Embedding an EXE inside a .REG file with automatic execution(x86matthew.com)
x86matthew.com
Embedding an EXE inside a .REG file with automatic execution
https://www.x86matthew.com/view_post?id=embed_exe_reg
99 comments
I actually miss the .ini files of early DOS / Windows days, with the defacto convention of storing them in their related program directory.
They were easy to examine and edit with text tools, and you could do things like diffs. And when you delete the program directory, they go away as well.
I used Total Uninstall on a couple Windows 7 workstations for over a decade and really paid attention to curating my registry against bloat. Almost every software out there leaves waste behind in your registry after you uninstall it.
I reported some of the most egregious cases to developers/publishers over the years... a few even got fixed.
But the ecosystem is a mess. I'm not sure Microsoft ever realized the importance of hammering on best practices and providing the tooling to make them effortless to follow. Even their internal teams have done some ugly stuff over the years.
They were easy to examine and edit with text tools, and you could do things like diffs. And when you delete the program directory, they go away as well.
I used Total Uninstall on a couple Windows 7 workstations for over a decade and really paid attention to curating my registry against bloat. Almost every software out there leaves waste behind in your registry after you uninstall it.
I reported some of the most egregious cases to developers/publishers over the years... a few even got fixed.
But the ecosystem is a mess. I'm not sure Microsoft ever realized the importance of hammering on best practices and providing the tooling to make them effortless to follow. Even their internal teams have done some ugly stuff over the years.
> Almost every software out there leaves waste behind in your registry after you uninstall it.
I think this is just a design flaw of the implementation itself.
Why couldn't every entry have a few more fields under the hood:
In this example, references to actual installed programs would make sure that when you have orphaned data it can be removed automatically (or the choice given to you), much like apt might suggest that you have some packages that aren't used by any other piece of software anymore.
For informative purposes, maybe also add:
I think this is just a design flaw of the implementation itself.
Why couldn't every entry have a few more fields under the hood:
programsDependingOnThisEntry: [PROGRAM_FOO, PROGRAM_BAR]
In this example, references to actual installed programs would make sure that when you have orphaned data it can be removed automatically (or the choice given to you), much like apt might suggest that you have some packages that aren't used by any other piece of software anymore.
For informative purposes, maybe also add:
entryFirstAdded: 2005.05.15 14:00
entryLastChanged: 2006.11.04 17:35
entryLastRead: 2008.10.13 13:00
Interestingly - as the article argues the registry is basically a crappy filesystem - the real (NTFS) filesystem already has all three of those date entries (created, modified, accessed).
I agree it would be nice of all data could be seamlessly associated with the programs that have touched it. I think Android/Apple kind of do this by giving each app its own storage sandbox / directory (to some extent).
I agree it would be nice of all data could be seamlessly associated with the programs that have touched it. I think Android/Apple kind of do this by giving each app its own storage sandbox / directory (to some extent).
Same here, there was nothing wrong with them.
Microsoft has been pushing for xml configuration files alongside applications, but even their own teams don't listen, so here we are.
Microsoft has been pushing for xml configuration files alongside applications, but even their own teams don't listen, so here we are.
>Anyway once you've persuaded the user to import a .reg file as administrator, it's game over.
relevant Raymond Chen https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91...
relevant Raymond Chen https://devblogs.microsoft.com/oldnewthing/20150923-00/?p=91...
> (It's similar to persuading a Linux user to unpack a tarball over /etc)
Would this allow for arbitrary code execution? Curious as a Linux amateur
Would this allow for arbitrary code execution? Curious as a Linux amateur
Sure; the list of startup services is maintained there, for one (in one of a number of ways), but a variety of programs allow the administrator to configure hooks to execute when something happens as well. Then there are lists of variables that are in fact shell scripts, names of users’ configured shells, mount options, kernel modules, ... . Arbitrary code execution immediately (as opposed to after next reboot or at least a service’s configuration being reloaded) seems harder, but I expect it to be possible as well.
ETA: Took a couple of minutes, huh. A sibling comment mentions the dynamic linker, which apparently maintains a cache of well-known library locations in /etc. This yields execution as soon as a new dynamically linked executable is started, which probably qualifies as immediate. (More care would be required to avoid breaking the system in the process, though.)
ETA: Took a couple of minutes, huh. A sibling comment mentions the dynamic linker, which apparently maintains a cache of well-known library locations in /etc. This yields execution as soon as a new dynamically linked executable is started, which probably qualifies as immediate. (More care would be required to avoid breaking the system in the process, though.)
you could put a cron entry by dumping a file into /etc/cron.d/
run any command as any user once a minute
run any command as any user once a minute
Or put something into /etc/profile.d and run at every shell startup, or put something into /etc/ld.so.conf.d and inject code into every process started on the system, or put something into /etc/init.d and run at every boot... (continue ad infinitum)
If you let code overwrite the files that make up your system configuration, you're going to have a Bad Time on any OS; this isn't somehow specific to Windows and the registry.
If you let code overwrite the files that make up your system configuration, you're going to have a Bad Time on any OS; this isn't somehow specific to Windows and the registry.
/etc/inittab
This could be useful in places where you need to deliver something to someone who trusts you, but corp policies get in the way. I’m talking not maliciously. There a cases where you’re admin but still can’t quite run something, or download an exe, but this might get past.
They can't download an exe, but can download a .reg file, modify RunOnce, run powershell scripts, scripts that write an executable, and run that executable?
I mean, maybe that's a use case, sure, but I'm not likely to remember this is in my toolbox, much less assume it'll ever work.
I mean, maybe that's a use case, sure, but I'm not likely to remember this is in my toolbox, much less assume it'll ever work.
why not executing the .exe and it doing it for you?
In my (admittedly biased) view, microsoft sacrificed security in the name of "usability". The problem is with what they considered "usability". It looks like in their view, "easy of use" simply meant "keep it working the way users are used to do". This created many bad habits in windows users: always clicking next, installing software from untrusted sources, hiding extensions of files, need for the user to install drivers after pluging a device, use of administrator rights even for simple tasks, rebooting the computer to make something work, periodic reinstalling the OS to make it faster.... and many other behaviors that are very very strange for people who don't use windows.
The other problem it created is that windows users expect things to be like that. Even if something is better they will have difficulty using it if it is different from how windows users are used to. Certainly this helps to keep windows market while making everybody pay a hefty price.
I'd bet if it wasn't because of android, ios and smart tv's; because they are different enough from what users think a "computer" is; windows users would expect a port to connect some form of media for software installation on these devices.
These habits afflict even power users, developers and administrators. Just consider how long windows lived without a reasonable powerful command line. I was more than once looked down from "windows experts" because for them, using a command line like is commonly done on linux is a "thing of the past".
People should learn some windows behaviors are not normal. Your computer shouldn't get slower over time, installing software from untrusted sources is not normal, an extension is part of the name of a file and it should not be hidden, using the computer as administrator should be reserved for administrator tasks only, your desktop area is not /tmp/, drivers belong to the kernel and devices should work as soon as they are plugged in, the command line is not a thing of the past...
We are all paying the price for not killing these myths.
The other problem it created is that windows users expect things to be like that. Even if something is better they will have difficulty using it if it is different from how windows users are used to. Certainly this helps to keep windows market while making everybody pay a hefty price.
I'd bet if it wasn't because of android, ios and smart tv's; because they are different enough from what users think a "computer" is; windows users would expect a port to connect some form of media for software installation on these devices.
These habits afflict even power users, developers and administrators. Just consider how long windows lived without a reasonable powerful command line. I was more than once looked down from "windows experts" because for them, using a command line like is commonly done on linux is a "thing of the past".
People should learn some windows behaviors are not normal. Your computer shouldn't get slower over time, installing software from untrusted sources is not normal, an extension is part of the name of a file and it should not be hidden, using the computer as administrator should be reserved for administrator tasks only, your desktop area is not /tmp/, drivers belong to the kernel and devices should work as soon as they are plugged in, the command line is not a thing of the past...
We are all paying the price for not killing these myths.
> drivers belong to the kernel
Pre-Windows Vista, Sound drivers were responsible for a double digit % of Windows crashes.
So they got ripped out.
And video cards drivers aren't exactly the most famously reliable bits of code, having the entire display subsystem be restartable is an amazing boon to stability.
> Your computer shouldn't get slower over time
Wish someone told my Android phone that!
> installing software from untrusted sources is not normal
> devices should work as soon as they are plugged in,
That is one of the things Windows popularized. Auto-mount is a Linux thing. Heck I remember circa 2005 being yelled at online because I expected my USB mouse to work under Linux when I plugged it into my laptop, something Windows had been doing since 1997 or so.
Pre-Windows Vista, Sound drivers were responsible for a double digit % of Windows crashes.
So they got ripped out.
And video cards drivers aren't exactly the most famously reliable bits of code, having the entire display subsystem be restartable is an amazing boon to stability.
> Your computer shouldn't get slower over time
Wish someone told my Android phone that!
> installing software from untrusted sources is not normal
> devices should work as soon as they are plugged in,
That is one of the things Windows popularized. Auto-mount is a Linux thing. Heck I remember circa 2005 being yelled at online because I expected my USB mouse to work under Linux when I plugged it into my laptop, something Windows had been doing since 1997 or so.
The windows driver architecture is great. The Linux approach of mainlining everything and having things ‘just work’ seems great until you come across an unsupported device. Suddenly every routine kernel update becomes a chore of compiling modules and praying it still works. TV tuner cards for example are still a barrel of fun
At least with Linux drivers, if your new device has a similar model in the kernel already, then copying that code + making adjustments for your own purpose works.
Or even tweaking compile settings for existing drivers to adjust to a new scenario. eg adjusting blacklist entries for samsung ssds trim settings ~recently.
Or even tweaking compile settings for existing drivers to adjust to a new scenario. eg adjusting blacklist entries for samsung ssds trim settings ~recently.
I was using USB mice in the late 90s on Linux when all we had was USB 1.x era mice and they were complete garbage, but so were the PS/2 mice, so I decided to live in the future.
So, uh, what? When was there a time that USB mice didn't work, unless it was semi-intentional misconfiguration of X (which makes your criticism one of pre-modern X, not of Linux; and of which, you'd be preaching to the choir)?
So, uh, what? When was there a time that USB mice didn't work, unless it was semi-intentional misconfiguration of X (which makes your criticism one of pre-modern X, not of Linux; and of which, you'd be preaching to the choir)?
I'm quite sure in 2005 usb mice worked fine on linux.
mount is for filesystems not for other stuff.
I guess your distribution just didn't ship the needed Xorg config and at the time xorg wasn't autoconfiguring input devices.
mount is for filesystems not for other stuff.
I guess your distribution just didn't ship the needed Xorg config and at the time xorg wasn't autoconfiguring input devices.
The history of Linux peripheral autoconfiguration is a long and very tangled story.
Please don't lecture other people on the Internet before you commit to further understanding either OS.
Please don't lecture other people on the Internet before you commit to further understanding either OS.
There was never a moment when you could mount a usb mouse. This has never worked, the above commenter was just mistakenly remembering.
I have a generic USB mouse that doesn't work even on present day Linux. Works just fine on Windows.
Must be some terrible hardware because I haven't seen a USB mouse have OS-specific issues in two decades.
I bet it's a $5 mouse from the turn of the millenium.
I bet it's a $5 mouse from the turn of the millenium.
I have a mouse that will blue screen Windows Server at boot but works fine under Linux.
I have a USB mouse with 12 side buttons, and it "just works" because USB HID.
> Pre-Windows Vista, Sound drivers were responsible for a double digit % of Windows crashes.
I sound drivers on linux have historically being (somtimes buggy but) extremely stable. I don't think it has anything to do with them belonging to the kernel; but I do get your point in terms of crashing potential.
> And video cards drivers aren't exactly the most famously reliable bits of code, having the entire display subsystem be restartable is an amazing boon to stability.
This is something I envy on windows: I once saw a warning on windows explaining that the display was restarted because the driver crashed and wondered that on linux I'd have to login through the network to do the same and would still lose everything that was running under X. Video drivers have been also so stable that it has been a non problem nevertheless.
>> Your computer shouldn't get slower over time
>Wish someone told my Android phone that!
Although I hear windows users saying that third party software are to blame and that windows 11 is better in this regard, this has not being what I saw with people who bought recent windows computers.
>That is one of the things Windows popularized. Auto-mount is a Linux thing. Heck I remember circa 2005 being yelled at online because I expected my USB mouse to work under Linux when I plugged it into my laptop, something Windows had been doing since 1997 or so.
In 1997 I can't tell much about how hot plugging would work with a USB mouse on linux. But my experience is much better than on windows these days. It is funny I plug a keyboard on a friend's computer and windows says "installing driver software for hardware..." and wastes some time installing a driver that should already been installed because the other keyboard already is a USB keyboard.
I sound drivers on linux have historically being (somtimes buggy but) extremely stable. I don't think it has anything to do with them belonging to the kernel; but I do get your point in terms of crashing potential.
> And video cards drivers aren't exactly the most famously reliable bits of code, having the entire display subsystem be restartable is an amazing boon to stability.
This is something I envy on windows: I once saw a warning on windows explaining that the display was restarted because the driver crashed and wondered that on linux I'd have to login through the network to do the same and would still lose everything that was running under X. Video drivers have been also so stable that it has been a non problem nevertheless.
>> Your computer shouldn't get slower over time
>Wish someone told my Android phone that!
Although I hear windows users saying that third party software are to blame and that windows 11 is better in this regard, this has not being what I saw with people who bought recent windows computers.
>That is one of the things Windows popularized. Auto-mount is a Linux thing. Heck I remember circa 2005 being yelled at online because I expected my USB mouse to work under Linux when I plugged it into my laptop, something Windows had been doing since 1997 or so.
In 1997 I can't tell much about how hot plugging would work with a USB mouse on linux. But my experience is much better than on windows these days. It is funny I plug a keyboard on a friend's computer and windows says "installing driver software for hardware..." and wastes some time installing a driver that should already been installed because the other keyboard already is a USB keyboard.
> Wish someone told my Android phone that!
I feel like this is mostly due to flash wear on under-provisioned flash chips.
I feel like this is mostly due to flash wear on under-provisioned flash chips.
90% of what you said about Windows stopped being true at least 7 years ago, it doesn't get slower anymore, you don't need to reboot all the time, users are not admins, ...
> installing software from untrusted sources is not normal
Funny, because you also hear exactly the opposite critique here all the time: trusted sources (App Store/Google Play/Windows Store/macOS Store) are walled gardens and represent a war against general computing and owning your device. I know you meant the Linux package repositories, but it applies to all stores.
> installing software from untrusted sources is not normal
Funny, because you also hear exactly the opposite critique here all the time: trusted sources (App Store/Google Play/Windows Store/macOS Store) are walled gardens and represent a war against general computing and owning your device. I know you meant the Linux package repositories, but it applies to all stores.
Exactly. I for one, love the fact that I can find some old or niche game or hobbyist program, get it directly from their website, install it, and use it that simply.
Sure I use the package manager in linux, and the google play store on android, and brew on mac, but they're all very limited and clunky by comparison. There is (relatively) little software for them. And if you want something older, or that isn't in the mainstream package manager, then you have to do unpleasant workarounds to trick or coerce the system into installing it. Then once you install something you have to hunt to find it, and there are bits scattered all over the system.
That's one thing I don't like about Windows, is that while it got much better at everything else, it also inherited the 'scatter stuff everywhere when installing' mentality from linux (or somewhere), and even went a step beyond that with the registry.
But at least we're beyond the days of 'DLL hell' and programs are usually pretty good about uninstalling themselves now. And there is some benefit to having user data under the user directory (especially for backups), although that could be an easy checkbox option during install or configuration.
Still would be better if 'portable program' style installation, where you just unzip it in a directory and there it is, the whole thing, right where you put it, was the default.
Sure I use the package manager in linux, and the google play store on android, and brew on mac, but they're all very limited and clunky by comparison. There is (relatively) little software for them. And if you want something older, or that isn't in the mainstream package manager, then you have to do unpleasant workarounds to trick or coerce the system into installing it. Then once you install something you have to hunt to find it, and there are bits scattered all over the system.
That's one thing I don't like about Windows, is that while it got much better at everything else, it also inherited the 'scatter stuff everywhere when installing' mentality from linux (or somewhere), and even went a step beyond that with the registry.
But at least we're beyond the days of 'DLL hell' and programs are usually pretty good about uninstalling themselves now. And there is some benefit to having user data under the user directory (especially for backups), although that could be an easy checkbox option during install or configuration.
Still would be better if 'portable program' style installation, where you just unzip it in a directory and there it is, the whole thing, right where you put it, was the default.
> I for one, love the fact that I can find some old or niche game or hobbyist program, get it directly from their website, install it, and use it that simply.
That hasn't been my experience at all. I have lots of old games on my Steam account and playing them on the latest Windows turned out to be impossible. Many games don't even start due to DLL hell. I even hunted down and installed old DirectX versions to no avail.
So much for Microsoft's legendary backwards compatibility. Wouldn't it be hilarious if one day it turns out Wine is the best way to play these games?
That hasn't been my experience at all. I have lots of old games on my Steam account and playing them on the latest Windows turned out to be impossible. Many games don't even start due to DLL hell. I even hunted down and installed old DirectX versions to no avail.
So much for Microsoft's legendary backwards compatibility. Wouldn't it be hilarious if one day it turns out Wine is the best way to play these games?
> Wouldn't it be hilarious if one day it turns out Wine is the best way to play these games?
One day?
One day?
Yeah, maybe it already is. I haven't tried it recently, it's been a while since I played Steam games.
> it doesn't get slower anymore
It absolutely does. I have friends running the latest Windows who still report speedups after reinstalling. Who knows what sort of cruft silently accumulates in a Windows system?
> you don't need to reboot all the time
You absolutely do. Not only do users still have to reboot, Windows has become ridiculously aggressive about rebooting and updating. It doesn't matter what users are doing, it will stop everything and spend an hour applying updates, rendering the computer useless because obviously people have nothing better to do than watch the computer reboot itself continuously while a progress percentage slowly increases on the screen.
It absolutely does. I have friends running the latest Windows who still report speedups after reinstalling. Who knows what sort of cruft silently accumulates in a Windows system?
> you don't need to reboot all the time
You absolutely do. Not only do users still have to reboot, Windows has become ridiculously aggressive about rebooting and updating. It doesn't matter what users are doing, it will stop everything and spend an hour applying updates, rendering the computer useless because obviously people have nothing better to do than watch the computer reboot itself continuously while a progress percentage slowly increases on the screen.
Running Windows 11 here, tons of stuff installed, including bloated Visual Studio 2022 with almost everything. Runs great, but I do have a beast of a machine.
I routinely have weeks of uptime, rebooting only to update...usually a 5 minute affair. I don't think an hour long update for Windows 11 even exists.
You are right about Windows being aggressive about wanting to reboot and update, though you're able to configure 'active hours' for this to happen outside of normal usage. Furthermore, you can use the Group Policy editor to fully customize every aspect of how Windows Update works if you're running Pro, Enterprise, or Educational SKUs, thereby disabling auto-reboot if you desire.
I routinely have weeks of uptime, rebooting only to update...usually a 5 minute affair. I don't think an hour long update for Windows 11 even exists.
You are right about Windows being aggressive about wanting to reboot and update, though you're able to configure 'active hours' for this to happen outside of normal usage. Furthermore, you can use the Group Policy editor to fully customize every aspect of how Windows Update works if you're running Pro, Enterprise, or Educational SKUs, thereby disabling auto-reboot if you desire.
> I don't think an hour long update for Windows 11 even exists.
One such update just happened a few hours ago at work.
So I'm doing my job and Windows randomly loses its connection to the internet in the middle of my work. Who even knows why? This happens every day at work and only rebooting fixes it. So I Alt+F4 at the desktop to open the reboot/shutdown dialogue and it says "Reboot and update". I scroll up to another option that says "Reboot", and only "Reboot", and start the process.
Of course the goddamn thing starts updating the second it boots back up. Not only did it disrespect explicit my choice, it wasted 48 minutes of my time doing stuff that doesn't get me paid. I know exactly how much money that time is worth. Do I get to send a bill to Microsoft?
One such update just happened a few hours ago at work.
So I'm doing my job and Windows randomly loses its connection to the internet in the middle of my work. Who even knows why? This happens every day at work and only rebooting fixes it. So I Alt+F4 at the desktop to open the reboot/shutdown dialogue and it says "Reboot and update". I scroll up to another option that says "Reboot", and only "Reboot", and start the process.
Of course the goddamn thing starts updating the second it boots back up. Not only did it disrespect explicit my choice, it wasted 48 minutes of my time doing stuff that doesn't get me paid. I know exactly how much money that time is worth. Do I get to send a bill to Microsoft?
This is almost always down to third party software and people installing tons of junk software that starts with the machine. My laptop that I've used every day for 6 years is still as fast as it was when I got it.
The difference between stores and repositories is the ability to add your own sources that you may or may not trust, making it not a walled garden.
(And yes, that does make snaps a walled garden)
(And yes, that does make snaps a walled garden)
This is a great point regarding walled garden vs repositories with respect to choice.
The original point though was implying repositories were better because they are trusted.
However if choice allows trusting a new repository you just came across, choice similarly is fine to trust an .exe from the internet too.
Not advocating for random .exe installing BTW. But honestly, for 99% of what we do we make trust choices based off Reputation and Probability guesses for outcome. We mostly don't have a clue what the executable code will do exactly.
In this case, I have a hunch that a well known repository is likely not to feed me malware. But I also figure that VLC/7-zip/notepad++ probably won't either. So will happily download their .exe. And I don't want anyone removing that option.
The original point though was implying repositories were better because they are trusted.
However if choice allows trusting a new repository you just came across, choice similarly is fine to trust an .exe from the internet too.
Not advocating for random .exe installing BTW. But honestly, for 99% of what we do we make trust choices based off Reputation and Probability guesses for outcome. We mostly don't have a clue what the executable code will do exactly.
In this case, I have a hunch that a well known repository is likely not to feed me malware. But I also figure that VLC/7-zip/notepad++ probably won't either. So will happily download their .exe. And I don't want anyone removing that option.
>90% of what you said about Windows stopped being true at least 7 years ago, it doesn't get slower anymore, you don't need to reboot all the time, users are not admins, ...
I call bullshit.
If you're not an admin, there's a whole host of things you just can't get done, and just makes life miserable for me, because that implicit suggestion that "some special person" should fo things scares users away from actually learning wtf it is they are doing. Systems do bog down over time, as evidenced by the need to clean up the massive amount of lint/waste that tends to be accrued over time. S-mode is an abomination. The effing continuous reboots as soon as you need to do something are the bane of my existence.
The Windows computer has become more anti-user over time, arguably anti-admin, and I'm just getting to the point of saying "fuck this shit, I'm out". I'm done being the guy M$oft devs externalize the costs of their lack of care to. Or maybe I'm becoming just like them with age in a sense.
t. Multi-household maintainer/debugger of all things technical
I call bullshit.
If you're not an admin, there's a whole host of things you just can't get done, and just makes life miserable for me, because that implicit suggestion that "some special person" should fo things scares users away from actually learning wtf it is they are doing. Systems do bog down over time, as evidenced by the need to clean up the massive amount of lint/waste that tends to be accrued over time. S-mode is an abomination. The effing continuous reboots as soon as you need to do something are the bane of my existence.
The Windows computer has become more anti-user over time, arguably anti-admin, and I'm just getting to the point of saying "fuck this shit, I'm out". I'm done being the guy M$oft devs externalize the costs of their lack of care to. Or maybe I'm becoming just like them with age in a sense.
t. Multi-household maintainer/debugger of all things technical
> If you're not an admin, there's a whole host of things you just can't get done
I can replace this with:
> if you can't `sudo`, there's a whole host of things you just can't get done
I can replace this with:
> if you can't `sudo`, there's a whole host of things you just can't get done
> Funny, because you also hear exactly the opposite critique here all the time: trusted sources (App Store/Google Play/Windows Store/macOS Store) are walled gardens and represent a war against general computing and owning your device. I know you meant the Linux package repositories, but it applies to all stores.
'Curious, you say you do not like being stabbed in the face, and yet you use a knife to prepare your dinner'
It's a matter of who gets to decide where the walls are and who to trust. App Store/Google Play/Windows Store/macOS Store are not and never have been curated for software the user can trust, only things that do not harm the perceived interests of their owners. They are not trusted sources.
'Curious, you say you do not like being stabbed in the face, and yet you use a knife to prepare your dinner'
It's a matter of who gets to decide where the walls are and who to trust. App Store/Google Play/Windows Store/macOS Store are not and never have been curated for software the user can trust, only things that do not harm the perceived interests of their owners. They are not trusted sources.
> App Store/Google Play/Windows Store/macOS Store are not and never have been curated for software the user can trust, only things that do not harm the perceived interests of their owners. They are not trusted sources.
Amen. The proliferation of knock-off apps, shovelware and spyware was not the future we wanted but it's exactly the one we built for ourselves. If you explore this conflict of interest between users, OEMs and developers, you start to reconsider your enthusiasm for the whole cloud computing era.
Amen. The proliferation of knock-off apps, shovelware and spyware was not the future we wanted but it's exactly the one we built for ourselves. If you explore this conflict of interest between users, OEMs and developers, you start to reconsider your enthusiasm for the whole cloud computing era.
> People should learn some windows behaviors are not normal. Your computer shouldn't get slower over time, installing software from untrusted sources is not normal, an extension is part of the name of a file and it should not be hidden, using the computer as administrator should be reserved for administrator tasks only, your desktop area is not /tmp/, drivers belong to the kernel and devices should work as soon as they are plugged in, the command line is not a thing of the past...
Playing devil’s advocate, the Unix/Linux model of things doesn’t have to be “normal” either. Why should file extensions be a thing? Why shouldn’t people use their desktop as they please? Why put drivers in the kernel?
Playing devil’s advocate, the Unix/Linux model of things doesn’t have to be “normal” either. Why should file extensions be a thing? Why shouldn’t people use their desktop as they please? Why put drivers in the kernel?
> Why should file extensions be a thing?
Because they are part of the name of the file. Note: my file manager even identifies the mime type without extension. That is how it should be, changing the extension should not make the file harder to use. To this day, AFAIK, windows file manager still uses the extension to identify file type, thus allowing the user to easily change it may break expectation. GNOME's nautilus, KDE's Dolphin and even Apple's finder do it right: press f2 and you can rename the file without changing the extension, unless you go out of you way for that.
It is also a security breach: image.jpg and image.exe may look the same.
> Why shouldn’t people use their desktop as they please?
Sure they should! But the fact that the OS lacks a working /tmp incentivizes a form of use that is disorganized and ugly.
> Why put drivers in the kernel?
Read about complaints about wacom tablet driver phoning home or printers drivers doing the same. To use my wacom tablet I simply plugged it. Since it is on the kernel, it will work on any architecture the kernel support. They didn't spent a dime to make it working on my raspi, for example. Also, once it is in the kernel, whoever change any internal api will fix every driver code to keep it working, so things that work once will work for a very long time. I met people who lost a TCE scanner and an ASUS mini projector because it wasn't supported by the most recent windows versions. The ASUS mini projector (disclaimer: I had a little involvement in the development of its driver) works on my rockpi4 just by plugging it; the windows experience with it is far from that simple.
Because they are part of the name of the file. Note: my file manager even identifies the mime type without extension. That is how it should be, changing the extension should not make the file harder to use. To this day, AFAIK, windows file manager still uses the extension to identify file type, thus allowing the user to easily change it may break expectation. GNOME's nautilus, KDE's Dolphin and even Apple's finder do it right: press f2 and you can rename the file without changing the extension, unless you go out of you way for that.
It is also a security breach: image.jpg and image.exe may look the same.
> Why shouldn’t people use their desktop as they please?
Sure they should! But the fact that the OS lacks a working /tmp incentivizes a form of use that is disorganized and ugly.
> Why put drivers in the kernel?
Read about complaints about wacom tablet driver phoning home or printers drivers doing the same. To use my wacom tablet I simply plugged it. Since it is on the kernel, it will work on any architecture the kernel support. They didn't spent a dime to make it working on my raspi, for example. Also, once it is in the kernel, whoever change any internal api will fix every driver code to keep it working, so things that work once will work for a very long time. I met people who lost a TCE scanner and an ASUS mini projector because it wasn't supported by the most recent windows versions. The ASUS mini projector (disclaimer: I had a little involvement in the development of its driver) works on my rockpi4 just by plugging it; the windows experience with it is far from that simple.
> Note: my file manager even identifies the mime type without extension. That is how it should be
No, probing around the file content with a gazillion format-specific heuristics/hacks is not how it should be.
This is a security problem because it makes the probing code a giant attack surface, and there have been CVEs related to precisely that.
The file type should be determined from metadata only (simple, regular and without format-specific idiosyncrasies). Whether that metadata should be a suffix on the filename that's easy to mess up inadvertently is debatable, but Windows has the right idea here.
No, probing around the file content with a gazillion format-specific heuristics/hacks is not how it should be.
This is a security problem because it makes the probing code a giant attack surface, and there have been CVEs related to precisely that.
The file type should be determined from metadata only (simple, regular and without format-specific idiosyncrasies). Whether that metadata should be a suffix on the filename that's easy to mess up inadvertently is debatable, but Windows has the right idea here.
The .zip file and .xlsx/.docx is a good example of the complexity. It's popular to build certain application files (word docs, excel spreadsheets) that are zip files on the outside. Something with the first bytes 0x50 0x4d 0x03 0x04 (iirc) could be a zip file that the user wants to unzip or an application file that the user wants to open with an application. You need to probe deeper to guess which it is, or rely on the file extension.
> No, probing around the file content with a gazillion format-specific heuristics/hacks is not how it should be.
My favorite file browsers do it wonderfully. I don't even care when using network because performance is good enough and updates are done async.
My favorite file browsers do it wonderfully. I don't even care when using network because performance is good enough and updates are done async.
> GNOME's nautilus, KDE's Dolphin and even Apple's finder do it right: press f2 and you can rename the file without changing the extension, unless you go out of you way for that.
This is exactly how Windows Explorer works by default too.
This is exactly how Windows Explorer works by default too.
They introduced that feature a very long time ago too. I remember when they made the change because it made renaming files while having extensions visible was so much nicer. Hitting Ctrl-A to select everything in those cases where you do actually want to alter the extension is far easier than adjusting the selection to not include the extension for the common case where you don't want to change the extension.
IIRC that wasn't always the case. Maybe GP simply didn't use Windows since a long time.
But you're right, and I wanted to drop the same hint. As much as I dislike the OS, I have to admit they made some improvements.
But you're right, and I wanted to drop the same hint. As much as I dislike the OS, I have to admit they made some improvements.
So this changed recently. Didn't know that.
> Note: my file manager even identifies the mime type without extension. That is how it should be, changing the extension should not make the file harder to use. To this day, AFAIK, windows file manager still uses the extension to identify file type, thus allowing the user to easily change it may break expectation. GNOME's nautilus, KDE's Dolphin and even Apple's finder do it right: press f2 and you can rename the file without changing the extension, unless you go out of you way for that.
You've just confounded two different concerns: filetype identification by file managers and the interface to rename files. If you're not just cribbing some bad Intro to UX course, you'd know that Windows Explorer has always gone out of its way to howl bloody murder when you accidentally changed the file extension, and since Windows XP most rename file controls preserve the file extension. Your thinking was very sloppy here.
Identifying files by heuristics is a VERY dangerous game. Different systems have implemented it differently over the years, classic Mac OS in particular offering a fascinating alternative to file extensions.
> Also, once it is in the kernel, whoever change any internal api will fix every driver code to keep it working, so things that work once will work for a very long time.
Sometimes. Not always. Don't blindly worship code you haven't read.
You've just confounded two different concerns: filetype identification by file managers and the interface to rename files. If you're not just cribbing some bad Intro to UX course, you'd know that Windows Explorer has always gone out of its way to howl bloody murder when you accidentally changed the file extension, and since Windows XP most rename file controls preserve the file extension. Your thinking was very sloppy here.
Identifying files by heuristics is a VERY dangerous game. Different systems have implemented it differently over the years, classic Mac OS in particular offering a fascinating alternative to file extensions.
> Also, once it is in the kernel, whoever change any internal api will fix every driver code to keep it working, so things that work once will work for a very long time.
Sometimes. Not always. Don't blindly worship code you haven't read.
File extensions aren't really a thing in the UNIX world. Executables and scripts work just fine whatever extension they have, if any. The shell will call the 'file' command to figure out what it is.
Some apps do care about extensions but this is not really an OS thing. And some files have to have specific names but that's really a thing in any OS.
Some apps do care about extensions but this is not really an OS thing. And some files have to have specific names but that's really a thing in any OS.
The shell will NOT call the file command unless you type "file" and hit enter.
Executables are executed by the kernel. They have the x bit set and a header that the kernel reads to decide what to do with them.
Executables are executed by the kernel. They have the x bit set and a header that the kernel reads to decide what to do with them.
I agree that I've simplified things a bit, 'file' is rather the user facing tool that does the same kind of inspection, and of course the X bit is a prerequisite. I know this but I didn't want to write a whole elaboration on my phone :)
But my main point was that extensions aren't really a thing used at OS level to determine file type like on Windows, like the OP said.
But my main point was that extensions aren't really a thing used at OS level to determine file type like on Windows, like the OP said.
Actually the header is read by the shell so it can call the appropriate loader. That may include running the file tool (or an internal equivalent that uses "database" of magic files).
That's completely incorrect. Where did you get that information from?
A regular POSIX shell will simply call the `exec` syscall on the path provided. It may set up some environment variables or parse some arguments, but it will not actually read the file. In fact you can have a file with executable permissions, but not read permissions.
The kernel determines how to execute the file based on its Magic Numbers, which are the first few bytes in certain file formats that will specify what type of file it is. It just so happens that the one for scripts are `#!`.
A regular POSIX shell will simply call the `exec` syscall on the path provided. It may set up some environment variables or parse some arguments, but it will not actually read the file. In fact you can have a file with executable permissions, but not read permissions.
The kernel determines how to execute the file based on its Magic Numbers, which are the first few bytes in certain file formats that will specify what type of file it is. It just so happens that the one for scripts are `#!`.
> Why should file extensions be a thing?
They're not that important on Linux. Making files without extensions is simple and common.
Honestly, file extensions are an annoying GUI thing. In the command line you pass the file as parameter to a program, the extension doesn't matter. Simply clicking on a file provides no information to the operating system about what program to invoke though, there needs to be additional metadata. So graphical environments created this notion of file associations based on extensions to the file name.
They're not that important on Linux. Making files without extensions is simple and common.
Honestly, file extensions are an annoying GUI thing. In the command line you pass the file as parameter to a program, the extension doesn't matter. Simply clicking on a file provides no information to the operating system about what program to invoke though, there needs to be additional metadata. So graphical environments created this notion of file associations based on extensions to the file name.
> Why should file extensions be a thing?
The problem is Windows does different things with files based on their extension, and hides their extension by default. Linux does neither.
The problem is Windows does different things with files based on their extension, and hides their extension by default. Linux does neither.
What happens when you double click a .png file on Linux? It's exactly like Windows, it reads the extension and finds the associated app.
I know you meant +x, but that is limited to only some files.
I know you meant +x, but that is limited to only some files.
Yes, you're right. Sloppy writing by me. Thanks for the cleanup!
Those aren't all windows specific. Nothing like adding untrusted ppa repositories or pasting magic commands from a random blog into the terminal because it fixed someone's problem once, or piping wget into the shell, or being free with the sudo. I think bad habits are cross platform.
> People should learn some windows behaviors are not normal
> drivers belong to the kernel
No, they do not. A modern computer is extremely modular, and the driver subsystem should be equally modular and allow easy plug-and-play. The Windows NT driver model excels at this, and the Linux model of compiling drivers into the kernel is comparatively asinine. Every time I update the Nvidia driver on Arch I have to wait for it to compile into the kernel with DKMS.
For the record, I find some UNIX behaviours equally anachronistic.
- 'Every file is a bag of bytes'
- 'A dot in front of a file/directory means it's hidden'
- 'The OS as an IDE'
- 'Config files are plaintext files that need to be parsed by every single program' (this is now leaking into Windows, too)
etc.
> drivers belong to the kernel
No, they do not. A modern computer is extremely modular, and the driver subsystem should be equally modular and allow easy plug-and-play. The Windows NT driver model excels at this, and the Linux model of compiling drivers into the kernel is comparatively asinine. Every time I update the Nvidia driver on Arch I have to wait for it to compile into the kernel with DKMS.
For the record, I find some UNIX behaviours equally anachronistic.
- 'Every file is a bag of bytes'
- 'A dot in front of a file/directory means it's hidden'
- 'The OS as an IDE'
- 'Config files are plaintext files that need to be parsed by every single program' (this is now leaking into Windows, too)
etc.
>> drivers belong to the kernel
> No, they do not. A modern computer is extremely modular, and the driver subsystem should be equally modular and allow easy plug-and-play.
I get this.
> The Windows NT driver model excels at this, and the Linux model of compiling drivers into the kernel is comparatively asinine.
The linux driver model guaranteed me much better compatibility when using the SAME driver under different architectures and they continued worked when the kernel was updated.
> Every time I update the Nvidia driver on Arch I have to wait for it to compile into the kernel with DKMS.
This is a good example of the problems that happen when a driver is not in the kernel.
>For the record, I find some UNIX behaviours equally anachronistic.
Sure! One of my favorites: you can't have a directory with ":" in its name on your PATH.
> No, they do not. A modern computer is extremely modular, and the driver subsystem should be equally modular and allow easy plug-and-play.
I get this.
> The Windows NT driver model excels at this, and the Linux model of compiling drivers into the kernel is comparatively asinine.
The linux driver model guaranteed me much better compatibility when using the SAME driver under different architectures and they continued worked when the kernel was updated.
> Every time I update the Nvidia driver on Arch I have to wait for it to compile into the kernel with DKMS.
This is a good example of the problems that happen when a driver is not in the kernel.
>For the record, I find some UNIX behaviours equally anachronistic.
Sure! One of my favorites: you can't have a directory with ":" in its name on your PATH.
Package management in Linux is a pain in the ass.
It is too easy to remove preinstalled packages and if you do so, it will be a potential failing point in your system until something happened.
You need to install packages for some basic features and everyone was just install and forget. People don't remove packages after they have served their purpose. Those packages will stay in your system, occupying space and slowing up everything.
The worse thing is that there is no easy way to "diff" the original system, and find out what have you installed/removed.
It is too easy to remove preinstalled packages and if you do so, it will be a potential failing point in your system until something happened.
You need to install packages for some basic features and everyone was just install and forget. People don't remove packages after they have served their purpose. Those packages will stay in your system, occupying space and slowing up everything.
The worse thing is that there is no easy way to "diff" the original system, and find out what have you installed/removed.
You have a point, and a few I do agree with, but to play devils advocate here, there is a reason they are trying to make it 'out of the box' as possible. It's a business for them and ease of use is the key.
I don't believe however they just disregard the security issues, I know a lot of the old school engineers involved in a lot of the core of older OS' and I can say hands down they're some of the best and most responsible engineers I've had the pleasure of working with.
Over time microsoft have gotten a little bit better with open source for example, again because they realised that bigger community assistance helps their bottom line.
Personally, in terms of proprietry OS' I do prefer their model over Apple/Redhat.
And for many many years I despised Micro$oft.
I don't believe however they just disregard the security issues, I know a lot of the old school engineers involved in a lot of the core of older OS' and I can say hands down they're some of the best and most responsible engineers I've had the pleasure of working with.
Over time microsoft have gotten a little bit better with open source for example, again because they realised that bigger community assistance helps their bottom line.
Personally, in terms of proprietry OS' I do prefer their model over Apple/Redhat.
And for many many years I despised Micro$oft.
> It's a business for them and ease of use is the key.
I have no personal problem with ease of use or market success because of it. I do have a personal problem with the feeling that it looks people behave almost like they are being brainwashed to believe some very very bad behaviors are "ease of use".
> I don't believe however they just disregard the security issues,
As an example, AFAIK windows still hides extensions by default.
I have no personal problem with ease of use or market success because of it. I do have a personal problem with the feeling that it looks people behave almost like they are being brainwashed to believe some very very bad behaviors are "ease of use".
> I don't believe however they just disregard the security issues,
As an example, AFAIK windows still hides extensions by default.
Yes, hiding extensions is indeed really stupid. That's one of the first things I turn off when installing Windows.
Meanwhile Mac does user-hostile things like hides scrollbars by default (so you don't even know something is scrollable) and also scrolls backwards by default (scroll up to scroll something down, scroll down to scroll something up). Those are a couple of the first settings I fix when I setup a new Mac. To this day I've never figured out how to get the edit keys (home, end, pgup, pgdn, insert, delete) to work properly. Those are all things that Windows does get right by default.
Also Windows has window management built-in by default without needing a 3rd-party app, unlike Mac. For a windowed GUI-based operating system, that's a pretty big deal.
Meanwhile Mac does user-hostile things like hides scrollbars by default (so you don't even know something is scrollable) and also scrolls backwards by default (scroll up to scroll something down, scroll down to scroll something up). Those are a couple of the first settings I fix when I setup a new Mac. To this day I've never figured out how to get the edit keys (home, end, pgup, pgdn, insert, delete) to work properly. Those are all things that Windows does get right by default.
Also Windows has window management built-in by default without needing a 3rd-party app, unlike Mac. For a windowed GUI-based operating system, that's a pretty big deal.
The scrolling thing is even stupider than just being inverted: the scroll direction setting applies to both the trackpad and the mouse wheel. There's no way to make both feel like they're scrolling in the correct direction. Up on the mouse wheel should scroll up and down should scroll down, but the trackpad should behave like you're gripping a physical object and pushing it up to scroll down and pulling it down to scroll up.
That's what's natural to me anyway. I'm sure others will be used to different behaviors. But my point is it should be possible to configure the scroll wheel and trackpad independently to account for all the different preferences.
That's what's natural to me anyway. I'm sure others will be used to different behaviors. But my point is it should be possible to configure the scroll wheel and trackpad independently to account for all the different preferences.
> As an example, AFAIK windows still hides extensions by default.
I'll bite on this one, it was always a weird choice as IIRC it was always there before back in 3.1 - xp!
I'll bite on this one, it was always a weird choice as IIRC it was always there before back in 3.1 - xp!
Primarily a Windows user here (though not really by choice) and I guess I'll bite - what does it matter what people put on the Desktop? Are there any security implications of not keeping it tidy?
The rest of your points I fully agree with, but that one sticks out as weird to me.
The rest of your points I fully agree with, but that one sticks out as weird to me.
Yes, this one I have to admit it is probably some form of OCD on my part. I get nervous when I see windows users using they desktops as /tmp/ ... it looks so disorganized! Then I remember it is really a personal thing... then I remember windows does have "C:\Temp" but whatever you put there is not deleted on the next reboot.
Whatever I do that I know is temporary, will go to /tmp and I know it will be deleted after I reboot. Windows users are not used to this concept and use their desktops as a makeshift /tmp/. They have to delete the files themselves and sometimes just forget it quickly growing to an aberrant state where the desktop is extremely polluted.
It may be some form of OCD with me, but it is very common among windows users and it IS ugly.
Whatever I do that I know is temporary, will go to /tmp and I know it will be deleted after I reboot. Windows users are not used to this concept and use their desktops as a makeshift /tmp/. They have to delete the files themselves and sometimes just forget it quickly growing to an aberrant state where the desktop is extremely polluted.
It may be some form of OCD with me, but it is very common among windows users and it IS ugly.
> Whatever I do that I know is temporary, will go to /tmp and I know it will be deleted after I reboot.
Only problem with that is that if I remember correctly, on some distributions, the /tmp folder is actually held in-memory. This means that, the more stuff is in there, the more RAM is going to be used up.
There's also /run/user/1000 which is more of a systemd thing, and that's definitely mapped to memory (at least it is on Fedora).
Only problem with that is that if I remember correctly, on some distributions, the /tmp folder is actually held in-memory. This means that, the more stuff is in there, the more RAM is going to be used up.
There's also /run/user/1000 which is more of a systemd thing, and that's definitely mapped to memory (at least it is on Fedora).
I’m not sure about the command line not being a thing of the past, it’s not something I do on my current gen devices, game consoles/smart phones/watches/tablets.
In fact for the general software user I think terminal commands are a thing of the past.
In fact for the general software user I think terminal commands are a thing of the past.
Maybe a general user is okay for himself without command line.
But a good command line is essential for replicating more complicating tasks on more than one machine. I still remember when computer magazines printed a ton of screenshots on how to do certain things. A command line can be short, simple and much easier to replicate.
But a good command line is essential for replicating more complicating tasks on more than one machine. I still remember when computer magazines printed a ton of screenshots on how to do certain things. A command line can be short, simple and much easier to replicate.
This!
Fixing problems on windows means watching youtube videos and trying to replicate clicks which sometimes break the version is not the same. On linux, you google the problem, find the fix on stackoverflow and just type a few commands.
Beware that copy-pasting from websites may not be safe!
Fixing problems on windows means watching youtube videos and trying to replicate clicks which sometimes break the version is not the same. On linux, you google the problem, find the fix on stackoverflow and just type a few commands.
Beware that copy-pasting from websites may not be safe!
> In fact for the general software user I think terminal commands are a thing of the past.
For the general software user.... maybe. Seen advanced users and developers acting like that makes them seem very likely underestimating or ignoring the power of features like history and how you can combine and compose commands.
For the general software user.... maybe. Seen advanced users and developers acting like that makes them seem very likely underestimating or ignoring the power of features like history and how you can combine and compose commands.
How do you justify "maybe" when it's not only the general software user but many advanced users too. Maybe even most of them.
What is actually left is a tiny group of people compared to all the computer population.
Terminal is a thing of the past. No use pretending it isn't.
What is actually left is a tiny group of people compared to all the computer population.
Terminal is a thing of the past. No use pretending it isn't.
> What is actually left is a tiny group of people compared to all the computer population.
Certainly not on HN. You could say the same about assistive technologies, for example.
Also, the current "computer population" still is a distortion. A lot of people started using computers to access the internet and have some entertainment. This is being replaced by smartphones, tablets and smart tv's. So, the advanced users share on "computer population" is (I think) increasing.
You can see some evidence of people using less the "computer" and more other devices: https://gs.statcounter.com/os-market-share#monthly-200901-20...
Certainly not on HN. You could say the same about assistive technologies, for example.
Also, the current "computer population" still is a distortion. A lot of people started using computers to access the internet and have some entertainment. This is being replaced by smartphones, tablets and smart tv's. So, the advanced users share on "computer population" is (I think) increasing.
You can see some evidence of people using less the "computer" and more other devices: https://gs.statcounter.com/os-market-share#monthly-200901-20...
If the terminal is a thing of the past, you can leave me behind. Come find me when you can replicate the power and brevity of a relatively simple tool like “find -exec”. Then we can talk about the real power tools!
[deleted]
> We are all paying the price for not killing these myths.
I can't tell you how many times I've taken on teaching a novice or junior developer and then had to un-teach them all the shit that Windows teaches users.
I can't tell you how many times I've taken on teaching a novice or junior developer and then had to un-teach them all the shit that Windows teaches users.
There is a funny symptom among windows users when they have a notebook/laptop: they need a mouse. Even when the notebook has a good trackpad, they still need a mouse. I tried to investigate why this happens. What I suspect: windows overuse/abuse clicks. The user must click so many points, they don't care about using the keyboard or shortcuts. Also, AFAIK, only recently windows has support for things like two-finger scroll and right click by tapping with two fingers; most users don't even know this is possible and look surprised when I show them that.
They have a need for a mouse. They scroll the text using the scrollbar, they use it even for moving the caret to the above line when writing code! It makes me sad just looking at that.
They have a need for a mouse. They scroll the text using the scrollbar, they use it even for moving the caret to the above line when writing code! It makes me sad just looking at that.
Give me a mouse (with a good sensor and no acceleration) over keyboard navigation any day
I appreciate there are people who swear by the keyboard driven text editors etc. But I feel like these people do not appreciate how fast you can be with a good mouse, low input lag and muscle memory
I appreciate there are people who swear by the keyboard driven text editors etc. But I feel like these people do not appreciate how fast you can be with a good mouse, low input lag and muscle memory
I admit I also use a mouse even on laptops. I hate trackpads.
But my text experience is much more blended. If I move around a lot in a file then I might drag the scrollbar with the mouse. But if it's a few lines or maybe just a few pages then I'll use arrow keys (or tmux's or vi's equivalent) and sometimes pageup/pagedown.
I particularly prefer being able to use globs and regular expressions for everything though. Files for all devices -- only relying on permissions -- is absolutely wonderful. And the best part is not (usually) having configuration hidden in some registry ... just use `grep -P` on `/etc` to find what needs to change.
But my text experience is much more blended. If I move around a lot in a file then I might drag the scrollbar with the mouse. But if it's a few lines or maybe just a few pages then I'll use arrow keys (or tmux's or vi's equivalent) and sometimes pageup/pagedown.
I particularly prefer being able to use globs and regular expressions for everything though. Files for all devices -- only relying on permissions -- is absolutely wonderful. And the best part is not (usually) having configuration hidden in some registry ... just use `grep -P` on `/etc` to find what needs to change.
Most students that age play videogames
[deleted]
The (base64-encoded) binary can even be stored directly in the Registry: https://twitter.com/tenrobots/status/1552179803121258496
Yes, there is an atomic test / mitre attack technique exactly for this. The lame part is the attack executes successfully on stock windows 10/11. Its one of the top threats of 2021/2022.
https://github.com/redcanaryco/atomic-red-team/blob/master/a...
"RunOnce" isn't even the preferred way to run EXEs with RegEdit.
See "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options". That stuff there is very powerful and scary. You can even use this feature to stop the Windows Telemetry from running.
See "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options". That stuff there is very powerful and scary. You can even use this feature to stop the Windows Telemetry from running.
This has been known for a long while.
I'm not sure the purpose - probably just for fun, but as an attack vector without 0day in pdf for example, to me at least it wouldn't be too effective.
I've always been fascinated thought and been playing around with images with executable inside that could be triggered through the browser that you're on, I have played with a personal chromium build that it 'kind of' happens, but i digress.
Interesting article - I just don't see a patch coming for it anytime soon.
I'm not sure the purpose - probably just for fun, but as an attack vector without 0day in pdf for example, to me at least it wouldn't be too effective.
I've always been fascinated thought and been playing around with images with executable inside that could be triggered through the browser that you're on, I have played with a personal chromium build that it 'kind of' happens, but i digress.
Interesting article - I just don't see a patch coming for it anytime soon.
• administrator privileges are required
• the main payload doesn't execute until the next reboot
still an impressive demo
• the main payload doesn't execute until the next reboot
still an impressive demo
I admire this type of content where the creator take some concepts we [all] use and understand then combine them in a specific, but a new way, add some tweaks to get some never-seen results.
Here is another experience that, as a Windows developer, blows my mind for a while. https://www.youtube.com/watch?v=ExwqNreocpg
Here is another experience that, as a Windows developer, blows my mind for a while. https://www.youtube.com/watch?v=ExwqNreocpg
There surely is a better way to launch an exe having access to the registry, even if it is just HKEY_CURRENT_USER. Some directory handler or file handler, GUID for launching an exe when desktop is shown etc.
Anyone knows more about alternatives to Run/RunOnce to start an exe? Or maybe, let's leave it for the reader to investigate...
Anyone knows more about alternatives to Run/RunOnce to start an exe? Or maybe, let's leave it for the reader to investigate...
Any company that allows .reg files executed by non-admin users have bigger fish to fry. This method has been used for literally decades.
Anyway once you've persuaded the user to import a .reg file as administrator, it's game over. There are so many registry entries with exploitable possibilities. (It's similar to persuading a Linux user to unpack a tarball over /etc)
While I'm here...
hivex is a Linux library for accessing and modifying the Windows registry (https://github.com/libguestfs/hivex), and virt-win-reg is a Linux tool for modifying the registry of a VM (https://libguestfs.org/virt-win-reg.1.html). After many hours discovering how the registry works to write those, I also wrote this about why the registry sucks: https://rwmj.wordpress.com/2010/02/18/why-the-windows-regist...