to boot into a Windows-like OS >What happened instead? I get a black screen which says >Booting from DVD/CD... >Boot failed: Could not read from CDROM (code 0004) >No bootable device. >debugging Did you run md5sum on the ISO to check that it downloaded correctly? Did you manually mount the ISO to check that it contains a bootable filesystem? Did you read the logs from the hypervisor? Did you google any error messages you found? Did you look at the source code to find where those errors are emitted? Now try your bug report again but with more details and less snarky entitlement.

>>5442 there is no iso retard, it's just a clonezilla image there's literally no chance for user error, no way to install it incorrectly. boot clonezilla, restore image, reboot, it won't boot honestly the fact that there isn't an iso should have been my first clue to avoid this amateur crap

>>5443 >there is no iso retard, it's just a clonezilla image Everything >>5442 said is still valid. >Did you run md5sum on the (clonezilla image) to check that it downloaded correctly? >Did you manually mount the (clonezilla image) to check that it contains a bootable filesystem? >Did you try to boot inside a vm and read the logs? >Did you google any error messages you found? >Did you look at the source code (of the hypervisor) to find where those errors are emitted? If you are lacking such basic technical skills how can you call others amateur?

>>5463 not worth my time when I can just download an os that actually works

>>5141 Making an analogy, I could as well imply that anyone who distributes binaries for their free/open souce software might be smuggling things that aren't present in the code itself in them. I can relate to that particular concern of yours, and if anyone's paranoid enough, then they can/should always double-check things twice, especially before running in their main environment. But this just looks like your're reacting with pretentious allergy, because someone DARED to discuss PROPRIETARY software (apart from the fact that it looks like it's been done in absolutely good faith, and with goal of making a bad OS better, which you should at least appreciate). And for fuarrrking sake, will ever linuxtards learn that WINE isn't a silver bullet, that can completely replace the full Windows environment, especially everytime 3D-dependant tasks are concerned. Also exactly what this >>5147 lainon says. I don't care in the slightest if the tone of this post gets me derezzed or not, at least i elaborated sufficiently enough to make it something more substantial than just a mere soykafpost. Your reaction wasn't of best taste either. >>5163 Why literally no one ever recommends MPC-HC whenever Windows is concerned? It's much more lightweight and has incomparably better overall experience than VLC. And it's FOSS, if you're concerned about that (you just only need to remove the crash reporter library, which is annoying and not FOSS) Also, regarding the discussion about possible dangers of having the OS not up-to-date security-wise - I'm also using Windows (not 10 though), and while critical security updates are a good thing, I have found that overall benefit-problem ratio is rather displeasing, knowing how much soykaf MS tends to push with those, not even mentioning the fact that many have very misleading or even straight false descriptions. That's why I decided to completely remove the backend services responsible for it, and live a life that is maybe a bit more riskier, but I'm personally okay with the tradeoff. I have secure browsing habits, and as far as vulnerabilities go, i try to stay informed about them and mitigate on my own. >>5312 I don't know what you're blabbering about, unless you lived under a rock since Win9x times until very now. My Windows installation is super stable, not a single kernel panic, nor total hang-up since early 2016. You can have a very unstable Linux setup, very stable Windows one, and vice versa, it only depends on the system itself to some extent, the rest is user management. >>5411 The thing is that it's hardly supposed to work since you can't move a Windows installation after it's set up to another hardware, because current configuration (including drivers) might be incompatible with new one. It might be compatible just enough to run, but it's still a huge hit and miss game. Thats' a huge fuarrrkup on your part, OP, i have to admit. Nevertheless, the idea is very laudable and i wish you luck in your endeavors Picture unrelated

>>5580 I hope your wifi is secure because the instant the kid next door gets onto your LAN you are getting raped so hard. >I have secure browsing habits lol

>>5584 Maybe i'm using wired network? (Actually no, but it's reasonably secure) Also what are you lolling at?

>>5586 I'm lolling at the delusion and naivete. You think that staying away from weird websites and turning off js will save you? >Maybe i'm using wired network? And what about the other people on your LAN? Do you trust them not to get popped? Because once they do, Windows presents a massive attack surface to the LAN. And we're not even talking about generic classes of attacks like ARP poisoning or NetBIOS/LLMNR spoofing. There are dozens of ways that an attacker can get a foothold on your system. Evil twin access points, WPA key reinitialization attack, your router might have a backdoor, or predictable credentials. A trusted website like this one could get hacked and feed you a malicious page. Or a dns hijacking could send you to the wrong site. And there are obviously all the zero days that everyone else are vulnerable to as well. The problem with turning off updates is that any tiny foothold an attacker gets can quickly turn into a full system compromise. Whereas if you actually applied the updates Microsoft gives you then they would be stuck with their little foothold and limited access. You are free to do what you want of course, I just don't want you to mislead other people into thinking that you just need to be smart or something and you will be safe.

>>5580 >MPC-HC

>>5589 I'm aware that turning JS off /not using Flash/Silverlight/whatever isn't a silver bullet for some very sophisticated attacks (like, say abusing vulnerabilities in libraries/code responsible for parsing images, in order to gain RCE), but that's kinda out of scope of this thread anyway, and if we're talking 0-days, NO setup is guaranteed to make you absolutely secure in case of such threats. Virtual machine can give you another layer of isolation, and greatly reduce chances of compromising the host, if anything. Maybe describe what precautions YOU do take, instead of just laughing your ass off me >Other people on my LAN Yeah, good point, since they are complete noobz when it comes to computers, they're all just your everyday fecesbook lurkers >Evil twin attack I should also bind my computer to one specific gateway's MAC btw, thanks for reminder >DNS Hijacking My system runs a script at startup that checks router's DNS addresses against the correct ones >You are free to do what you want of course, I just don't want you to mislead other people into thinking that you just need to be smart or something and you will be safe. I never meant to imply that in the first place, and security is a process, not a goal you can ever ultimately reach. >>5592 >VLC >VLC >VLC Okay, maybe you actually prefer MPV, then I'm ok with this. But you could elaborate on this a tiny bit instead of brewing soykaf, no?

I'm still uneasy about removing updates entirely. You wouldn't run your GNU/Linux system on kernel 0.01 and without the last year of package updates would you? Maybe adding a feature to allow users to selectively install certain updates (instead of windows 10's default "install everything" mode) might be helpful.

>>5599 True, but even on older Windows systems, where you are able to select what to install, there's often a lack of clarity from MS on what a particular update does, and i hate that.

>>5580 >The thing is that it's hardly supposed to work since you can't move a Windows installation after it's set up to another hardware OP here, that is simply not correct. Since windows 8 you can to this very thing. Before 8 you would of had to use sysprep in order transfer between different hardware. Now you can just move the drive between machines and it will reconfigure at boot. So your statement is false in both situations either before or after windows 7. Where to find sysprep: C:\windows\system32\sysprep\sysprep.exe

>>5599 Next release will have security updates up till Oct 10 2017 (end of support for 1511). The version without updates will still be available and I might do some minor tweaks to it. If enough people care, I will do work on one of the later versions either 1607 or 1709.

>>5597 >and if we're talking 0-days, NO setup is guaranteed to make you absolutely secure in case of such threats. Yes and the point I was trying to make is that a zero day in your browser will give an attacker code execution as the browser user. Now if you have 1000 local privesc vulnerabilities that you didn't bother patching then that petty code execution turns into a full system compromise. So concentrating only on your outer defenses is not good enough because, like you said, no setup is perfect and once someone gets in you can't rely on any internal defenses because your OS is full of security holes you didn't patch. >I should also bind my computer to one specific gateway's MAC btw, thanks for reminder To avoid arp poisoning? Yeah that would work. >My system runs a script at startup that checks router's DNS addresses against the correct ones Mmk. But a mitm can give you any ip address for any hostname you ask for. And you have no control over the DNS settings of the sites you visit. Even Twitter got their DNS hijacked once. https://techcrunch.com/2009/12/17/twitter-reportedly-hacked-by-iranian-cyber-army/ >Maybe describe what precautions YOU do take, instead of just laughing your ass off me If I was using Windows as my full time OS I would patch it. It doesn't really make sense to me for someone to run a Microsoft OS and then be scared of Microsoft patches. You are only throwing out the airbags and seatbelts from your 3 wheeled car. I do have one Windows machine for games. I obviously don't do random web browsing with it. I run it under Xen with pci-passthrough for the graphics card. That lets me contain the damage that malware can do to a virtual disk drive and lets me restore from a snapshot if something happens. The network is NATed so it has no visibility into the LAN.

>>5472 fuarrrk's sake guy, if you knew you didn't have time to troubleshoot and learn why the hell would you even bother with a third party windows image

>>5580 >while critical security updates are a good thing, I have found that overall benefit-problem ratio is rather displeasing, knowing how much soykaf MS tends to push with those, not even mentioning the fact that many have very misleading or even straight false descriptions Maybe this is true of non-security updates, but Microsoft publishes the details of their security updates extensively. Every security patch is available online with instructions on how to patch the issue manually that corresponds to the automated patching done by the update system. Please show an instance of a security update's .msu file pulled down from Microsoft's update manager acting differently than the instructions included in the full description of it. >I have secure browsing habits, and as far as vulnerabilities go, i try to stay informed about them and mitigate on my own. Secure browsing habits do not protect you from all exploitation vectors, and you're deluding yourself if you think one single person can keep up-to-date with every vulnerability that could affect them. >>Other people on my LAN >Yeah, good point, since they are complete noobz when it comes to computers, they're all just your everyday fecesbook lurkers So they're the type of people who don't practice secure browsing habits and are likely to get infected with malware? Then what's stopping them from getting infected with a worm that spreads over your LAN via unpatched Windows security updates?

>>5319 >Updates are not necessary for driver installation. You just install the drivers from manufacturer websites. What if the manufacturer doesn't provide drivers on their site and relies on Window's auto detect and install features?

>>5154 This. If you don't give a fuarrrk, build from leaked source, and fork from there.

>>5165 > lets Microsoft push arbitrary code to your machine. Not very secure. Full retard. If you run arbitrary amounts of MS code, allowing them to modify a few lines is an absurd complaint to make . Litteraly makes zero sense. DO you trust MS as your ISV or not. If you do allow update. If not, switch stacks.

>>5681 >If you run arbitrary amounts of MS code, allowing them to modify a few lines is an absurd complaint to make It makes a difference if Microsoft has reason to target you at a future date. Everyone gets the same ISO but not everyone gets the same updates. >DO you trust MS as your ISV or not. What the fuarrrk is ISV?

>>5168 >I think you need to be more explicit about that and make your users aware of the risks involved with removing all security updates. Yeup. A more realistic threat model for the average person is automatic attacks through malware, which this product emphatically fails. If the gubment doesn't get you through Using Windows, they will own you for not updating it. >>The (lack of) security updates do not effect users who practice safe browsing/computing technics and have a proper firewall. Idiocy. Even on a single user system. Your PDF reader gets owned by a book you downloaded with common sense and now your nudes are public. >What specific security configurations have you added to the project? Presumably this includes a "proper firewall"? Do you have any documentation on what constitutes "safe browsing/computing technics"? Because I do not think everyone knows this and it seems to be a very important prerequisite for anyone how wants to use your product safely. Exactly. A threat model is needed, but thats where this bombs. If your threat model includes government APT's acting through MS Update, it shouldn't preclude the possibily of WIndows being already backdoored.

>>5683 >If your threat model includes government APT's acting through MS Update, it shouldn't preclude the possibily of WIndows being already backdoored. Windows update *is* the backdoor. And I'm the "full retard"?

>>5183 Can you explain how privacy is different from security? Because it seems to me that privacy is just confidentiality of information. This sounds difficult to maintain with a vulnerable computer?

>>5684 Thats a pretty deep understanding you allege of the mechanics of how the government is backdoor'd Windows. Do you have any evidence of any kind to support the notion that the ONLY backdoor in Windows is Windows Update and that by removing it, you have fixe'd Windows? Because without evidence, alleging Windows update is bad because it allows microsoft to change code on your system is retarded. An abstract change by itself isn't good or bad. For sure some changes are positive (security updates). You are forgonig known positive effects that have real security impact, based on nebulous claims, and you can't even be sure that the CURRENT build is the good one without the unwanted code (after disabling Windows Update).

>>5185 >>5188 You don't recommened propetary security software, but you recommened a propetary kernel, and userspace ?

>>5682 >It makes a difference if Microsoft has reason to target you at a future date. Everyone gets the same ISO but not everyone gets the same updates. If the governement is targeting only a few people and unintrested in pervassive serveilance this kind of thinking might be sound. But if you read "I hunt sysadmins", about tampering with google's datacenter interconnects, it seems GOV is targeting evertyhing. I don't see why virtually every windows system woudn't be backdoor'd or how you could garentee windows update was the only part of the backdoor. >What the fuarrrk is ISV? Indapendant Software Vendor.

>A shift towards an unjust source of power, via Windows Update Automatically patching software is usaully considered desirable. Some ISV's (Redhat) even make you pay for the priviledge. Its usually configerable {on,off}. >a stock system is extremely unpredictable and subject to an ever-shifting, uncontrollable state of disarray If this is how you describe your OS, why would you ever want to use it??!! >nevertheless vulnerable to leaked back-doors, in cooperation with the NSA - seriously undermining and questioning the validity of the official narrative’s claim to security and progress. I am not understanding why I should trust you instead of microsoft , or why if you think windows is backdoor the only backdoor is windows update. >Richard M. Stallman Backdoor quote He didn't litterally mean all patching was NSA. He meant that MS as your ISV has full access to your system. They wrote it. Its their system. >it is strongly advised to revoke administrator privileges from the default user. This will mediate approximately 94% of the critical attack surface, while locking down the system from most foreseeable major future threats. Can you clarify ? How are you computing such a specifc number? You don't need admin to own a system. If you get user level privledges, you can dump home folder to network. I mean, you have a beautiful looking website, and your doing something. Thats cool. But, I don't see how there can be Windows Distributions in the future, unless a massive effort to either develop wine + reactos and/or audit , build and fork leaked Windows Source code. Anyone who is intelligent enough to install an OS , and cares about privacy/security is probably going to prefer open source.

>>5689 >garentee There are no guarantees on either side here. All I am saying is that by definition, Windows update is a backdoor because it allows Microsoft to push arbitrary code to arbitrary machines at anytime. If you already have this legitimized and accepted backdoor, why would you need a second, secret and obviously malicious backdoor that one of your millions of users could discover at any time? >it seems GOV is targeting evertyhing The Government is bigger than the NSA and the world is bigger than the USA. I will admit that the evidence is against me though, since the NSA invented md5 collisions to deploy Flame it seems that Microsoft are not actually that cooperative. >Indapendant Software Vendor Independent as opposed to what? Sounds like one of those terms you read in a college text book and then when you get your first job realize that no one ever talks like that in the real world. But ok.

>>5700 >Windows update is a backdoor because it allows Microsoft to push arbitrary code to arbitrary machines at anytime. Installing Windows is a backdoor because it allows Microsoft to run an arbitrary amount of code on your machine at all times. >If you already have this legitimized and accepted backdoor, If you trust Microsoft to have root on your system by installing or using Windows, then allowing them access to patch code makes sense. If microsoft wants to own you, they already did. Denying them access is a real security risk. Not patching has caused far more computer security issues than government surveillance - and I hate government surveillance. It is just so strange to declare without any evidence Windows-as-is (minus wuauserv) is perfect and not backdoored , and allow Microsoft to make changes is the backdoor. Okay man . So upgrading to the next edition of Windows is also the backdoor. Even if thats true, its still useless. Because, you just started your own new OS project - and your OS is written in binary - Go! Its going to suck to reverse engineer and patch binaries yourself. Or, as it seems you want, have a vulnerable system. >why would you need a second, secret and obviously malicious backdoor For people who are smart enough to see that wuauserv is the obvious backdoor ? >that one of your millions of users could discover at any time? Apparently, they are discovering the wuauserv is a backdoor. Its not a better strategy apparently. The problem with proprietary software is you know nothing. You have no clue about security or correctness of the code, but more importantly, you have no clue what MS is doing. Any or everything can be backdoord. I don't thing there is a strong enough argument to apropri declare update the exclusive backdoor.

>>5710 >Installing Windows is a backdoor because it allows Microsoft to run an arbitrary amount of code on your machine at all times. Yes you are running Microsoft code but that's not what a backdoor it. Installing Windows gives you Windows. That's it. Windows update is different because new code, targeted at only you, can be pushed at any time. That's why it can be called a backdoor. >It is just so strange to declare without any evidence Windows-as-is (minus wuauserv) is perfect and not backdoored Don't get confused. Nobody said that. The point is that if for some reason a person believes that, then removing Windows update makes sense. It is not "full retard" as you eloquently put it. >I don't thing there is a strong enough argument to apropri declare update the exclusive backdoor Fair enough. >Not patching has caused far more computer security issues than government surveillance Fair enough. There is also the "stable" aspect. Removing Windows update is a way to keep Windows exactly the same and avoid waking up one morning to find the start menu gone or something. I think that is also a motivation for the project. I agree with your overall point that keeping security vulnerabilities unpatched is far worse than anything Microsoft is going to do to you through Windows update. I don't think you should be soykafting on this guy's project too hard though.

>>5714 >Yes you are running Microsoft code but that's not what a backdoor it. >>It is just so strange to declare without any evidence Windows-as-is (minus wuauserv) is perfect and not backdoored >Don't get confused. Nobody said that. So, Windows -wuauserv is or isn't back-doored? >I agree with your overall point that keeping security vulnerabilities unpatched is far worse than anything Microsoft is going to do to you through Windows update. I don't think you should be soykafting on this guy's project too hard though. Doing anything is better than nothing. This guy has a nice looking website. But the whole thing is such a placebo. It probably engenders a false sense of confidence... I can take risks because I have removed the backdoor. (Who am i kidding, its all larp anyway). I'd love to see a build on windows stript of non-sense to deploy as a PC tech on customer machines. I can be pretty aggressive about striping most things out.. but I can strip Windows Update out in good conscious. If your going to use an insecure OS full of spyware, you at least need to patch.

>>5732 >So, Windows -wuauserv is or isn't back-doored? You are just being dumb on purpose. In >>5710 you try to play with the words to turn my statement around but it doesn't work. >Windows update is a backdoor because it allows Microsoft to push arbitrary code to arbitrary machines at anytime. >Installing Windows is a backdoor because it allows Microsoft to run an arbitrary amount of code on your machine at all times. Windows installer is not "arbitrary". Whatever code is on the ISO is what you get. Maybe it contains a backdoor, maybe it doesn't. MS cannot change it after the fact. Windows update is different because it 100% does allow MS to take control of your machine over the internet now or any time in the future. I don't know if you really don't understand the difference or you are just pretending but I don't care anymore.

Anon, I'm going to be sincere with you: Windows AME is a great project, the guys did an amazing job, but people will only trust that project after a team audit the modifications And I believe no one is going to do that too soon

Also, It just looks like a scam >no platform for feedback >very suspicious heavy advertisement on 4chan and another imageboards >tries too hard to convince us that ame is legit

>>5756 You sir are an idiot. You make the strangest unjustifiable distinction of all time. >Windows installer (+whole os) is not "arbitrary". Yes it is. You can't tell what it is. You have no source code. What ever its doing would take millions of man hours to figure out. Its wholly arbitrary, it could be doing anything and you'd have no clue. >>So, Windows -wuauserv is or isn't back-doored? >Maybe it contains a backdoor, maybe it doesn't. So Arbitrary? >MS cannot change it after the fact. You latch on to this like its even remotely important. You can't tell what the system is doing. How can you even tell if you want MS to change it or not? (Besides, you know... wanting them to change it to remove security vulnerabilities which they observably remove). The fact that Windows Update gives MS authority to change (the kernel) is factually no different than giving MS root as Kernel - what's the worst privilege escalation MS could get through a theoretical malicious windows update? The root they already had the second you installed windows. > it 100% does allow MS to take control of your machine over the internet now or any time in the future. What you artistically don't understand is they already have control over your machine... That whole privileged thing? Enforced by closed source kernel. Network stack? Closed source, arbitrarily back-doored Also, wtf is up with the hyper-specific claim that Windows is backdoored exactly via update, and without any reverse engineering or evidence you can be sure you removed the backdoor from gigabytes of binary data. Lol bruh. Its a ridiculous claim.

>>5765 >So Arbitrary? Let's use different words. Installer is a fixed size. If it does not contain a backdoor then your system will never have a backdoor. Update lets MS push any code at any time. If your system does not contain a backdoor, this allows them to add one later. >Windows + Update is logically worse than only >Windows

>>5765 >MS cannot change it after the fact. >You latch on to this like its even remotely important. The whole point of a backdoor is to have interactive control.The attacker will make decisions based on who you are and what they want from you in the future. Running code once, like in an installer is useless unless you know exactly what you want upfront or it in contains a mechanism to add more code later. >What you artistically don't understand is they already have control over your machine... That whole privileged thing? Enforced by closed source kernel. Network stack? Closed source, arbitrarily back-doored The closed source code has a specific function. It doesn't steal Facebook passwords. If MS want your Facebook password they need to add more code to do that. This is the dynamic requirement of a backdoor. Just running some closed source code is not the same thing.

>>5649 Through proper, albeit limited browsing habits and a properly written firewall it is possible to be completely protected without any security updates. There's a reason black hat and government hackers can remain hidden, methods exist but they tend to be far beyond the scope of what most people can or are willing to do. Not to mention that if you want to do anything beyond basic text retrieval you will have to write your own scripts/programs/firewall rules specifically designed for the tasks at hand, which will also require a lot of research and effort. But, it is possible...

>>5771 >So Arbitrary? >Let's use different words. But, you admitted as much, that it was arbitrary. It may or may not have a backdoor, we have no way of knowing. It arbitrarily has a backdoor. >Installer is a fixed size. If it does not contain a backdoor then your system will never have a backdoor. Size of binary has absolutely nothing to do with backdoor. If you have a static OS binaries nothing will ever change - that much is true, but you still have not said anything about having a backdoor or not with that statement , and if nothing changes, you have a backdoor through all the vulnerabilities that will be discovered. >>5772 >The whole point of a backdoor is to have interactive control.The attacker will make decisions based on who you are and what they want from you in the future. Running code once, like in an installer is useless unless you know exactly what you want upfront or it in contains a mechanism to add more code later. How can anyone believe this? Are you trolling? Because, the install runs once, but the OS runs daily. Any means Windows Update could have to identify you would surely be accessible to the kernel, or other backdoors MS designed on system. The kernel runs daily, can identify you, connects to internet (in non-air gapped installations). Code could execute, under conditions that were aprori known and no network required, or even commands communicated via other mechanisms. >The closed source code has a specific function. Really? Can you name it ? There are gigabytes of binaries with no source to compare to. Have you reverse engineered those and shown they behave as you expect? >It doesn't steal Facebook passwords. If MS want your Facebook password they need to add more code to do that. This is the dynamic requirement of a backdoor. Just running some closed source code is not the same thing. Wtf? First, we have no way of knowing kernel doesn't contain steal fb pass code, or networking stack, or a generic command control through any of the other means available, or even this isn't coordinated with the state and ISPs. Perhaps your networking stack accepts stenographed commands from packets with a legitimate cover to your ISP. You litterally have no way of knowing what the OS does , and running gigabytes of closed source binary RING 0 means that binary has root. This isn't controversal. This isn't my idea. Heres Mark Shuttlesworth on Ubuntu: >Don’t trust us? Erm, we have root. You do trust us with your data already >http://news.softpedia.com/news/Canonical-We-Have-Root-Trust-Us-294538.shtml

>>5776 >How can anyone believe this? Are you trolling? Read the words more carefully. I am not that stupid and neither are you. >Installer is a fixed size. If it does not contain a backdoor then your system will never have a backdoor. >Update lets MS push any code at any time. If your system does not contain a backdoor, this allows them to add one later. >Windows + Update is logically worse than only Windows

>>5131 is this a fresh build from the source code leak a short while ago, or just hacking at the existing binary? I'd love to see a WiNE-esque project that isn't hampered by muh copyright

>>5783 ReactOS?

>>5779 >Installer is a fixed size. If it does not contain a backdoor then your system will never have a backdoor. >Update lets MS push any code at any time. If your system does not contain a backdoor, this allows them to add one later. >Windows + Update is logically worse than only Windows I mean i don't disagree with this argument in principal theoretically. If you take size of binary as correlating with complexity and ability to hide a backdoor/intentional 0day then less binary / less lines of propetary code possibly lower likelyhood of observing a backdoor. But, the problem is, back door is a threshold effect, even one means 100% owned. And removing Windows Update is a infinitesimal fraction of the OS. So, theoretically it might be less likely to be back doored, but better by a negligible percentage. And the costs are all or nothing. Worse yet, because of the actual component you have chosen to remove, there is actual observable harm done. You have an unpatched vulerable system. This whole thing is an FBI prank bro. They don't have NSA 0days, and don't want to explain in court the 0day they have. Just convince all the lessor security autists to run unpatched Windows. Coming soon, Firefox Ameliorated.

>>5783 >is this a fresh build from the source code leak a short while ago, or just hacking at the existing binary? fuarrrk no. This isn't even a hack. This is some guy who deleted a few files from the binary he declared the backdoor TM. Ironically, the very files he removed as the backdoor TM, are the only files that stop a 15 year old from following a hacking tutorial on youtube from owning your machine. I'd love to see a project based on building and formally auditing leaked Windows Source code as a binary compatible "Windows Distribution". However, the legal headache would be a HUGE nightmere. You can't host it anywhere, you can't run it. Its far easier to just do ReactOS or switch to FOSS alternatives than assemble a worldwide team of experts spending millions of man hours constructing a product with the wrong kind of legal certainty.

>>5792 >If you take size of binary as correlating with complexity and ability to hide a backdoor/intentional 0day then less binary / less lines of propetary code possibly lower likelyhood of observing a backdoor..... Just stop. This argument you are fighting is entirely inside your head and has nothing to do with anything anyone said in this thread. Just stop beating up your own strawman it's getting old.

>>5685 For example, take Windows Update. Allowing microsoft to push updates on your system is a threat to your privacy, but (usually) not to your security. Another example would be google analytic : they beat the soykaf out of your privacy, but everything is encrypted using HTTPS, so it's not a threat to your security. There's plenty others examples out there, but you see my point.

>>5800 You never respond with a detailed argument. You make vague claims. You never answer my counter arguments. Idiot or wage slave ? If you had no 0days, what be the best way to penetrate a group? Meme them into running soykafty unpatched windows. Can you even explain how I am straw-manning your argument? You made a hyperspecific claim ("Windows Update is thee backdoor TM and some how because the size of the code doesn't change when you run windows its not backdoored. This is the stupidest argument of all time. No one says because size of bios/ cpu firmware is fixed they are not backdoored. I tried to offer a reasonable interpretation of your argument, that complexity is correlated with ability to add a backdoor, but honestly, I think you just a larping nogrammer who has no idea what a backdoor could even look like. Its insanely absured to remove a few kilobytes of gigabytes of binary data without reverse engineering and claiming to have removed the backdoor. Better yet, the thing removed is observably important to keeping your computer secure if you run Windows (which you shouldn't). This whole thing is an FBI prank bro.

>>5803 I am not really sure you understand security. Security consists of CIA triad (Confidentiality, Integrity, Availability). Privacy is ensuring the confidentiality of information or resources. If the information you seek to protect is on a computer, by failing to protect that computer, you are exposes that information to attack and disclosure, you are facing a privacy security risk. Privacy is a subset of security. You create security policy and enforce with technical security measures. Deploying random technical security measures isn't a good framework real security. >Another example would be google analytic : they beat the soykaf out of your privacy, but everything is encrypted using HTTPS, so it's not a threat to your security. That we understand the CIA triad, we see this is bunk. We take as a resource our browsing history. We seek to protect this and our threat model includes pervasive actors across the internet. If we are protecting metadata about browsing, and wish to ensure disclosure only to authorized parties, we could have a policy : Browsing History shall not be disclosed to unnecessary parties (ISP/VPN being necessary). Then in order to implement this policy, we put in place technical security measures like noscript with a filter for google analytics. Privacy is a subset of security.

>>5807 >Windows Update is thee backdoor TM and some how because the size of the code doesn't change when you run windows its not backdoored. No body said that. Show the post id. >Its insanely absured to remove a few kilobytes of gigabytes of binary data without reverse engineering and claiming to have removed the backdoor. No body said that. Show the post id. >This is the stupidest argument of all time. That's because you didn't understand what was actually posted so you morphed things into strawmen you can easily beat down.

>>5776 >Wtf? First, we have no way of knowing kernel doesn't contain steal fb pass code, or networking stack, or a generic command control through any of the other means available, or even this isn't coordinated with the state and ISPs. Perhaps your networking stack accepts stenographed commands from packets with a legitimate cover to your ISP. You are getting confused by the technical details. Think logical. Either Windows steals fb passwords of all users or Microsoft needs to give a command to steal YOUR fb password. Whatever code exists in Windows to handle this command is a backdoor. If there is no such code, Microsoft add it with Windows update. If no Windows update, Microsoft cannot steal your fb password.

>>5815 >Either Windows steals fb passwords of all users or Microsoft needs to give a command to steal YOUR fb password So what? Windows steals all FB passwords and microsoft compiles a table they search on demand. > Whatever code exists in Windows to handle this command is a backdoor Agreed. Also back-doors could look like deliberate bugs, or weakened encryption that results in pervasive surveillance actors stealing any traffic they want. >If there is no such code, Microsoft add it with Windows update. If no Windows update, Microsoft cannot steal your fb password. This is what is retarded. Out of all editions of Windows, you irrationally pick 1504 as the good one TM , and declare builds after may be backdoored. This is based on zero evidence. And even if true, not a usable solution anyway. Now you have a binary of an OS, no source, no development team, no patches for 0 days, no legal ability to use or distribute. Its effectively backdoored anyway because, 0 days will be discovered and you can do nothing about it. But all of that is based on the ridiculous assumption that today Windows is fine, but not tomorrow. If you don't trust your OS vender, your fuarrrked. This shouldn't even be hard. Literally, the only cross platform security rule listed in every single information security textbook, advocated for by every single information security expert, listed #1 in "You Can't Hack My Mind.." research paper by google on security experts personal practices. But, go a head. Get memed into running a vulnerable copy of an OS you can never patch based on nebulous assumptions about its freedom from backdoors NOW.

>>5131 >Windows Update is thee backdoor TM >No body said that. Show the post id. >5685 >Windows update *is* the backdoor. And I'm the "full retard"? >5700 >If you already have this legitimized and accepted backdoor, why would you need a second, secret and obviously malicious backdoor that one of your millions of users could discover at any time? >5710 >Yes you are running Microsoft code but that's not what a backdoor it. Installing Windows gives you Windows. That's it. >5772 >The whole point of a backdoor is to have interactive control.The attacker will make decisions based on who you are and what they want from you in the future. Running code once, like in an installer is useless unless you know exactly what you want upfront or it in contains a mechanism to add more code later. >>Its insanely absured to remove a few kilobytes of gigabytes of binary data without reverse engineering and claiming to have removed the backdoor. >No body said that. Show the post id. Litterally, whole project is removing Windows update and claiming backdoor removed. Retarded. Your OS Vender has root. Most important and consistent security advice ever given for decades has been keep software patched. I didn't make this up, its my idea. This is what experts say.

>>5825 >Windows Update is thee backdoor TM Stop. Don't cut half the sentence off. >Windows Update is thee backdoor TM and some how because the size of the code doesn't change when you run windows its not backdoored. Who said this exactly? Nobody. You can't just mix and match pieces of text out of context and then quote the individual parts when someone calls bullsoykaf. >Its insanely absured to remove a few kilobytes of gigabytes of binary data without reverse engineering and claiming to have removed the backdoor. >No body said that. Show the post id. Since you ignored this I assume you couldn't figure out what random text you mixed together to get this conclusion? >claiming backdoor removed. No body said that. Show the post id. >Most important and consistent security advice ever given for decades has been keep software patched. I didn't make this up That's fine. The problem you have is understanding what other people are saying. Instead of reading the thread you are making up bullsoykaf strawmen inside your head and projecting them onto other people and then calling them retards. It's not cool.

>>5828 Pretty typical. You didn't even respond to my last post. Its clear people claimed Windows update was thee backdoor TM, and made nebulous arguments about why a second back door was unnecessary and how the installer was fixed in size and not dynamic enough to create a real backdoor. It seems the only thing you object to is the word retard.

>>5831 >You didn't even respond to my last post. More words means more things you can deliberately misunderstand and twist into retarded strawmen and then call other people retards. But ok. >Its clear people claimed Windows update was thee backdoor TM, and made nebulous arguments about why a second back door was unnecessary This is more accurate. "Nebulous" is incorrect, the arguments were very clear. >>5700 admitted they were weak arguments, but not everybody has the same high standards that you do. Everyone has a different threat model. You cannot prove that there is no backdoor inside Linux either. There are no guarantees and everything is relative. >and how the installer was fixed in size and not dynamic enough to create a real backdoor. This is completely wrong. I will try to explain again. >>5824 >So what? Windows steals all FB passwords and microsoft compiles a table they search on demand. Forget Facebook, let's use FriendFace, hot new social network of 2018. If I install Windows in 2017, there cannot be code to steal FriendFace passwords because the thing didn't exist when I installed the OS. It does not matter that MS has "root" access and the installer is "arbitrary" closed source code and whatever. The only way MS can steal my FriendFace password 1 year after I installed Windows is to inject new code into the system from the outside. That requires either Windows update or a backdoor. The backdoor maybe exists, maybe does not exist but Windows update definitely exists. >you irrationally pick 1504 as the good one TM , and declare builds after may be backdoored It's not that future versions will be backdoored. Any update from MS can be targeted at only you and contain malicious code. When you install the ISO, you get the same code as everyone else. >And even if true, not a usable solution anyway. What do you think about the setup >>5608 said? >But all of that is based on the ridiculous assumption that today Windows is fine, but not tomorrow. Yes. Nobody is trying to convince you that Windows is fine today. This project is for people who already believe that.

>>5131 Your efforts would be better spent working on an "idgaf about copyright" fork of Wine. The restrictions that hamstring development and compatibility are entirely artificial, being legal in nature rather than technical. The only advantages to abiding by these arbitrary restrictions - access to mainstream distribution channels and insulation from personal liability - are far less significant now than a quarter century ago when the Wine project began. Decentralized, distributed networks and strong encryption offer the same benefits without arbitrary restrictions, irrespective of legality in any particular jurisdiction. Taking advantage of the available windows source will speed development of a compatibility layer immensely, making exclusive GNU/Linux use possible for the largest and most likely group of new adoptees: gamers. Gamers are not ignorant of the abuse to which Windows subjects them, but lack a convenient alternative. Dual-booting is too much a burden for most, let alone setting up a VM with PCIe-passthrough. Presenting them with such an alternative - a Wine with drastically improved compatibility - will entice many of them to switch to GNU/Linux full-time. Without the bloat of Windows games could even run better - a powerful incentive to this demographic. Increased GNU/Linux usage among the economic driving force behind new hardware would incentivize manufacturers to offer better driver support. An unfettered Windows compatibility layer would not only deal a heavy blow to Microsoft, but provide shelter to countless battered souls who've never know but software that abuses them.

>>5131 no matter what these glitterboys say. you know that what you are doing is the right thing. i like what you do. keep it up guys!

>>5839 >Your efforts would be better spent working on an "idgaf about copyright" fork of Wine. The restrictions that hamstring development and compatibility are entirely artificial, being legal in nature rather than technical. That's not true. Lack of decent graphics drivers for Linux is a major technical impediment. On the one hand a hell of a lot of work goes into Windows driver development and on the other hand, no one gives a fuarrrk about Linux graphics beyond running a basic desktop environment. Working on Wine will never fix that gap. http://www.gamedev.net/topic/666419-what-are-your-opinions-on-dx12vulkanmantle/#entry5215019

>>5832 >You cannot prove that there is no backdoor inside Linux either. You have an orders of magnitude better shot at it. Source is open. Feel free to read it. I have been reading OpenBSD VFS/UFS code. But, From the beginning I have insisted you must trust your OS vender. If you can't trust your OS vender, your stuck becoming your own OS vender. I think open source is the closest to secure model we have. Anything could in principal be checked anytime. We need reproducible builds now. >Forget Facebook, let's use FriendFace, hot new social network of 2018. If I install Windows in 2017, there cannot be code to steal FriendFace passwords because the thing didn't exist when I installed the OS. It does not matter that MS has "root" access and the installer is "arbitrary" closed source code and whatever. The only way MS can steal my FriendFace password 1 year after I installed Windows is to inject new code into the system from the outside. 100% absolutely wrong. Which is why I called you a larping nogrammer. All microsoft has to do is weaken the PRG and passively observe network traffic, or include an intentional 0day remote code execution bug. Nothing upfront about friendface has to be involved at install time. >The backdoor maybe exists, maybe does not exist but Windows update definitely exists. Removing Windows Update is a backdoor. You are guaranteeing your system is vulnerable to whatever comes next. Instead of trust microsoft - which you already do if you run Windows, you decide to trust everyone and everything else not to attack your vulnerable system. >Any update from MS can be targeted at only you and contain malicious code. Any Smartscreen traffic can exploit a intentional 0day, any telementry data can exploit an intentional 0day, any google update can exploit an intentional 0day in the network stack. If you believe that microsoft not as a microsoft, but in conjunction with the state is an adversery , then you have a perversive attack who can MITM, or potentially deploy malware through partners like Google , Microsoft, Apple , Skype , etc. Any network traffic that your machine pushes out through NAT could become an exploit vector for a backdoor, it doesn't need to be Windows Update. I mean, soykaf, what about all the comcast / att routers behind your firewall (because they are your firewall) , perhaps they could exploit machines. If you are paranoid, or consider a government level APT in your threat model, host security is critical. >What do you think about the setup >>5608 said? Depends on your threat model, and your risks. Virtualizing Windows is a great start. But, if you do not trust the OS , then you have to realize that it could attack your hyper-visor. Running untrusted code is a bad idea for the long term. Providing it direct access to the graphics card is also potentially bad for security - all though how big, I am not expert enough to say - with control of a graphics card can it use DMA to dump areas of memory it should? Or draw over screens things it shouln't? I don't understand graphics cards internels well enough to know. Virtualizing Windows is a great start though - you go from Microsoft having root to Microsoft running as a user process. >Yes. Nobody is trying to convince you that Windows is fine today. This project is for people who already believe that. I think that there are plenty of people who really don't care about computer security. I'd love to see a system of modifications to Windows 10 to respect user privacy - as well as can be observed. But, removing Windows Update immeadately makes this a deal breaker for me. I can't give clients unpatched systems.

>>5839 >Your efforts would be better spent working on an "idgaf about copyright" fork of Wine. The restrictions that hamstring development and compatibility are entirely artificial, being legal in nature rather than technical. I have though about this. There is leaked Windows Source code. Forking Windows, auditing, and maintaining binary compatibility would be awesome. But, the legality is a nightmare. You would be organizing millions of volunteer man hours to ultimately produce a product that few people could use. Although, China, Russia, Europe might have an interest in a such a project. It just seems far better to spend that development effort on existing open source projects. >The only advantages to abiding by these arbitrary restrictions - access to mainstream distribution channels and insulation from personal liability - are far less significant now than a quarter century ago when the Wine project began. Decentralized, distributed networks and strong encryption offer the same benefits without arbitrary restrictions, irrespective of legality in any particular jurisdiction. I 100% agree. Hella cyberpunk too, but the average person isn't hanging around in places like that, and handing out CD's would be illegal as fuarrrk. Passing Customs could fuarrrk you. User Groups could be raided. Its a freaking nightmare for anyone subject to physical interaction with a government. I don't think graphics on linux are slow because of secret sauce in the Windows Source Code. Its graphics card companies don't want to spend development time on Open Source graphics that their competitors can leverage as well.

>>5846 >You have an orders of magnitude better shot at it. Source is open. >>5832 >Everyone has a different threat model >There are no guarantees and everything is relative. >Which is why I called you a larping nogrammer. All microsoft has to do is weaken the PRG and passively observe network traffic What is a "larping nogrammer"? What is a "PRG"? > passively observe network traffic And how do they do that exactly? If MS were redirecting all Windows traffic to their own servers, someone would have noticed. If they have a switch to enable traffic snooping for targeted users, that would be a backdoor. >Removing Windows Update is a backdoor. Stop inventing your own definition to words please. I've warning you about this multiple times now. >Any Smartscreen traffic can exploit a intentional 0day, any telementry data can exploit an intentional 0day, any google update can exploit an intentional 0day in the network stack. Ignoring the fact that those are basically egress only applications and don't expose much attack surface client side, a 0day is a security vulnerability that the vendor does not know about. There is no such thing as an "intentional" 0day, that is called a backdoor. >you have to realize that it could attack your hyper-visor. This is more or less the reason hypervisors exist. > with control of a graphics card can it use DMA to dump areas of memory it should This is the reason iommu's exist. >I am not expert omg really? I had no idea.

>>5860 >>Which is why I called you a larping nogrammer. All microsoft has to do is weaken the PRG and passively observe network traffic >What is a "larping nogrammer"? Live Action Role Playing No(t) Programmer. >What is a "PRG"? Psuedo Random Generator You just don't understand how tiny and contained a backdoor can be, it doesn't have to be an elaborate obvious subsystem. Undermining the cryptography stack, or the network stack could be enough to allow a skilled attacker to decrypt all the network traffic or command and control respectively. >> passively observe network traffic >And how do they do that exactly? If MS were redirecting all Windows traffic to their own servers, someone would have noticed. If they have a switch to enable traffic snooping for targeted users, that would be a backdoor. You litterally have no clue. A state level APT is capable of influencing ISPs who are the couriers of your traffic or even the backbone. Passive or Active Surveillance are possible. Or you get TAO QAUNTUM'd. APT attacks don't necessarily look like arp poisoning / DNS redirection client side. >Stop inventing your own definition to words please. I've warning you about this multiple times now. I am trying to put this in your language. Removing Windows update is a sure way to end up compromised if your threat model includes ANYTHING. >Ignoring the fact that those are basically egress only applications Garbage. Smartscreen, and google update and not egress only. And, beyond that , smartscreen is not a binary protocol, its built on something else, and that something whole code base is involved. Its ridiculous to claim that those are not capable of being exploited. >, a 0day is a security vulnerability that the vendor does not know about. There is no such thing as an "intentional" 0day, that is called a backdoor. Thats what I have been trying to tell you. That a backdoor, doesn't have to look like an elaborate obvious system designed explicitly for command and control, it can look like intentional errata. It can be an intentional mistake in a code path. >This is more or less the reason hypervisors exist. Not even close. The reason Hypervisors exist isn't to run untrusted operating systems. Virtualization for a few use cases almost all business - to isolate client applications on multitenent machines above containers , to allow organizations to purchase single machines and deploy its capacity to multiple servers, to allow organizations to lower the cost on deploying additional servers while keeping their own applications isolated (as my be mandated by security policy). Virtualization was not created to run untrusted proprietary operating systems. >This is the reason iommu's exist. Again, I am not an expert, but devices with DMA access have been used to exploit FDE encrypted computers. Also, a device with control of the screen could draw anything it wants on screen, even a convincing login prompt. >>I am not expert >omg really? I had no idea. I am not an expert on x86 PC Hardware. I have formal training in information security. You don't even know what a 'PRG' is. I think its pretty telling that I am willing to be honest about my limitations while you sit pretentiously pretending you understand IS when its clear you have no clue.

>>5888 >Live Action Role Playing No(t) Programmer. Interesting. I think it is possible that a large gap in skills is the reason we keep arguing past each other but I don't think it is biased in the direction you think it is. Your overconfidence and the very ridiculous nature of your strawmen reeks of Dunning Kruger. >Psuedo Random Generator You mean Psuedo Random Number Generator. I'm surprised such a master programmer like yourself would make such a basic error. >Undermining the cryptography stack, or the network stack could be enough to allow a skilled attacker to decrypt all the network traffic or command and control respectively If you have access to the data before it is encrypted why would you bother weakening the encryption system? No one is trying to convince you that Windows is backdoor free or what the backdoors look like so I don't understand why you keep going on about it. >You litterally have no clue. A state level APT is capable of influencing ISPs... blah blah blah This affects everyone not just Windows. >Removing Windows update is a sure way to end up compromised It brings new risks, we established that a long time ago. >Smartscreen, and google update and not egress only. Google update has nothing to do with MS. I don't really understand what Smartscreen is so ok. Sounds like a much more trivial thing to disable than Windows Update. >Virtualization was not created to run untrusted proprietary operating systems. This is one of the top modern use cases for hypervisors. I don't care about the history you read from your textbook. > I have formal training in information security. You should ask for your money back.

>>5888 >You don't even know what a 'PRG' is can't stop laughing

>>5894 >You mean Psuedo Random Number Generator. I'm surprised such a master programmer like yourself would make such a basic error. Yeaup. Forgot the N. Argument invalidated. >If you have access to the data before it is encrypted why would you bother weakening the encryption system? No one is trying to convince you that Windows is backdoor free or what the backdoors look like so I don't understand why you keep going on about it. If you look at existing state level attacks many have focused on weakening encryption b/c of its broad level of applicability - Virtually everything is built on a set of basic cryptoprimatives that if intentionally degraded are a huge backdoor. Having your cryptoprimatives closed source is probably a bad idea, having them closed source from an untrusted Vendor is insanity. Literally 0 security afforded. We keep discussing this is in my opinion the most likely backdoor found in Windows. And if you look, this is what state actors have invested effort into (Cf. Bullrun). >>You litterally have no clue. A state level APT is capable of influencing ISPs... blah blah blah This affects everyone not just Windows. Got it, so when my ISP redirects my smartscreen traffic from IE on my openbsd box to a payload server I will be owned. Software stacks matter. Which is the point of all this. If you don't trust the network, you absolutely must have host security. But, you want to run an OS without host security. >>Removing Windows update is a sure way to end up compromised >It brings new risks, we established that a long time ago. Bruh. Can you produce a valid threat model? In a model where you don't trust the state not to act through Microsoft, running a network stack written by Microsoft, with Microsoft Cryptoprimaitaves that are closed source makes no sense. Running it unpatched is even more epic levels of stupidity, because now, its not just the state (but also the state) you have to worry about. I can't think of a threat model where this is sensible? >>Smartscreen, and google update and not egress only. Google update has nothing to do with MS. I don't really understand what Smartscreen is so ok. Sounds like a much more trivial thing to disable than Windows Update. Its not about that. Its any egress traffic that receives any kind of response invites data back through a firewall that could be an exploit vector. Running unpatched code that you suspect maybe backdoor'd is retarded. A backdoor could hide virtually anywhere in gigabytes of binary data. >>Virtualization was not created to run untrusted proprietary operating systems. >This is one of the top modern use cases for hypervisors. I don't care about the history you read from your textbook. >https://en.wikipedia.org/wiki/Virtualization >Virtualization began in the 1960s, as a method of logically dividing the system resources provided by mainframe computers between different applications >Article doesn't include the word security at all >Main use case is VPS Your 100% wrong. Virtualization has recently been used for isolation of trusted operating systems to provide compartmentalization through projects like qubes, but this is not to say that you can run untrusted OS's virtualized and expect no risks , virtualization platforms arn't designed to run untrust worthy OSs. >You should ask for your money back. I forgot the N in PRNG . Embarrassing. Doesn't invalidate my argument.

>>5895 https://en.wikipedia.org/wiki/Pseudorandom_generator

>>5905 >I forgot the N in PRNG . Embarrassing. Doesn't invalidate my argument. Yeah, just calm down with this larping nogrammer crap. Don't assume that the basic Python they taught you at your tech cert makes you better than anyone. >Its not about that. Its any egress traffic that receives any kind of response invites data back through a firewall that could be an exploit vector. I said basically egress only because presumably the data it gets back is too small and trivial to expose any real attack surface. Don't forget that Windows is the most popular desktop OS in the world and therefor is the primary target for security research. I don't think it's likely they will be able to hide a backdoor in 100 lines of smartscreen code or whatever for very long. >Your 100% wrong. The world's entire cloud infrastructure is based on virtualization. Running untrusted code may not have been a requirement in 1960 or whenever virtual machines first became a thing but it definitely is now and the state of modern hypervisror security reflects that. >If you look at existing state level attacks many have focused on weakening encryption b/c of its broad level of applicability - Virtually everything is built on a set of basic cryptoprimatives that if intentionally degraded are a huge backdoor. Having your cryptoprimatives closed source is probably a bad idea, having them closed source from an untrusted Vendor is insanity. This may be a fair point. I don't know enough about the Windows ecosystem to know how much crypto is done in the kernel. I would have thought that libraries like openssl do everything in userspace and only get their random numbers from kernelspace. But as you pointed out, even predicable random numbers can be enough for a sophisticated attacker. >Can you produce a valid threat model? Yeah fine, let me think about it.

Cool idea and all OP, but what can this do that a spare Windows machine can't do? I just don't understand the point of all these solutions for Windows when the easiest and less stressful solution for most people would be just building or buying a Windows laptop or desktop for needed software/games and then use the Linux machine for everything else.

>>5918 >Don't assume that the basic Python they taught you at your tech cert makes you better than anyone. I write C and MIPS assembly. Not cryptocode. I was right earlier it was PRG not PRNG. You convinced me for a second by samefagging. >I said basically egress only because presumably the data it gets back is too small and trivial to expose any real attack surface. You have no idea how big that attack surface might be. >Don't forget that Windows is the most popular desktop OS in the world and therefor is the primary target for security research Smartscreen is probably built on SSL (not actually sure though..) Backdoor could require a codepath after response has valid crypto. >I don't think it's likely they will be able to hide a backdoor in 100 lines of smartscreen code Utter non-sense. We have no idea how many lines of code because we don't have the source and we haven't reverse engineered it. Its not sensible to say how many lines of code either. A backdoor needn't even have its own line of code, it could be an intentional mistake in a single other line of code. Furthermore, Smartscreen was only 1 example. Any network traffic at all could be a vector for a backdoor, Any cryptoprimative could be intentionally weakened. >The world's entire cloud infrastructure is based on virtualization Thats what i said. >definitely is now and the state of modern hypervisror security reflects that. The primary use case isn't security. They wern't designed for untrusted operating systems. They are designed to isolated operating systems. Its not out right insanity, but there are risks. Features like GPU pass through weaken security, VMWare's (who I wouldn't trust either) says it doesn't affect guest isolation. >I would have thought that libraries like openssl Linux has lots of crypto in kernel for acceleration. I don't see why there is a distincition between user and kernel space, they are all closed code that you can't trust.

>>5927 >I was right earlier it was PRG not PRNG. They are very different things. If we are talking about real world code and not ivory tower academia then PRNG is the one you want. An actual programmer would know that. >I write C and MIPS assembly srand(3) >NAME > rand, rand_r, srand - pseudo-random number generator It sounds like you are the "larper" to be honest. >We have no idea how many lines of code I would reasonably expect it to be proportional to its functionality. Its functionality being "is this website blacklisted, yes or no?". Doesn't seem like a lot room to hide a backdoor on the receiving side. >we don't have the source and we haven't reverse engineered it. >it could be an intentional mistake in a single other line of code. Don't discount the fact that legions of security researchers are actively looking for vulnerabilities inside Windows everyday. >The primary use case isn't security. Every cloud provider uses virtualization to run arbitrary untrusted customer code and non of them care about security? >Features like GPU pass through weaken security, Not if you have an iommu. >I don't see why there is a distincition between user and kernel space, they are all closed code that you can't trust. That's my mistake of course Windows provides userspace libraries too. My point is what actually uses MS crypto code? Most things you actually care about probably use openssl or libnss or something anyway. >If you don't trust your OS vender, your fuarrrked. By the way, do you trust Intel?

>>5921 Ease of use. It is really annoying to have to wait for extended periods of time just to use a machine that you use and boot rarely to play games because of forced updates. Even more rage inducing when you have advertisements in the application menu. I have no clue what the larger discussion up above is all about, Windows has been broken from the start. Should not have even included security in the OP since the OS is Windows. Like I wrote in the documentation, if you desire security, don't use Windows. You play games on it and use it offline for windows only productivity applicstions, that is the entirety of its' usecase. I don't feel like I need to speak at length as to why, if you don't know, why are you even here?

>>5931 >They are very different things. If we are talking about real world code and not ivory tower academia then PRNG is the one you want. An actual programmer would know that. lol bruh. TFW when you believe cryptocode calls srand. >https://en.wikipedia.org/wiki/Pseudorandom_generator > Common constructions of stream ciphers are based on pseudorandom generators. Go take Dan Bonehs class on cryptography and then talk to me. Your right about the skill gap for sure. But you had me convinced for a second. >It sounds like you are the "larper" to be honest. mfw. >I would reasonably expect it to be proportional to its functionality. Its functionality being "is this website blacklisted, yes or no?". Doesn't seem like a lot room to hide a backdoor on the receiving side. Utterly retarded. We have discussed how many times how an intentional mistake in a single line of code could be enough. Also, Smartscreen isn't isolated functionlaity, it will sit no doubt on top of the network stack, crypto stack, probably http protocol and xml parser. Any traffic could be a vector. So (1) smart screen isn't isolated functionality, and there is plenty of attack surface. (2) You can't just assume that small size means no room for mistake and vulnerability (as we have discussed), (3) Finally, SmartScreen is closed source, and its non-snese to talk about it functionality or its lines of code without reverse engineering it, it may be horrifically complex. >Don't discount the fact that legions of security researchers are actively looking for vulnerabilities inside Windows everyday. No doubt. But an intentional vuln, may occur in code path after cryptographic signature has been validated. Researchers may not be checking these code paths because forging the signature may not be a practical attack. >Every cloud provider uses virtualization to run arbitrary untrusted customer code and non of them care about security? Cloud providers aren't writing the software. Cloud providers are leveraging what software is out there to accomplish business goals, and it is working well enough. I am not saying its horrifically insecure. But if you consider yourself an active target for a state APT (IE. MS will send targeted updates to you personally), and untrusted OS could potentially attack your hypervisor. Hypervisors are written to isolate guest OS's , but they aren't designed as a security product. I am not saying this is a worthless measure, I think virtualizing rather than dual booting drastically reduces risk. Cloud providers aren't using GPU pass through either. >That's my mistake of course Windows provides userspace libraries too. My point is what actually uses MS crypto code? Most things you actually care about probably use openssl or libnss or something anyway. Yeah right. I suspect most apps use default Windows crypto stack. >By the way, do you trust Intel? Absolutely not. I am working on switching out of x86 to arm which is better but not great). But, in all honesty, I practice risk avoidance. Waiting for SOC with RISCV.

>>5774 >Through proper, albeit limited browsing habits and a properly written firewall it is possible to be completely protected without any security updates. >completely protected Only if your browsing habits are "don't go on the internet" and your firewall rules are "don't allow any traffic." There is no such thing as being connected to the internet and being completely unhackable.

>>5936 You don't have to get snippy, it is a valid question and it was based on the understanding that Linux is better in terms of security compared to Windows. Why pour time and energy into "fixing Windows" when the average person, tech savvy or not, can just buy a cheap computer for their Windows based software and call it a day? And the forced updates aren't even that big of a deal for a gaming only computer anyways, but then again, I use my gaming computer at least weekly. I just see this stupid attitude within non-Windows desktop OSes, oh, let's just reverse engineer Windows instead of making native Linux software or at least letting software devs know that a Linux port would be preferable. If you are just fine with Linux as it is (lacking certain things like games and whatnot) and are going to still use Windows anyways then quite honestly dealing with a few headaches with Windows Update by having a spare Windows machine makes way more sense. tl;dr I think this is a overly complicated solution for a simple problem. You don't even have to be a programmer to see that. Also, I'm here on Lainchan because I like hardware.

>>5945 >lol bruh. TFW when you believe cryptocode calls srand. I never said that. I merely used srand as an example because you claimed to be a C programmer. However, if you are going to be a dick about it then here, real world crypto code calling srand. https://github.com/openssl/openssl/blob/2139145b72d084a3f974a94accd7d9812de286e4/crypto/rand/rand_vms.c#L97 >you had me convinced for a second. Would you mind reading this comment out to the rest of the class? https://github.com/openssl/openssl/blob/2139145b72d084a3f974a94accd7d9812de286e4/crypto/rand/rand_win.c#L81 >It sounds like you are the "larper" to be honest. I don't doubt you tried really hard to "teach yourself C" or something, but you obviously don't have any real experience so stop pretending. >Absolutely not. You don't trust Intel but use it anyway and you soykaf on people who don't trust Windows but use it anyway? Seems a bit hypocritical.

>>5970 Your argument instantly vanished. >I never said that. I merely used srand as an example because you claimed to be a C programmer. However, if you are going to be a dick about it then here, real world crypto code calling srand. Noo. You called me out for using PRG , which is the correct term where you believed PRNG was correct. As it turns out, you were wrong, and you hadn't even heard of PRG. I made the comment that you belive that the core part of the block diagram for a cipher is a PRNG like srand rather than a prg. I am sure PRNG's are actually used in cryptocode for things like IV's. Its fundamentally not a shock to me that a crypto lib uses srand. It was a shock to you that PRG is a word. >Would you mind reading this comment out to the rest of the class? Lol bruh. Running Grep on git hub ? Look at line 99. > /* poll the Pentium PRG with CryptoAPI */ As I said before, i am fundamentally not surprised that a PRNG would be useful for things like IV generation. But, I believe, having taken a crypto course years ago, and seen a block diagram for common ciphers, that PRG is the correct term. Your argument that PRG doesn't exist and PRNG's (like srand) are used in their place garbage. Also, Dan Boneh has a great free mooc on the subject. >I don't doubt you tried really hard to "teach yourself C" or something, but you obviously don't have any real experience so stop pretending. No one knows your a dog on the internet. >You don't trust Intel but use it anyway I host www on ARM (b/c blog is low traffic). I just deployed OpenBSD 6.2 on ppc for a personal work station , but a G4 is limited, and I am still seeing what I can do with it. The Truth is switching away from Intel is hard. Its totally trivial to swich to Linux/BSD/FOSS and definitely provides additional security margin. > you soykaf on people who don't trust Windows but use it anyway? By all means use Windows and Don't Trust it. Just don't disingenuously pretend there is net positive security margin by removing Windows Update and running unpatched. Or that its obvious that the exclusive backdoor to windows is contained in update (which has now been disavowed but was claimed). Or that Smartscreen or other network connectivity can't be used as an attack vector for unpatched Windows. Or that a long term solution is attained by just indefinitely running Windows 1504. The truth is that running an untrusted OS ring 0 is a bad idea. Running vulnerable software against a state apt is retarded. Running vulernable software against a non-persistant threat is retarded. Forking Windows 10 1504 without source is not a possible solution that can produce any kind of product long term. Trusting some unknown party on the internet to modify your closed source OS also seems retarded to me. Why should I trust originator of project more than microsoft? In all honesty, I don't. I figure if he is dumb enough to suggest unpatched Windows as a solution to anything, I don't want him modifying any OS. >Seems a bit hypocritical. I am willing to admit the limits of Intel and have an honest conversation about it. Also, if I am going to use ME (which I wont), I would at least update the damn thing. If its backdoor'd its backdoored, leaving it vulnerable to everyone is not a better solution.

>thread is flooded by redditors derailing the discussion to Pedo Ring Generators.

>>5979 >You called me out for using PRG , What did I tell you about using half truths as strawmen? >>5846 >All microsoft has to do is weaken the PRG and passively observe network traffic I thought I showed you proof in >>5970 that it's a PRNG that MS exposes in their API. But don't worry, more is coming. >It was a shock to you that PRG is a word. The reason I asked was to give you an opportunity to correct yourself instead of pouncing on what was most likely just a typo. Instead I see that you are clinging to the hope that this Wikipedia article you don't understand represents a concept that is somehow relevant to the discussion so you can pretend that that is what you meant all along. That's fuarrrking sad. >Lol bruh. Running Grep on git hub ? Look at line 99. > /* poll the Pentium PRG with CryptoAPI */ Can't believe you faceplanted into that hole. Obviously I saw that when I made >>5970. Here's the thing, that is the only mention of a "PRG" in the codebase. A real programmer would have read the code and not blindly trusted the comments. Line 103 calls CryptGenRandom. What is CryptGenRandom? >https://en.wikipedia.org/wiki/CryptGenRandom >CryptGenRandom is a cryptographically secure pseudorandom number generator I'm getting tired of trying to counter you point for point because you keep twisting the things people say into little strawmen and then you attack the strawmen and the original points get lost in the chaff. You are either a good troll or have some kind of learning disorder. >You should ask for your money back. I wasn't joking.

>>5991 >You called me out for using PRG , >What did I tell you about using half truths as strawmen? <You mean Psuedo Random Number Generator. I'm surprised such a master programmer like yourself would make such a basic error. >I thought I showed you proof in >>5970 that it's a PRNG that MS exposes in their API. But don't worry, more is coming. Wtf are you talking about , you greped openssl's code base for 'PRNG' and discovered that openssl does actually the word prng in it. >to the hope that this Wikipedia article you don't understand represents a concept that is somehow relevant to the discussion so you can pretend that that is what you meant all along. That's fuarrrking sad. Your so pretentious. First of all none of this is even relevant. You made the retarded claim that the only way MS could steal a "friendface" password was by command and control through windows update because it was "dynamic". I think we both see clearly thats a retarded claim to make. I made a few arguments against that : 0days in network facing applications (SmartScreen, GoogleUpdate, etc.), 0days in Network Stack , or weakening cryptostack through weakening primatives. This fundamental is the right answer. Your response was pretty much to derail by claiming I used the wrong word. The irony was, I knew that word from cryptoclass, and you didn't know it was a word at all. You samefagged, and I believed I could be wrong. But, a cursory look at the wikipedia article says exactly what I said : >Pseudorandom generators have numerous applications in cryptography. >Common constructions of stream ciphers are based on pseudorandom generators. >Pseudorandom generators may also be used to construct symmetric key cryptosystems, where a large number of messages can be safely encrypted under the same key. Such a construction can be based on a pseudorandom function family, which generalizes the notion of a pseudorandom generator. I could still have been wrong. Its been years since I took that class, and I don't write crypto. But, does it even matter? This is all the tinest subargument over terms that are not relevant. Your claims have all been retarded and you have fought term by term into the weeds. >I'm getting tired of trying to counter you point for point because you keep twisting the things people say into little strawmen and then you attack the strawmen and the original points get lost in the chaff. You are either a good troll or have some kind of learning disorder. How, you are the one who derailed into this argument about correct use of 'PRG vs PRNG'. Your claims bigger claims are obviously retarded on face, which is why /tech/ boards at large don't use Windows Free of Windows update. Its also why every single information security textbook and information security professional recommends keeping code patched cross vender. There is no recognized expert saying anything like what your saying. Because its fundamentally retarded. >You should ask for your money back. I think maybe you need it to start your education. Maybe my university will offer a two for one. b/c damn man. Still waiting for that threat model.

Okay, OP, so I read your website and all of that, but for a lot of the reasons; >>5846 said, this idea is terrible. You are basically pushing an OS with no updates by ripping out Windows Update. I'm just an everyday computer user but I can already see real world issues. What if a non-tech savvy person starts using this thinking they are safe now but still do stupid things like click "GROW YOUR DICK IN THREE SECONDS!!!" ads and get some adware installed by force? That person would have been better served with Ubuntu or a properly patched Windows 10. Sure the better thing would be to teach them to not click random things but we know how people behave. What if I am dating a woman who becomes interested in privacy and decides to use this but because of the fact it's unpatched, she unknowingly ends up with a keylogger that sends data not to MS but some other malicious group that does identity theft? Now she has to deal those issues. If she needs Windows it would make more sense for her to use a fully patched install of Windows. Preferably on a separate machine. Also, you never gave me a proper answer to my first post, OP. But after reading your website, I see this does nothing better than a cheap Dell for the sole purpose of gaming and legacy software. I will never accept your "ease of use" argument, as a PC gamer, I hear that trash too much from console users. It will always be weak argument for this kind of project. A separate machine for what you need will always be better than just either tainting Linux with WINE or using harddrive space better used for family memories or what have you on a VM or in your case modding a closed source OS by gimping it's only defense. And finally, if you use Windows, you are agreeing to the non-sense that MS has in place. Why not put the effort in getting more native software on Linux, buddy? You are just giving reasons for MS to lock themselves down even more.

>>5997 >That person would have been better served with Ubuntu or a properly patched Windows 10. Yes they would, since they barely know how to use a computer. >something, something, user error Not my problem. I am not responsible for people's mistakes, if you manage to get infected and/or choose not to read the documentation, that is up to you. >If she needs Windows it would make more sense for her to use a fully patched install of Windows. Correct. Noticing a pattern here.... AME is not for everyone, as you said so yourself, >I'm just an everyday computer user Clearly you do not fall into the category of someone who would use AME. (Why do you spend time replying to this thread?) > if you use Windows, you are agreeing to the non-sense that MS has in place. Why not put the effort in getting more native software on Linux, buddy? This is laughably naive and ludicrous. You said this earlier and most likely refuse to believe it to be an unrealistic idea. Something else on the same lines that I'm sure you think is reasonable: "If everyone would just stop using money then we could finally get rid of capitalism and start using a RBE!" Hopefully you can see the absurdity in this and move past it.

>>5996 yes, okay, fine... This is now the end goal of AME: All the security updates included, as many security modifications as possible, and none of the bloat. You can read all the previously available guides on how to disable/uninstall the bloat. None of them actually do that, they are all temporary disabling the apps from running at boot. With AME, the goal was for that never to occur, and that goal was met. Now the goal is to make a version with all security updates and have it be a similar download size to the one without updates. We have decided not to release anything new until that is complete. We do have a version with updates and an ISO installer, but it is 12GB when fully packaged.

>>5996 >Wtf are you talking about , you greped openssl's code base for 'PRNG' and discovered that openssl does actually the word prng in it. No, I showed you proof that real world crypto code uses PRNGs (e.g. CryptGenRandom). MS can't backdoor their "PRG" because they don't fuarrrking have one. I can see that you have done a lot of glib book learning but you don't have any real experience writing code and this is a manifestation of that. >How, you are the one who derailed into this argument about correct use of 'PRG vs PRNG'. Because the whole disagreement is about a specific term so you cannot twist the words around like you did with every other point in this thread and that made is possible for me to show you proof that you are wrong. >Your claims bigger claims are obviously retarded on face They are retarded because you twisted my words into strawmen and projected them back onto me. I'm not playing your game anymore. If you genuinely think you have been arguing in good faith then you have a serious learning disorder. >I think maybe you need it to start your education. Actually I have a real degree, Computer Science. And guess what my day job is. You're probably running code I wrote in your pocket right now (unless you have an iPhone). No one knows you're a dog right? You call people "larping nogrammers" and you are not even a programmer yourself. I think I've successfully shown everyone that you don't have a clue what you are talking about, on any level. I'm obviously not going to convince you of that because the disconnect between your ego and your real skill level is too large. >I am willing to admit the limits of Intel and have an honest conversation about it. Wow double standards. Everyone else is a retard but you are willing to admit the limits of your tools? That's very mature of you kid. You've been discredited. Windows AME is not a fundamentally bad idea. Hopefully these nice people can move on with their thread now.

>>5997 I'd never stick my meat into a female who is that much tech illiterate which is gradually equal to retarded in current year for any thinking human being. She at least should know what free software is and be able to install Debian/Android ROMs without help. As for OP >>5131 I've seen his threads of few other boards, I think he spammed every English-speaking technology board with >100 users and got kicked out for his blatant advertising. I wonder how many people he got deluded to download his spyware. The main arguments are: Why his project with unknown binary is better than 1000 others that do everything with a PowerShell script? Why not LTSB version but some weird build pulled out of ass? Where is a shell/python script that allows to do the same thing from Linux LiveCD on installed but not running Windows? Why disable security updates but not let user choose? Proprietary software hacking is awesome, it may lead to some performance improvements and ease of copying, but making it "secure" is really pointless from this perspective since you still know nothing whats going on under the hood and have to slap blindly. Removing things decreases disk size or memory usage because it's straightforward euclidean logic, but removing "Telemetry.exe" and leaving "TotallyNotTelemetry.exe" doesn't mean you remove phoning home or backdoors.

>>6021 So wanting more native Linux software is laughable? Okay, dude. I was just interested in how many projects people come up with just to run Windows software, we build up Windows as this horrible thing and in many ways it really is but then we have all these man hours that could have been used to improve Linux, I don't see how that is an unreasonable idea. >"If everyone would just stop using money then we could finally get rid of capitalism and start using a RBE!" Hopefully you can see the absurdity in this and move past it. I don't agree with this statement, are you trying to imply that I'm some sort of communist? All I'm saying is that if one doesn't agree with what MS has laid out with their product, then just don't use it or use it by their own rules but separate from your main machine. >>6027 Uh... tech illiterate doesn't equal retarded... I do hope you've found women who already know about free software. But... > I wonder how many people he got deluded to download his spyware. That is what concerns me, he is giving people a false sense of security. A lain who may not know a ton but still helps his/her family and friends with tech might have other people install this to help them.

>>6024 >No, I showed you proof that real world crypto code uses PRNGs I really don't recall disputing that real world cryptocode code use a PRNG. I recall even saying PRNG might useful for IVs, but that crypto code didn't use srand as a cryptoprimative, or replacement for a PRG. <you twisted my words into strawmen and projected them back onto me >MS can't backdoor their "PRG" because they don't fuarrrking have one. >Actually I have a real degree, Computer Science. And guess what my day job is. You're probably running code I wrote in your pocket right now (unless you have an iPhone). No one knows you're a dog right? Well you skipped cryptoclass, because MS has a PRG underlying at least there stream ciphers like RC4. >I can see that you have done a lot of glib book learning but you don't have any real experience writing code and this is a manifestation of that. <Actually I have a real degree, Computer Science. Lol. Most people don't write their crypto, its the standard advice. >Because the whole disagreement is about a specific term <If you genuinely think you have been arguing in good faith then you have a serious learning disorder. Its absolutely not. This is a disagreement about terms under a disagreement if weakening crypto is a real vulnerability under an argument that MS is required to have "dynamic" code and that >root doesn't matter . You were claiming only command and control is possible, which I think you are now convinced is retarded. > proof that you are wrong. Please show me a recognizable expert of any kind claiming that you need "dynamic" code to be a backdoor. I have cited all types of soykaf. Please show me any recognizable expert claiming that removing Windows Update for Windows makes Windows Safer. Again, I reassert >Your claims bigger claims are obviously retarded on face and, even this micro claim is far from "proven". You greped source code to show a word is used and changed the name of the argument from PRG doesn't exist to cryptocode can't have any PRNG in it anywhere , which is of course ironic because cryptoapis expose a CSPRNG to clients. >Wow double standards. Everyone else is a retard but you are willing to admit the limits of your tools? That's very mature of you kid. I totally explain this so many ways. Hardware is much more difficult to switch out than software. Open Hardware is largely niche is still not really verifiable in anyway. That I have tried some computing to other architectures. The whole time, I haven't made ridiculous claims about how intel couldn't backdoor the cpu or that using an untrusted cpu is absolutely fine and has impact at all on anything. You have made all kinds of absurd arguments about why Windows is fine. >You've been discredited. In your mind, by fiat. >>5997 >>6022 . I'd say you have been discredited by not one single recognizable security expert agreeing with any of your opinions. You must have had a great CS degree, because it seems you are in a class of your own on information security, not one expert agrees with you. >I think I've successfully shown everyone that you don't have a clue what you are talking about, on any level. >I'm obviously not going to convince you of that because the disconnect between your ego and your real skill level is too large. Its funny to me, because you really write those words unironically. I would say those words unambiguously describe you. I'd cite as evidence your misunderstanding of what backdoors look like ("root doesn't matter", " 'dynamic code' is a requirement") , your lack of understanding of existing state efforts to compromise information security (Project Bullrun, Qauntum) , and your otherwise general lack of understanding of code ("Smartscreen is isolated and egress only and can't be used to compromise a machine"). I'd say you are astroturfing b/c you unironically change the goal posts while claiming I strawman you but never responding to my arguments, or correcting yours. I really is unfortunate that we could spend so much time arguing past each other. And that you know and even use words like dunning-kruger. Ironic, that you could save others from the dunning-kruger effect, but not yourself.

>>6024 >Actually I have a real degree, Computer Science.

>>6033 >I really don't recall disputing that real world cryptocode code use a PRNG. >>5945 >lol bruh. TFW when you believe cryptocode calls srand. >>6033 >"Smartscreen is isoLated and egress only and can't be used to compromise a machine" >>5918 >I said basically egress only because presumably the data it gets back is too small and trivial to expose any real attack surface. Don't forget that Windows is the most popular desktop OS in the world and therefor is the primary target for security research. I don't think it's likely they will be able to hide a backdoor in 100 lines of smartscreen code or whatever for very long. Either learn to read or stop making soykaf up. >>6033 ><Actually I have a real degree, Computer Science. >Lol. >>5888 >I have formal training in information security. I think CS degree + profressional kernel hacker trumps your "formal training" (which presumably means a cheap cert and working an IT helpdesk).

Try creating a wim file or something like that so it's installable the traditional USB stick way. it's the fastest and safest form of installing window$ anyway. And thank you for your efforts, I hope you will release that ISO soon. I'm updating my bookmarks.

Another good idea would be to create it using the Enterprise build as a base which has opt-out updates. So if there's another big threat like that ransomware thing that happened a year ago you can still patch your system. Removing WU altogether is a really bad idea.

>>6098 >>6099 Seconded

>>6098 >>6129 OP here, the next build will include this.