Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any sufficiently advanced uninstaller is indistinguishable from malware

devblogs.microsoft.com

Post reply on HN
Print view View original

501–510 of 556 posts

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#501

Post by GuB-42 »

EustassKid wrote: post #499
GuB-42 wrote: post #492

Earlier quoted context omitted.

Besides the "special uninstaller" thing. One of the things I hate the most with Windows filesystem management compared to Unix-like OSes. On Windows, opening a file locks it. So you can't delete a program that is running, you will get an error. It means of course that an executable can't delete itself without resorting to ugly tricks like the one mentioned in the article. That's also why you get all these annoying "i…

I feel like this is some stupid question but aren't exexutables and their libraries loaded to RAM? If yes then why can't it just delete itself (from disk)?

I don't know the details but I think executable files are mapped into memory, and needed sections are loaded on demand. In case the system is low on RAM, little used sections can be evicted, to be reloaded the next time they are needed. This requires the file to be present on disk.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#503

Post by Arainach »

dmazzoni wrote: post #477
kazinator wrote: post #413

Earlier quoted context omitted.

The .js script isn't injecting code into another program in order to deletee itself; it is deleeting itself directly. It can do that because, I'm guessing, the file isn't open; the run-time isn't executing instructions from that file. The file was read, the content compiled into memory, and closed. The script is deleting its source code, not itself. What actually deletes the script itself is the garbage collector in…

Is the behavior that a running .js script is fully loaded into memory and the file doesn't need to exist documented, supported behavior? What if, hypothetically, the system was suspended in the middle of script execution, and the resume function was designed to reload the script from disk? It just feels like a different hack to me. Also - trying 20 times and pausing 500 ms seems wasteful. What are the chances that it…

There is never a good reason to inject code into another process - particularly a system process. At the point at which you believe this is necessary you are several layers of hackiness deep and should go find a beverage and think over what your actual goal is.

As a metaphor: you find the instructions to sweep your floor cumbersome so you reprogram your neighbor's Roomba to come clean your floor. Sure, it may well go back to their house and no harm done, but it's hacky, socially unacceptable, and no matter how hard your broom is to use it's not OK.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#504

Post by slaymaker1907 »

dmazzoni wrote: post #477
kazinator wrote: post #413

Earlier quoted context omitted.

The .js script isn't injecting code into another program in order to deletee itself; it is deleeting itself directly. It can do that because, I'm guessing, the file isn't open; the run-time isn't executing instructions from that file. The file was read, the content compiled into memory, and closed. The script is deleting its source code, not itself. What actually deletes the script itself is the garbage collector in…

Is the behavior that a running .js script is fully loaded into memory and the file doesn't need to exist documented, supported behavior? What if, hypothetically, the system was suspended in the middle of script execution, and the resume function was designed to reload the script from disk? It just feels like a different hack to me. Also - trying 20 times and pausing 500 ms seems wasteful. What are the chances that it…

Even if it doesn't, I think you could do something similar by just spawning a shell (command prompt) that executes a small script trying to delete the file. You just have to take care to make sure the process is detached from the original one and then let the spawning process terminate to release the lock on the executable. PowerShell could also work, but I know it is pretty restricted in a lot of environments. These completely avoid any intermediate file.

I think the retry is necessary because if you launch "wscript cleanup.js" from the process that wants to be cleaned up, you then need to wait for the spawning process to finish executing. I agree if it fails after 20 times, you should probably spawn an alert or something letting the user know that uninstall failed. There are also so many random processes that might take a reference on the file like antivirus in Windows so just spamming retry will help wait that stuff out (this problem does not exist on Linux since Linux generally just does garbage collection which has the downside of not keeping specific paths around, just file inodes).

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#505

Post by Arainach »

chrchang523 wrote: post #489
dmazzoni wrote: post #477

Earlier quoted context omitted.

Is the behavior that a running .js script is fully loaded into memory and the file doesn't need to exist documented, supported behavior? What if, hypothetically, the system was suspended in the middle of script execution, and the resume function was designed to reload the script from disk? It just feels like a different hack to me. Also - trying 20 times and pausing 500 ms seems wasteful. What are the chances that it…

Agree, I'm shocked at how ugly the recommended alternative is. This does not make MS look good.

There are plenty of other solutions; that was merely one straightforward option that could be shown in a few lines of code and which doesn't require *injecting code into a binary you don't own*.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#506

Post by Arainach »

sim7c00 wrote: post #428
PcChip wrote: post #409

Earlier quoted context omitted.

>How is the proposed solution better than the original thing? I'm only assuming here, but maybe because it won't crash explorer and it's just a few lines of self-documenting code?

Haha, well fair enough the crash is bad indeed, good point! This isn't intended behavior though and presumably, it doesn't crash on in cases of this technique being implemented in uninstallers. (a bit of a guess i admit!)

You find the instructions to sweep your floor cumbersome so you reprogram your neighbor's Roomba to come clean your floor. Sure, it may well go back to their house and no harm done, but it's hacky, socially unacceptable, and no matter how hard your broom is to use it's not OK.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#507

Post by justusthane »

realslimjd wrote: post #444
drbig wrote: post #418

I still long for the approach many software used on the AmigaOS - the app is a folder, the folder has the main exec and any assets it needs (libraries, images, etc.) and documentation and... That's it. Install? Copy the directory to where you like. Uninstall? Delete the directory. And if you wish you could keep any files used/generated with such an app in the same folder, making it 100% self-contained. I remember bei…

This is how a lot of apps on MacOS still work.

Sort of. They still leave garbage behind in ~/Library though.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#508

Post by snkline »

eptcyka wrote: post #91

Their Teams uninstaller isn't quite as good - it just doesn't uninstall all the crap that the Teams malware has left behind. I still have a stray MS Teams audio device left on my macOS machine.

The Skype for Business "installer" is too good at removing stuff.

Skype for Business stop working, I run "Repair" on the installation, progress bar zips to completion. Skype for Business is now gone. Oh, and so is the rest of Microsoft Office.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#509

Post by chrchang523 »

Arainach wrote: post #505
chrchang523 wrote: post #489

Earlier quoted context omitted.

Agree, I'm shocked at how ugly the recommended alternative is. This does not make MS look good.

There are plenty of other solutions; that was merely one straightforward option that could be shown in a few lines of code and which doesn't require *injecting code into a binary you don't own*.

Sure, but there isn't even an offhand remark about how hacky this kind of polling is. It's presented as if it's a completely normal way to do things in reliable software.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#510

Post by efreak »

alerighi wrote: post #442
highwaylights wrote: post #159

Earlier quoted context omitted.

I don't think any major desktop OS handles this well. I suspect the final form for software installation is probably where iOS and Android are going in the EU, where there's a single means of installing software to the device so that everything can be sandboxed properly, but the acquisition/update process can be pointed to a URL/Store that the user has pre-approved. macOS comes pretty close to what I'd ideally want i…

> I suspect the final form for software installation is probably where iOS and Android are going in the EU, where there's a single means of installing software to the device so that everything can be sandboxed properly, but the acquisition/update process can be pointed to a URL/Store that the user has pre-approved. Basically how Linux distributions works since the beginning. Tough at the start the installation source…

Android/iOS didn't invent this, no, however you're missing the sandbox part. Most Linux package managers don't sandbox anything.
Post reply on HN