151–160 of 556 posts
Earlier quoted context omitted.
Using the same API that lets you move file blocks around at will.
Huh? That API requires a file handle. Which you get by opening a file. Which you can't do because you can't find it on the filesystem when it's not there. Edit: Actually, hmm... see edit above.
Earlier quoted context omitted.
Imagine having 2,000 different config file formats you have to edit within a terminal instead of a central registry hive. Imagine a file explorer that doesn't simply prompt for admin rights when you need them, instead silently failing.
Imagine having a central registry hive, yet have programs do whatever they want, including saving config files in random locations and formats. Imagine using a file explorer you don't like.
So something like "/var/lib/postgresql/data" in the container becomes something like "/app/my-postgres-service-12/var/lib/postgresql/data" on the host.
I have just one directory to backup, I can also move it to different nodes entirely and OS upgrades don't break anything either due to the running software being decoupled from the OS somewhat.
But my Linux and Windows desktops? It's absolute Wild West over there and I just reinstall the entire OS every few years - they're beyond saving.
Why do Windows programs need special installers/uninstallers? Why isn't this handled by Windows itself?
Why do Windows programs need special installers/uninstallers? Why isn't this handled by Windows itself?
I’m probably missing something but why is an uninstaller allowed to inject code into explorer.exe? That seems like a massive security flaw?
It's never a security flaw that a program running with administrator privileges is allowed to do something.
interesting investigation and js. Though I'm wondering why does windows rely on the software to uninstall itself?
That’s kinda like asking “why does Linux rely on `curl | sudo bash`” It doesn’t rely on it. It’s just something that’s possible.
Where do I look in the OS for the manifest of all installed files from an installer?
Thanks, I'm mostly a Linux user and I've sorely missed a `dpkg -L` on MS Windows for ages.
Software shouldn't uninstall or update itself. There should be a package manager to do this. Then at least you have one attack vector less per application.
Software shouldnt update itself? What? Thats crazy If browsers werent updating itself we would have huge security mess
And today I learned that Windows supports running Javascript as shell script. huh
And it's even funnier that the solution the author gives is "hey execute this javascript code that uninstalls a program and deletes itself afterwards" like, really? can't you write that in C? I don't think most Win32 apps use JavaScript for their installers.
The point of the exercise is that, on Windows, you can’t, because Windows won’t let anyone delete executables that are currently in use (try it, you won’t be able to delete one either). Upgrading shared DLLs in the face of this fact is why installers for Windows programs often have to have you reboot the system (and in more civilized times asked you to close other programs before installation to reduce the probability of hitting a locked DLL). It’s also why there’s a registry key[1] containing a list of rename and delete actions to be performed on next reboot (usually accessed via the MOVEFILE_DELAY_UNTIL_REBOOT flag to MoveFileEx).
You can’t (straightforwardly[2]) make a self-deleting batch script, either, because the command interpreter parses a command at a time and so wants the batch file to exist. The Windows Scripting Host, on the other hand, will parse the whole file at once, close it, and then forget about it, so you can write self-deleting WSH scripts.
The workaround used by the uninstaller under discussion is instead for the executable to inject some code into the Windows Explorer (on the assumption that it’s always running and the user has to have access permissions for it) that accomplishes the deletion through return-oriented programming, so that the stack it’s executing from can then disappear into the wind (apparently? I’m not seeing how they plan to clean that up).
On a POSIX system you are explicitly allowed to delete any open file—including an executing one—making it languish in a kind of system-managed limbo (and take up disk space, invisibly) until it’s closed. The tradeoff is then that it’s impossible to ensure you’ve opened the same file as somebody else when all you have is its name. (I think you can at least check for success, provided you also have the device and inode numbers for it.)
[1] https://superuser.com/questions/58479/is-there-a-registry-ke...
[2] https://stackoverflow.com/questions/20329355/how-to-make-a-b...
Why do Windows programs need special installers/uninstallers? Why isn't this handled by Windows itself?
I suspect the final form for software installation is probably where iOS and Android are going in the EU, where there's a single means of installing software to the device so that everything can be sandboxed properly, but the acquisition/update process can be pointed to a URL/Store that the user has pre-approved.
macOS comes pretty close to what I'd ideally want in an OS with regards to installation - independent packages that are certified/notarised, but I'd like to see the OS allow for user-specified authorities beyond just Apple. That being said, I'm not sure I'd ever use them as it's part of what I'm paying Apple for, I'm really thinking more of Linux there.
A kind of flatpak/snap approach, but that has signing of the package and centralised management of the permissions for the sandbox at an OS level would be ideal in my view. That way it's still free-as-in-speech as the user can specify which notarisation authority to use (or none at all).
I really don't understand why seperate programs are handling removing their mother program in 2023, that's registry spaghetti messy.
interesting investigation and js. Though I'm wondering why does windows rely on the software to uninstall itself?
That’s kinda like asking “why does Linux rely on `curl | sudo bash`” It doesn’t rely on it. It’s just something that’s possible.