Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any sufficiently advanced uninstaller is indistinguishable from malware

devblogs.microsoft.com

Post reply on HN
Print view View original

261–270 of 556 posts

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#261

Post by jraph »

BoppreH wrote: post #258
Tuna-Fish wrote: post #256

Earlier quoted context omitted.

The same way any linux distro does? Define a separate directory for program installations, that user processes cannot write to. Only program that can do so is the package manager, which other programs can call to install packages. Uninstall removes everything related to a program from this directory. > In the age of shared runtimes, auto-updaters, extension marketplaces, and JIT compilers, managing installed applicat…

That was the first option, "provides a framework for installers/uninstallers". But what would you do with the millions of existing programs, most unmaintained? And what about programs with strong opinions on update schedules, or built-in extension marketplaces? It's easy to solve this problem if your first step is "replace every program".

You could provide the framework that well-behaved, maintained programs will use while still allowing the old installers to run.

By the way that's what we have on Linux, some programs come as a shell script that you run to install them. Most Java IDEs for instance.

(which can't be arsed to provide proper packages -- darn, what did I just write? :-))

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#262

Post by mjan22640 »

BoppreH wrote: post #245
blackpill0w wrote: post #149

Why do Windows programs need special installers/uninstallers? Why isn't this handled by Windows itself?

How could Windows handle it by itself? If it provides a framework for installers/uninstallers, it'll be fighting the inertia of decades of legacy software, programmer habits, and old tutorials. If it tracks file ownership by program, it might accidentally delete user files. How would it differentiate between a VSCode extension that should be uninstalled, and a binary compiled with VSCode for a user project? A false p…

A VSCode extension would be installed and managed by the OS package manager. User created content would be not.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#263

Post by jraph »

mjan22640 wrote: post #262
BoppreH wrote: post #245

Earlier quoted context omitted.

How could Windows handle it by itself? If it provides a framework for installers/uninstallers, it'll be fighting the inertia of decades of legacy software, programmer habits, and old tutorials. If it tracks file ownership by program, it might accidentally delete user files. How would it differentiate between a VSCode extension that should be uninstalled, and a binary compiled with VSCode for a user project? A false p…

A VSCode extension would be installed and managed by the OS package manager. User created content would be not.

You, you want Microsoft to lose its total control over the VSCode extension "marketplace", don't you?

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#264

Post by mjan22640 »

jraph wrote: post #260
Tuna-Fish wrote: post #256

Earlier quoted context omitted.

The same way any linux distro does? Define a separate directory for program installations, that user processes cannot write to. Only program that can do so is the package manager, which other programs can call to install packages. Uninstall removes everything related to a program from this directory. > In the age of shared runtimes, auto-updaters, extension marketplaces, and JIT compilers, managing installed applicat…

I agree with you, now for completeness I should mention that Linux package formats usually allow packagers to provide arbitrary pre- and post- install shell scripts ran as root. (which means that if you don't trust a provider, not only it's not safe to run the program, but it's also unsafe to install it)

The packages are cryptographically signed, you have the option to abort the install of an untrusted package before it does something malicious.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#265

Post by hnben »

mark_and_sweep wrote: post #243
notpushkin wrote: post #187

Earlier quoted context omitted.

Wow, that's so cool! I played around with making HTAs as a kid and never thought those could be that powerful. (I quickly moved on to topics more exciting to a teenage hacker, like making WinForms apps with some PHP RAD IDE.) Wondering what would it take to port mshta (with all the ActiveX goodies) to other platforms. Maybe it's a little bit late for that, but sounds like it might be a fun project to me.

To be honest, in my ideal world, mshta, Electron and the like would be discontinued and, instead, there'd be a cross-desktop-platform HTML/CSS/JS app-runtime (_not a browser!_). This runtime should support a sensible, large subset of modern Web APIs plus a set of cross-OS and OS-specific APIs so it's easy to work with for developers. To be easy to use for users, it should be installed by default on all major consumer…

how do you feel about PWA?

https://web.dev/progressive-web-apps/

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#266

Post by jjgreen »

irusensei wrote: post #253
highwaylights wrote: post #159

Earlier quoted context omitted.

I don't think any major desktop OS handles this well. I suspect the final form for software installation is probably where iOS and Android are going in the EU, where there's a single means of installing software to the device so that everything can be sandboxed properly, but the acquisition/update process can be pointed to a URL/Store that the user has pre-approved. macOS comes pretty close to what I'd ideally want i…

Everyone is pointing at Windows but there are still installer software on MacOS. Normally crusty old corpoware like Citrix that needs to extend its tentacles to the whole system. On Unix/Linux land the prevalence of pipe curl to bash type installers is not much different. I normally keep both types away from my computers.

On Unix/Linux land the prevalence of pipe curl to bash type installers is not much different.

True, but saying so will likely to earn you downvotes from those committed to this unhygenic practice ...

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#267

Post by ateng »

jraph wrote: post #260
Tuna-Fish wrote: post #256

Earlier quoted context omitted.

The same way any linux distro does? Define a separate directory for program installations, that user processes cannot write to. Only program that can do so is the package manager, which other programs can call to install packages. Uninstall removes everything related to a program from this directory. > In the age of shared runtimes, auto-updaters, extension marketplaces, and JIT compilers, managing installed applicat…

I agree with you, now for completeness I should mention that Linux package formats usually allow packagers to provide arbitrary pre- and post- install shell scripts ran as root. (which means that if you don't trust a provider, not only it's not safe to run the program, but it's also unsafe to install it)

>if you don't trust a provider, not only it's not safe to run the program, but it's also unsafe to install it

Isn't it same for windows right now? `.msi` and `.exe` can execute arbitrary code right?

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#268

Post by hardware2win »

proto_lambda wrote: post #157
hardware2win wrote: post #143

Earlier quoted context omitted.

Software shouldnt update itself? What? Thats crazy If browsers werent updating itself we would have huge security mess

The package manager updates the browser, just like it updates everything else.

Why would software want to rely on some external software?

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#269

Post by grishka »

TheHappyOddish wrote: post #246
ikekkdcjkfke wrote: post #244

Earlier quoted context omitted.

Why does a third party app have rights all files without asking? The Android app rights system integration into linux and windows is way overdue

I'm fairly sure Android apps running as root (like this driver installer probably was) will also have access over all files without asking. That's the danger of root.

Android apps themselves can't run as root. The apps that do perform operations "as root" do so by spawning a shell process running as root, usually using `su -c`. That's on a rooted device. Normally, all privileged actions are done by system daemons that run with appropriate permissions and that apps communicate with through the "binder" IPC mechanism. Those daemons also handle access control — both the regular Android permissions and the god mode for "system privileged" apps.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#270

Post by winthrowe »

BoppreH wrote: post #258
Tuna-Fish wrote: post #256

Earlier quoted context omitted.

The same way any linux distro does? Define a separate directory for program installations, that user processes cannot write to. Only program that can do so is the package manager, which other programs can call to install packages. Uninstall removes everything related to a program from this directory. > In the age of shared runtimes, auto-updaters, extension marketplaces, and JIT compilers, managing installed applicat…

That was the first option, "provides a framework for installers/uninstallers". But what would you do with the millions of existing programs, most unmaintained? And what about programs with strong opinions on update schedules, or built-in extension marketplaces? It's easy to solve this problem if your first step is "replace every program".

If you care about this enough to abandon old software, they built that and called it Windows S and few wanted it.
Post reply on HN