Live data from Hacker News

Any sufficiently advanced uninstaller is indistinguishable from malware

devblogs.microsoft.com

141–150 of 556 posts

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#141
post #98
post #91

Their Teams uninstaller isn't quite as good - it just doesn't uninstall all the crap that the Teams malware has left behind. I still have a stray MS Teams audio device left on my macOS machine.

Did you considered filling a bug report ?

I didn't consider to file a bug report, I sent one.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#142

I keep forgetting Windows-isms that won't allow you to delete the executable file of a running process. I guess that's also why the arcane .dll upgrade process / WoW is so necessary.

>won't allow you to delete the executable file

Any open file

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#143
post #94

Software shouldn't uninstall or update itself. There should be a package manager to do this. Then at least you have one attack vector less per application.

Software shouldnt update itself? What? Thats crazy

If browsers werent updating itself we would have huge security mess

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#144

I can only imagine the Win32 API team meeting prior to this... A: So, people are resorting to injecting code in Explorer to delete in-use files in such numbers that it shows up in our top-100 crash report reasons B: Well, maybe we should add a public API to Windows to support this incredibly common functionality that apparently has been missing so far? A: Nah, let's just write a mildly condescending blog post that re…

This. The deep dive is fascinating, but really feels like a distraction from a product management failure. Microsoft has been 3 decades in the OS business. Surely someone must have noticed that package management should be a core OS feature.

Since Windows 2000, however Microsoft isn't Apple, in being a dictator regarding OS API adoption.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#145

Earlier quoted context omitted.

You don't? Those are either free space, or held by handle by a running process, so you just leave them be and assume they will be released sooner or later. Worst case you defragment on boot. https://unix.stackexchange.com/questions/68523/find-and-remo... This is how it works on UNIX. Generally better then apps randomly failing because a file(name) is held open somewhere by something.

> You don't? Those are either free space, or held by handle by a running process, so you just leave them be and assume they will be released sooner or later. Well that's what I was getting at, it would suck to not be able to move around file blocks just because a process is using the file. That "sooner or later" might well be "until the next reboot". The current strategy makes it possible to live-shrink and live-defr…

'Sooner or later' means 'until the file is no longer open'.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#147

Earlier quoted context omitted.

With enough conditional evals() with dynamic inputs you can make the search space unsearchable big.

The search space is linear as the algorithm is linear.

This stuff is mostly done to make static analysis harder.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#148

If Microsoft just made uninstalling work properly themselves maybe people wouldn’t have to resort to uninstallers in the first place

They did, vendors have to provide a MSI package, or more recently a MSIX package.

Now they aren't Apple, in telling developers "use this or get lost".

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#150
post #7

...or maybe Windows should just offer an API for marking a file for deletion once it's not in use anymore (I understand unlink semantics may not be possible, but that's not what my suggestion above is saying)

I thought I'll be the guy to point out that once again mandatory file locking is to blame, but you beat me to it. I never digged into the question, but why is it used, what benefits did it provide over the UNIX unlink behaviour?

Locking mechanism that actually works, like in any sane OS besides UNIX.

And with it, less data corruption issues.

Post reply on HN