Open-source tool to enforce privacy/security best-practices on Windows, macOS(github.com)
github.com
Open-source tool to enforce privacy/security best-practices on Windows, macOS
https://github.com/undergroundwires/privacy.sexy
78 comments
> if a signature was revoked
if a certificate was revoked
(Just to prevent confusion. Someone might think that it’s possible to revoke individual signatures.)
if a certificate was revoked
(Just to prevent confusion. Someone might think that it’s possible to revoke individual signatures.)
It's a tradeoff. You can have your built-in anti-malware, or you can choose not to leak information on the files you open. Which is more important is not a "one size fits all" situation. If you shut any of that off, you should be aware of the implications, as it is a potential footgun.
It's good that things with security ramifications are separated, but they must be used with care.
It's good that things with security ramifications are separated, but they must be used with care.
Depending on your field this could be a "yeah duh" comment for you, but there is a whole set of related tools and standards for this that's common when you're doing compliance-related cybersecurity, especially on server OSes.
There's SCAP https://en.wikipedia.org/wiki/Security_Content_Automation_Pr... then a popular set of tools that implements it, for example: https://www.open-scap.org/tools/ However the rulesets "profiles" are flexible, one popular one is CIS.
There's SCAP https://en.wikipedia.org/wiki/Security_Content_Automation_Pr... then a popular set of tools that implements it, for example: https://www.open-scap.org/tools/ However the rulesets "profiles" are flexible, one popular one is CIS.
I've found one of the easiest ways to enforce privacy on Windows is using the Local Group Policy Editor, which can then be backed up using LGPO.exe from the Security Compliance Toolkit and re-imported to other machines. Another option is PowerShell Desired State Configuration which you can then use to backup your local GPO into a MOF file, and reapplied to multiple machines or even added as part of an unattended setup:
https://docs.microsoft.com/en-us/powershell/dsc/quickstarts/...
I'm glad other people are working on tools, but you'll probably realize sooner or later that a few registry edits are not sufficient to maintain privacy, and policies are really the better approach.
https://docs.microsoft.com/en-us/powershell/dsc/quickstarts/...
I'm glad other people are working on tools, but you'll probably realize sooner or later that a few registry edits are not sufficient to maintain privacy, and policies are really the better approach.
Can you explain how policies are better? They generally just cause registry entries to be written, don’t they?
They are not just written to the registry but stored in a .pol file, and not all policies are easily managed via the registry. There are hundreds of policies that impact security and privacy. With policies you can easily print a report of what is changed with descriptions, and see deprecated policies or misconfigured ones. I'd recommend anyone to try it out and see the difference for themselves as to why it is much easier to manage these using local group policies vs a bunch of registry entries.
Aren't many of those only available in pro/enterprise versions of Windows?
Yes and no... The gpedit.msc isn't included by default in Windows Home Edition, but it can easily be added:
https://windowsreport.com/enable-gpedit-windows-11/
https://windowsreport.com/enable-gpedit-windows-11/
Do you have any suggestions for privacy-enhancing GPOs?
There are too many to really point out any in particular. Here is an LGPO text file for my machine policies. These can be converted to a Policy Analyzer .PolicyRules file using LGPO.exe I believe to get more input as to what they are used for. You also have to add those policy templates (ADMX), which I have a few added for Zoom, Chrome, Firefox, LibreOffice, Office, Edge, etc.
https://dpaste.com/ARRBCVVXN
https://dpaste.com/ARRBCVVXN
Thanks!
Is this a scam?
How does disabling Gatekeeper, File Quarantine or automatic updates make a MacOS system safer? It looks like the opposite !
How does disabling Gatekeeper, File Quarantine or automatic updates make a MacOS system safer? It looks like the opposite !
FWIW, the settings you refer to are under a section entitled “Privacy over security”. Though I’m not sure there’s a strong privacy argument for disabling automatic updates or the offline-only things like (I think) Quarantine. Gatekeeper, though, as I recall, does send information about all binaries being opened.
Privacy, not security. This removes features that call home.
Those features are not disabled in their "standard" preset which they present as "recommended for everyone".
To disable gatekeeper, you need to use the "strict preset" which they describe as "not designed for daily users, it will break important functionalities".
Those features are not disabled in their "standard" preset which they present as "recommended for everyone".
To disable gatekeeper, you need to use the "strict preset" which they describe as "not designed for daily users, it will break important functionalities".
It's to do with Privacy:
Gatekeeper performs online checks to verify if an app contains known malware and whether the developer's signing certificate is revoked. Gatekeeper, file quarantine etc. are security features also designed for data collection to learn about the files and applications you have in your computer (built in anti-malware on macOS and Windows provide them a perfect excuse to harvest all your file name and file hashes to know more about you). When automatic update is enabled macOS phones Apple periodically, leaking info like your geolocation and network etc.
Gatekeeper performs online checks to verify if an app contains known malware and whether the developer's signing certificate is revoked. Gatekeeper, file quarantine etc. are security features also designed for data collection to learn about the files and applications you have in your computer (built in anti-malware on macOS and Windows provide them a perfect excuse to harvest all your file name and file hashes to know more about you). When automatic update is enabled macOS phones Apple periodically, leaking info like your geolocation and network etc.
I have not tested this app. Does it give the person running it a clear explanation of all the potentially positive and negative ramifications of the changes? If not then I think that should be a high severity enhancement. Maybe that could even be a discussion thread in and of itself here on HN giving feedback to the developer what could go wrong with each change. e.g. functionality breakage, security impact, auditing impact and so on.
Looks like it handles a lot of items 'Shut Up 10' and 'Windows 10 cleaner' does. Great to have everything rolled into one spot, customizable, and easy to understand. Great work.
I trust Shut Up 10 with my life. I'm curious if there's anything on this site not covered by it.
Do you mean 'O&O shut up 10 ++'? I only found that. It's not open source though. How come you 'trust it with your life'?
Interesting software, seems to have a lot of options, although I'm finding it difficult to read. The font is very large and an odd style.
I also can't figure out what the "REVER" option does on some entries.
Resizing the window doesn't seem to do anything, the program is fixed in the middle at a certain size.
I also can't figure out what the "REVER" option does on some entries.
Resizing the window doesn't seem to do anything, the program is fixed in the middle at a certain size.
That toggle is supposed to say REVERT.
I love it, but my work issued PC won't let me run any of the .bat files generated or install other FOSS apps such as freetubeapp.io. I wish I knew a way around Windows Defender Smartscreen managed by my company.
Use a non-work PC for non-work stuff?
I do use a Linux PC for all personal stuff. I still want to make my work life a bit more private since MS seems to have made a business of knowing everything they can about workers.
One of the quickest ways to get fired is to try and circumvent your work computer stuff, better to find another job where they dont lock you down so hard.
That depends on what you are doing and your position. IT must expect senior hackers will try to find ways to improve their setup. I wish more companies would recognize that it is not wise to have their workers surveilled by external companies and instead setup these machines with tight privacy by default.
Better to give you less privileges than too many. And if you really need the freedom to things that you can’t. You could always use VMs, if needed.
If you can install and use virtual machines you can use hypervisor escapes - any company that lets you do that probably isn't in the list of super locked down envs (or if it is its probably for a great reason.)
I'm curious, does the company-issue PC also prevent you from opening CMD and PowerShell? (If not, you can probably paste the commands directly there; or create a .bat file yourself as suggested in a sibling comment. But as another comment points out, trying to circumvent company restrictions is risky. Ideally you'd just have to ask IT to do it for you, until they get tired of fulfilling your requests and give you access to your machine.)
Creating the .bat file yourself and pasting the generated code manually should allow you to run the file as admin.
privacy/security best-practices is to block the running of .bat files
edit: misunderstood the intention is not to install this tool/repo, but use the scripts it generates.
You click on options and it generates code that is clearly readable on the right panel. You then have the option to copy paste it yourself or download the file. Then you can read the generated bat file before running it.
It's not JS either.
It's not JS either.
Using Windows or macOS in the first place already runs afoul of best practices for privacy and security.
Yeesh. MacOS is years ahead of Linux re: several important security features -- disk encryption, SecureBoot, TPM, immutable root FS.
Glibly pretending it ain't so isn't making Linux better.
Glibly pretending it ain't so isn't making Linux better.
The ones you mention can be had on Linux too (optionally, as everything, of course). But one place where the Linux ecosystem is really behind is running untrusted applications.
> ones you mention can be had on Linux too
First, agreed re: untrusted apps.
And, yeah, maybe I should have been more clear, as you note, they are usually an option, not the standard. Full disk encryption is the standard on MacOS. With Linux, like so many things, you never know what you're going to get. Secure boot took some work to setup on Ubuntu, but works relatively flawlessly. Immutable root filesystem is something you can do with Fedora Silverblue and a few other distros, but it's nowhere near the standard it is on MacOS.
And that's what I mean by years behind, sure you can do basically anything on Linux, but, if it's not the standard, is it even practical enough to be workable? Linux, for lack of a better word, bigots (and I'm a huge Linux fan!) may call MacOS is a toy OS, but, for a laptop, how much work does it take to get Linux to the point where Linux's practical security is similar to MacOS? Lots, and lots, and lots.
First, agreed re: untrusted apps.
And, yeah, maybe I should have been more clear, as you note, they are usually an option, not the standard. Full disk encryption is the standard on MacOS. With Linux, like so many things, you never know what you're going to get. Secure boot took some work to setup on Ubuntu, but works relatively flawlessly. Immutable root filesystem is something you can do with Fedora Silverblue and a few other distros, but it's nowhere near the standard it is on MacOS.
And that's what I mean by years behind, sure you can do basically anything on Linux, but, if it's not the standard, is it even practical enough to be workable? Linux, for lack of a better word, bigots (and I'm a huge Linux fan!) may call MacOS is a toy OS, but, for a laptop, how much work does it take to get Linux to the point where Linux's practical security is similar to MacOS? Lots, and lots, and lots.
The fallacy is in wanting to run "untrusted" applications. If you don't trust them, you should not run them.
The 90s called, they want their OS fanboy flamebait back
.sexy is not an appropriate domain name for these things imho
"Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead."
https://news.ycombinator.com/newsguidelines.html
All we get out of generic tangents like this is a tedious, offtopic subthread that often ends up being much larger than the on-topic discussion, and usually descends into flamewar after a while—perhaps because the mind resorts to indignation to amuse itself in the absence of anything interesting (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...).
https://news.ycombinator.com/newsguidelines.html
All we get out of generic tangents like this is a tedious, offtopic subthread that often ends up being much larger than the on-topic discussion, and usually descends into flamewar after a while—perhaps because the mind resorts to indignation to amuse itself in the absence of anything interesting (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...).
It is a useful resource (the more people are aware the better kind) but as others have pointed out the TLD will be blocked by many software/browsers and inhibit the broad distribution of the content via that fqdn.
Thank you.
I don't see any problem with it.
It is just a word. A word that carries far more weight than it really should in our society.
I kinda like the idea of "privacy is sexy" which is how I read it.
The only possible issue is I can see some companies blocking it due to "Sex" but that's their issue with way too strong rules.
It is just a word. A word that carries far more weight than it really should in our society.
I kinda like the idea of "privacy is sexy" which is how I read it.
The only possible issue is I can see some companies blocking it due to "Sex" but that's their issue with way too strong rules.
"carries far more weight than it really should in our society"
If it should or shouldn't carry the weight is irrelevant, "Sexy" does carry weight so surely the problem is obvious.
Besides, speaking from first hand experience, historically 'sexy' content on the internet usually came with a Malware/Virus, not a good association when the intention is to run scripts that make significant changes to your computer configuration, all for a novelty that lends nothing to the product.
With that being said, I have no issue with it personally.
If it should or shouldn't carry the weight is irrelevant, "Sexy" does carry weight so surely the problem is obvious.
Besides, speaking from first hand experience, historically 'sexy' content on the internet usually came with a Malware/Virus, not a good association when the intention is to run scripts that make significant changes to your computer configuration, all for a novelty that lends nothing to the product.
With that being said, I have no issue with it personally.
“sexy”, definition:
1. Arousing or tending to arouse sexual desire or interest.
2. Highly appealing or interesting; attractive.
3. Having sexual appeal; suggestive of sex.
While #2 might be the intent, there are much better alternative choices for links that I could
* send to my 10 year old niece who is interested in tech
* share with co-workers or on company forums
* use without hassle from automated filtering/proxy/scanning tools for a TLD that is associated with adult content
1. Arousing or tending to arouse sexual desire or interest.
2. Highly appealing or interesting; attractive.
3. Having sexual appeal; suggestive of sex.
While #2 might be the intent, there are much better alternative choices for links that I could
* send to my 10 year old niece who is interested in tech
* share with co-workers or on company forums
* use without hassle from automated filtering/proxy/scanning tools for a TLD that is associated with adult content
Which sentence is more offensive?
- Privacy is sexy
- Don't let Microsoft kill privacy
The answer probably depends where you live. Stereotypically, Americans are afraid of sex, and Europeans are afraid of violence - for example many video games released in Germany were modified to have green blood.
My take: both sides of the pond need to lighten up
- Privacy is sexy
- Don't let Microsoft kill privacy
The answer probably depends where you live. Stereotypically, Americans are afraid of sex, and Europeans are afraid of violence - for example many video games released in Germany were modified to have green blood.
My take: both sides of the pond need to lighten up
It's very off-putting, I agree.
Why?
Technical reasons:
- more likely to be blocked by web filtering
- the TLD is intended for "risqué content" according to the registrar
- the TLD is more expensive due to the novelty, a novelty which negatively impacts the reputation as indicated here by some.
- It can lead to awkward situations when browsing or sharing with others if people assume the content to be related to the URL.
Most of that is related to how other people would behave, not really with the URL being “off-putting”, though.
You mean, other than the obvious reason that any corporate firewall will probably block it and send notifications to your manager?
I mean, do whatever, but there's a certain irony to something which is about privacy and security forcing you to pollute your search history with the word 'sexy' in a way that you cant control locally.
I mean, do whatever, but there's a certain irony to something which is about privacy and security forcing you to pollute your search history with the word 'sexy' in a way that you cant control locally.
HN has a sort of hilarious amount of puritan sentimentality when you look at comment patterns at large
[deleted]
I am not coming from that angle. I just find the branding to be poorly executed and would be concerned about TLD blocking.
HN gives me Reddit vibes nowadays. Same opinions, but with more text and less images.
HN gives me reddit-from-5-years-ago vibes. Reddit today is unreadable for me.
What if some kid will show this domain? In some cultures it is unacceptable to have a talk with kids about sex.
"sexy" is so whitebread it's on daytime tv and op-ed headlines. Other cultures are already exposed to this if they are consuming Western media in the first place, how they deal with it is on them.
Some of that other cultures use to hate Western one. Doesn't they have or deserve a right to be kind of shy?
Their being shy is of no consequence, it doesn't necessitate an imperative for self-censorship on the part of the Westerner on the conceit that some outsider interest groups hypothetically might not like x/y/z.
people here are too easily offended
I am not offended, I just find it in bad taste, along with the poorly-executed interface styles.
It's just my opinion anyway.
It's just my opinion anyway.
lukestateson(1)
Your comment is not an appropriate comment.
EDIT: This is according to the HN guidelines: “Please don't complain about tangential annoyances—things like article or website formats, name collisions, or back-button breakage. They're too common to be interesting.”.
EDIT: This is according to the HN guidelines: “Please don't complain about tangential annoyances—things like article or website formats, name collisions, or back-button breakage. They're too common to be interesting.”.
It is a useful resource but as others have pointed out the TLD will be blocked by many software/browsers and inhibit the broad distribution of the content via that fqdn.
Thank you.
Thank you.
The only thing one could argue for in a privacy oriented manner is the signature validation with OCSP checks since it somewhat leaks what signature owners you're trying to check. But without it you'll never be able to find out if a signature was revoked, including self-signed signatures.