On 20/03/2023 17:59, The Natural Philosopher wrote:
> On 19/03/2023 16:29, GB wrote:
>> On 18/03/2023 17:45, Smolley wrote:
>>> I have removed the windows 11 update executable, in order to stop
>>> updates
>>> that reset my defender off settings.
>>
>>
>> If you want to fuck your computer up, why not do something more
>> direct, like hitting it with a sledge hammer?
>>
>>
> Or installing Windows...

Sure. Install a different OS, but installing Windows, and then disabling
the security...

I assume it's just a wind-up, because nobody could actually be that stupid.

On Mon, 20 Mar 2023 21:01:47 +0000
Rob Morley <nospam@ntlworld.com> wrote:

> On Mon, 20 Mar 2023 20:37:49 +0000
> Joe <joe@jretrading.com> wrote:
>
> > Even now, the first user out of the box is by default an
> > administrator.
> >
> How would you configure the machine and add regular users, if not as
> admin?
>

You would run the OOBE as admin but would be required to create a
normal user.

You're still free to logon as admin and install viruses if you want to.
At the moment, the first user isn't even told that it's a bad idea to
run as admin, something that most domestic users wouldn't guess.

--
Joe

> On 19/03/2023 16:29, GB wrote:
>> On 18/03/2023 17:45, Smolley wrote:
>>> I have removed the windows 11 update executable, in order to stop updates
>>> that reset my defender off settings.
>>
>>
>> If you want to fuck your computer up, why not do something more direct,
>> like hitting it with a sledge hammer?
>>
>>

Funny enough there is an apt called Sledgehammer that lets you turn on/off windows updates

--

On 19/03/2023 12:24, Custos Custodum wrote:
> On Sun, 19 Mar 2023 08:14:20 +0000, Algernon Goss-Custard
> <Ben@nowhere.com> wrote:
>
>> Rob Morley <nospam@ntlworld.com> posted
>>> On Sat, 18 Mar 2023 17:45:05 -0000 (UTC)
>>> Smolley <s@home.net> wrote:
>>>
>>>> I have removed the windows 11 update executable, in order to stop
>>>> updates that reset my defender off settings.
>>>
>>> I have removed Windows in order to stop Windows.
>>>
>>
>> In order to save the village, you had to destroy it.
>
> "They create a wilderness and call it peace." - Tacitus

https://en.wikipedia.org/wiki/Calgacus

says it's a quote from a Caledonian chieftain. Just for once I wish I'd
paid attention in those Latin classes so I could read the original! I
think I get it...

"atque ubi solitudinem faciunt, pacem appellant." it says at

<http://www.perseus.tufts.edu/hopper/text?doc=Perseus%3Atext%3A1999.02.0084%3Achapter%3D30>

"they make a solitude and call it peace."

I'm surprised it's that old. Plus ça change.

Andy

On 20/03/2023 21:22, GB wrote:
> On 20/03/2023 17:59, The Natural Philosopher wrote:
>> On 19/03/2023 16:29, GB wrote:
>>> On 18/03/2023 17:45, Smolley wrote:
>>>> I have removed the windows 11 update executable, in order to stop
>>>> updates
>>>> that reset my defender off settings.
>>>
>>>
>>> If you want to fuck your computer up, why not do something more
>>> direct, like hitting it with a sledge hammer?
>>>
>>>
>> Or installing Windows...
>
> Sure. Install a different OS, but installing Windows, and then disabling
> the security...
>
> I assume it's just a wind-up, because nobody could actually be that stupid.

If you really understood security, you would realize that huge parts of
what is sold to you as secure it to protect incompetent programming and
incompetent users from getting fucked.
By not being an incompetent user, and taking precautions, you simply
dont need additional security

I havent bothered with any since I moved to Linux, 20 years ago. Ni
virus, No malware. Nada.

--
If I had all the money I've spent on drink...
...I'd spend it on drink.

Sir Henry (at Rawlinson's End)

On 21 Mar 2023 at 16:34:39 GMT, "The Natural Philosopher"
<tnp@invalid.invalid> wrote:

> On 20/03/2023 21:22, GB wrote:
>> On 20/03/2023 17:59, The Natural Philosopher wrote:
>>> On 19/03/2023 16:29, GB wrote:
>>>> On 18/03/2023 17:45, Smolley wrote:
>>>>> I have removed the windows 11 update executable, in order to stop
>>>>> updates
>>>>> that reset my defender off settings.
>>>>
>>>>
>>>> If you want to fuck your computer up, why not do something more
>>>> direct, like hitting it with a sledge hammer?
>>>>
>>>>
>>> Or installing Windows...
>>
>> Sure. Install a different OS, but installing Windows, and then disabling
>> the security...
>>
>> I assume it's just a wind-up, because nobody could actually be that stupid.
>
> If you really understood security, you would realize that huge parts of
> what is sold to you as secure it to protect incompetent programming and
> incompetent users from getting fucked.
> By not being an incompetent user, and taking precautions, you simply
> dont need additional security
>
> I havent bothered with any since I moved to Linux, 20 years ago. Ni
> virus, No malware. Nada.

Same applies on macOS, where I do precisely nothing at all about viruses,
because there are none. And see my sig.

--
"The idea that Bill Gates has appeared like a knight in shining armour to lead all customers out of a mire of technological chaos neatly ignores the fact that it was he who, by peddling second-rate technology, led them into it in the first place." - Douglas Adams

On 3/20/2023 5:34 PM, Joe wrote:
> On Mon, 20 Mar 2023 21:01:47 +0000
> Rob Morley <nospam@ntlworld.com> wrote:
>
>> On Mon, 20 Mar 2023 20:37:49 +0000
>> Joe <joe@jretrading.com> wrote:
>>
>>> Even now, the first user out of the box is by default an
>>> administrator.
>>>
>> How would you configure the machine and add regular users, if not as
>> admin?
>>
>
> You would run the OOBE as admin but would be required to create a
> normal user.
>
> You're still free to logon as admin and install viruses if you want to.
> At the moment, the first user isn't even told that it's a bad idea to
> run as admin, something that most domestic users wouldn't guess.
>

The first user during OOBE, belongs to the Administrator group.
Elevation involves a UAC prompt.

The "real administrator" account is disabled. If you did
want to run in a "permanently elevated" state, then you
would do this, but this is NOT how windows ships. And this
model is really not much different than the "sudo" model
used by some Linux distros (where the root account is not
running and there is just sudo).

net user administrator /active:yes

(do not forget to set a password for the account, and record it somewhere)

If you did want to run permanently elevated by logging
in as the (freshly-enabled) real administrator, you can
get a copy of DropMyRights.

DropMyRights notepad.exe

and then that is the inverse of UAC. It would allow you
to run notepad.exe without elevation. But having to type
this for everything, this would get on your nerves.

DropMyRights firefox

So really, Windows has a means of emulating what model
Linux is using at the moment. You can selectively elevate.
Or, selectively de-elevate. The shipping Windows model,
is similar to how sudo works in Linux (selective elevation).

For example, I regularly "deny" UAC prompts, as a means
of preventing certain aggressive browsers from updating :-)
You don't always click "OK" on the stupid UAC prompt :-)
There are occasions when there is an activity you want blocked.

The purpose of elevation during software install, is
for the "impersonation privilege" and being able to add
software to Program Files as the TrustedInstaller account.
Not as the Administrator account.

When administering a Windows PC, just be careful to not
remove the last account with elevation privileges. As
they've made it harder to hack your way back in. The OSK.exe
hack has been removed (or, bypassed in a sense). There is
one person who keeps a webpage, with the hacks that still work
for adding back a user who belongs to the Administrator group.

Paul

On Wed, 22 Mar 2023 04:13:28 -0400
Paul <nospam@needed.invalid> wrote:

> On 3/20/2023 5:34 PM, Joe wrote:
> > On Mon, 20 Mar 2023 21:01:47 +0000
> > Rob Morley <nospam@ntlworld.com> wrote:
> >
> >> On Mon, 20 Mar 2023 20:37:49 +0000
> >> Joe <joe@jretrading.com> wrote:
> >>
> >>> Even now, the first user out of the box is by default an
> >>> administrator.
> >>>
> >> How would you configure the machine and add regular users, if not
> >> as admin?
> >>
> >
> > You would run the OOBE as admin but would be required to create a
> > normal user.
> >
> > You're still free to logon as admin and install viruses if you want
> > to. At the moment, the first user isn't even told that it's a bad
> > idea to run as admin, something that most domestic users wouldn't
> > guess.
>
> The first user during OOBE, belongs to the Administrator group.
> Elevation involves a UAC prompt.
>
> The "real administrator" account is disabled. If you did
> want to run in a "permanently elevated" state, then you
> would do this, but this is NOT how windows ships. And this
> model is really not much different than the "sudo" model
> used by some Linux distros (where the root account is not
> running and there is just sudo).
>
> net user administrator /active:yes
>
> (do not forget to set a password for the account, and record it
> somewhere)
>
> If you did want to run permanently elevated by logging
> in as the (freshly-enabled) real administrator, you can
> get a copy of DropMyRights.
>
> DropMyRights notepad.exe
>
> and then that is the inverse of UAC. It would allow you
> to run notepad.exe without elevation. But having to type
> this for everything, this would get on your nerves.
>
> DropMyRights firefox
>
> So really, Windows has a means of emulating what model
> Linux is using at the moment. You can selectively elevate.
> Or, selectively de-elevate. The shipping Windows model,
> is similar to how sudo works in Linux (selective elevation).
>
> For example, I regularly "deny" UAC prompts, as a means
> of preventing certain aggressive browsers from updating :-)
> You don't always click "OK" on the stupid UAC prompt :-)
> There are occasions when there is an activity you want blocked.
>
> The purpose of elevation during software install, is
> for the "impersonation privilege" and being able to add
> software to Program Files as the TrustedInstaller account.
> Not as the Administrator account.
>
> When administering a Windows PC, just be careful to not
> remove the last account with elevation privileges. As
> they've made it harder to hack your way back in. The OSK.exe
> hack has been removed (or, bypassed in a sense). There is
> one person who keeps a webpage, with the hacks that still work
> for adding back a user who belongs to the Administrator group.
>

You know all this, and I used to for NT4 and the few following it, but
I'm no longer in that line of business.

But what about your aunty Mary, bought a new computer by one of her
other nephews? Does she know all this or is she happy to just use the
first account, that the nephew 'set up' for her, and permanently run
with admin privileges?

--
Joe

On 22/03/2023 08:48, Joe wrote:
> On Wed, 22 Mar 2023 04:13:28 -0400
> Paul <nospam@needed.invalid> wrote:
>
>> On 3/20/2023 5:34 PM, Joe wrote:
>>> On Mon, 20 Mar 2023 21:01:47 +0000
>>> Rob Morley <nospam@ntlworld.com> wrote:
>>>
>>>> On Mon, 20 Mar 2023 20:37:49 +0000
>>>> Joe <joe@jretrading.com> wrote:
>>>>
>>>>> Even now, the first user out of the box is by default an
>>>>> administrator.
>>>>>
>>>> How would you configure the machine and add regular users, if not
>>>> as admin?
>>>>
>>>
>>> You would run the OOBE as admin but would be required to create a
>>> normal user.
>>>
>>> You're still free to logon as admin and install viruses if you want
>>> to. At the moment, the first user isn't even told that it's a bad
>>> idea to run as admin, something that most domestic users wouldn't
>>> guess.
>>
>> The first user during OOBE, belongs to the Administrator group.
>> Elevation involves a UAC prompt.
>>
>> The "real administrator" account is disabled. If you did
>> want to run in a "permanently elevated" state, then you
>> would do this, but this is NOT how windows ships. And this
>> model is really not much different than the "sudo" model
>> used by some Linux distros (where the root account is not
>> running and there is just sudo).
>>
>> net user administrator /active:yes
>>
>> (do not forget to set a password for the account, and record it
>> somewhere)
>>
>> If you did want to run permanently elevated by logging
>> in as the (freshly-enabled) real administrator, you can
>> get a copy of DropMyRights.
>>
>> DropMyRights notepad.exe
>>
>> and then that is the inverse of UAC. It would allow you
>> to run notepad.exe without elevation. But having to type
>> this for everything, this would get on your nerves.
>>
>> DropMyRights firefox
>>
>> So really, Windows has a means of emulating what model
>> Linux is using at the moment. You can selectively elevate.
>> Or, selectively de-elevate. The shipping Windows model,
>> is similar to how sudo works in Linux (selective elevation).
>>
>> For example, I regularly "deny" UAC prompts, as a means
>> of preventing certain aggressive browsers from updating :-)
>> You don't always click "OK" on the stupid UAC prompt :-)
>> There are occasions when there is an activity you want blocked.
>>
>> The purpose of elevation during software install, is
>> for the "impersonation privilege" and being able to add
>> software to Program Files as the TrustedInstaller account.
>> Not as the Administrator account.
>>
>> When administering a Windows PC, just be careful to not
>> remove the last account with elevation privileges. As
>> they've made it harder to hack your way back in. The OSK.exe
>> hack has been removed (or, bypassed in a sense). There is
>> one person who keeps a webpage, with the hacks that still work
>> for adding back a user who belongs to the Administrator group.
>>
>
> You know all this, and I used to for NT4 and the few following it, but
> I'm no longer in that line of business.
>
> But what about your aunty Mary, bought a new computer by one of her
> other nephews? Does she know all this or is she happy to just use the
> first account, that the nephew 'set up' for her, and permanently run
> with admin privileges?

The "first account" does not "permanently run with admin privileges".
For GUI operations it can use the *nix style elevation in the form of
UAC to allow elevation.

Try:

notepad %windir%\system32\drivers\etc\hosts

Now save save the file...

Did it let you?

That would be because you don't have privilege.

(you can use the "runas" command from the cli to allow elevation there)

--
Cheers,

John.

/=================================================================\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\=================================================================/

On 22/03/2023 08:13, Paul wrote:
>
> So really, Windows has a means of emulating what model
> Linux is using at the moment. You can selectively elevate.
> Or, selectively de-elevate. The shipping Windows model,
> is similar to how sudo works in Linux (selective elevation).
>
> For example, I regularly "deny" UAC prompts, as a means
> of preventing certain aggressive browsers from updating :-)
> You don't always click "OK" on the stupid UAC prompt :-)
> There are occasions when there is an activity you want blocked.
>

In Linux getting past Sudo is by default a request for a password, and
for that a trip to command line if not prompted in the GUI. And ...

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

#1) Respect the privacy of others.

#2) Think before you type.

#3) With great power comes great responsibility.

Password:

Because of the overload of nuisance things to deal with in a typical
Windows installation with pop-ups, spam warnings, anti virus software,
windows notifications, software updates, windows updates, advertising,
browser windows etc... some Windows users will blindly click anything,
including UAC prompts and unsigned software warnings.

If Microsoft enforced re-authentication for UAC out of the box, then
those users would probably take note.

--
Adrian C

Adrian Caspersz wrote:

> In Linux getting past Sudo is by default a request for a password

but it's the same password that user has already logged on with,
using "su -" at least it's a different password for the privileged account.

On 23/03/2023 09:16, Andy Burns wrote:
> Adrian Caspersz wrote:
>
>> In Linux getting past Sudo is by default a request for a password
>
> but it's the same password that user has already logged on with,
> using "su -" at least it's a different password for the privileged account.
>
Well that depends on what you have your passwords set *for*. In terms of
whether that is better or not.

Having to re-enter my password to do 'cool shit'; at least reminds me
that I am tampering with how the thing works, rather than just
mindlessly creating and destroying data.
And it stops any random malware including kiddies sticky fingers from
using my identity to fuck with the system as well.
I have never given my password to anyone, except in an emergency to a
friend. I changed it then after 10 years. But then he died, so I could
change it back.
And I have never on Linux been hacked or suffered any malware at all

So I reckon its 'good enough'

--
"The most difficult subjects can be explained to the most slow witted
man if he has not formed any idea of them already; but the simplest
thing cannot be made clear to the most intelligent man if he is firmly
persuaded that he knows already, without a shadow of doubt, what is laid
before him."

- Leo Tolstoy

On 3/23/2023 7:07 AM, The Natural Philosopher wrote:
> On 23/03/2023 09:16, Andy Burns wrote:
>> Adrian Caspersz wrote:
>>
>>> In Linux getting past Sudo is by default a request for a password
>>
>> but it's the same password that user has already logged on with,
>> using "su -" at least it's a different password for the privileged account.
>>
> Well that depends on what you have your passwords set *for*. In terms of whether that is better or not.
>
> Having to re-enter my password to do 'cool shit'; at least reminds me that I am tampering with how the thing works, rather than just mindlessly creating and destroying data.
> And it stops any random malware including kiddies sticky fingers  from using my identity to fuck with the system as well.
> I have never given my password to anyone, except in an emergency to a friend. I changed it then after 10 years. But then he died, so I could change it back.
> And I have never on Linux been hacked or suffered any malware at all
>
> So I reckon its 'good enough'
>

If you use sudo to elevate the package manager

sudo synaptic

then that first occurrence will cause a password prompt.

If you immediately enter a second command

sudo copy empty /etc/fstab

then no password prompt results. The initial authentication
is good for some number of minutes.

if you want some sort of "absolute-ism", you can "su"
your afternoon away if you want.

Some distros even have a "root terminal window",
for the <cough> "power hungry" user.

Security is a state of mind -- never assume anything
when you sit down at a computer. You never know what
silly habit a distro might have.

*******

I've only ever had one computer tipped over, and I'm
not particularly careful. The exploit came in through
a browser, and I doubt the browser was elevated at the time
either. Apparently a commercial site was hacked and
the top level domain was replaced with a "redirect attack".

Paul

On 23/03/2023 19:51, Paul wrote:
> On 3/23/2023 7:07 AM, The Natural Philosopher wrote:
>> On 23/03/2023 09:16, Andy Burns wrote:
>>> Adrian Caspersz wrote:
>>>
>>>> In Linux getting past Sudo is by default a request for a password
>>>
>>> but it's the same password that user has already logged on with,
>>> using "su -" at least it's a different password for the privileged
>>> account.
>>>
>> Well that depends on what you have your passwords set *for*. In terms
>> of whether that is better or not.
>>
>> Having to re-enter my password to do 'cool shit'; at least reminds me
>> that I am tampering with how the thing works, rather than just
>> mindlessly creating and destroying data.
>> And it stops any random malware including kiddies sticky fingers  from
>> using my identity to fuck with the system as well.
>> I have never given my password to anyone, except in an emergency to a
>> friend. I changed it then after 10 years. But then he died, so I could
>> change it back.
>> And I have never on Linux been hacked or suffered any malware at all
>>
>> So I reckon its 'good enough'
>>
>
> If you use sudo to elevate the package manager
>
>    sudo synaptic
>
> then that first occurrence will cause a password prompt.
>
> If you immediately enter a second command
>
>    sudo copy empty /etc/fstab
>
> then no password prompt results.

No, you will get an error because copy and empty are not Linux commands

> The initial authentication
> is good for some number of minutes.

And? If I do su - and enter the root password, the root session is
there forever.

>
> if you want some sort of "absolute-ism", you can "su"
> your afternoon away if you want.
>
> Some distros even have a "root terminal window",
> for the <cough> "power hungry" user.
>
> Security is a state of mind -- never assume anything
> when you sit down at a computer. You never know what
> silly habit a distro might have.
>
The distros aren't the silly part. The users are.

> *******
>
> I've only ever had one computer tipped over, and I'm
> not particularly careful. The exploit came in through
> a browser, and I doubt the browser was elevated at the time
> either. Apparently a commercial site was hacked and
> the top level domain was replaced with a "redirect attack".
>
>    Paul
>

--
Socialism is the philosophy of failure, the creed of ignorance and the
gospel of envy.

Its inherent virtue is the equal sharing of misery.

Winston Churchill