Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

Post reply on HN
Print view View original

181–190 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#181

Post by pixl97 »

dangus wrote: post #108
fransje26 wrote: post #48

Earlier quoted context omitted.

Is there a more performant, less resource-crippling, antivirus for Windows?

This whole topic is a massive eye roll. In what universe is windows defender “resource-crippling?” There are windows laptops that will sip battery for an entire workday plus extra hours while running defender the entire time. So clearly it’s not “resource-crippling” if it can run on a laptop with a single digit wattage power draw. And then we’ve got the “I need to control my system I’m too smart for antivirus” folks…

>In what universe is windows defender “resource-crippling?”

In any universe where you do a lot of small file IO. I'm not saying that other AV isn't far worse, but on access/write/delete AV massively kills performance when you do anything that creates/deletes tons of small files.

Re: I ruined my vacation by reverse engineering WSC

#182

Post by AStonesThrow »

musjleman wrote: post #157
dangus wrote: post #119

Earlier quoted context omitted.

Let’s cut the bullshit, Defender is basically unchanged as a concept since Windows Vista or maybe even Windows XP. It runs completely fine on 15 year old hardware. We are in the “Windows users complain endlessly and refuse to switch to Linux” bingo card right now. Windows has been this way since before you bought that mini PC.

> Let’s cut the bullshit, Defender is basically unchanged as a concept since Windows Vista or maybe even Windows XP. It runs completely fine on 15 year old hardware. Exactly. It's the same legacy scan every fucking thing you open AV architecture. Back in the day of spinning disks it probably wouldn't have been too noticeable for the AV to marshal scanning to its usermode service and the filesystem to pull the data fr…

Yeah so like, every time I ran AV software it was quite obvious where the paranoia settings were, and how to tone down the aggressive "scan everything everywhere every time" settings.

For 98% of systems, there is probably no reason to scan every file on opening it. If people have enabled that setting, or left that default on, then that's their problem; it's not Windows Defender's fault.

My current AV dashboards are screaming at me that I'm only 35% protected. That's because I've exercised a lot of prudence in enabling paranoid settings, based on my rather limited and simplistic threat modeling. Installing AV software comes with the understanding that it can steal resources, but they nearly always have plenty of settings that can be disabled and win back your system responsiveness.

I am beginning to believe that commenters giving bingo-card winnings are not the brightest bulbs in the Windows MCSE pool, honestly. I can relate: Linux and Unix admin in general is far more intuitive and comfortable for me, so I have generally stayed on that side of things, but knowing how to properly set up Windows is an indispensable life skill for anyone.

Re: I ruined my vacation by reverse engineering WSC

#183

Post by Washuu »

es3n1n wrote: post #114
magicalhippo wrote: post #52

Earlier quoted context omitted.

My suggestion: In this post I will briefly describe the journey I went through while implementing defendnot, a tool that disables Windows Defender by using the Windows Security Center (WSC) service API directly.

thank you! i changed the first paragraph to include these changes

Appreciated, thank you!~ \(￣︶￣*\))

Re: I ruined my vacation by reverse engineering WSC

#184

Post by animuchan »

SSLy wrote: post #92
animuchan wrote: post #82

Earlier quoted context omitted.

In a sense, it has been for a long time. With Linux, there's often a good clean way to do a thing, and then there are weird hacks. On Windows, it often starts with weird hacks, as Microsoft is further enclosing its ecosystem. (I use Windows mostly for gaming and VR, and still have to constantly fiddle with the system to keep it working on a basic level, sad face emoji. Who would've thunk that merely playing a 8K Euro…

> Who would've thunk that merely playing a 8K European documentary in VR would require configuring DirectShow filters found on GitHub. Dios Mio, get mpv, enable gpu-hq

Thanks! How do I run it in VR though? Can't find it in the manual[1]

[1]: https://mpv.io/manual/master/

Re: I ruined my vacation by reverse engineering WSC

#185

Post by Yizahi »

rstuart4133 wrote: post #172
Yizahi wrote: post #153

Earlier quoted context omitted.

Skilled in what exactly? In x-raying all data storages on a system with a naked eye and spotting there a malware? In sniffing ether around the system and smelling a malicious bits on the radio spectrum coming in? How does this skill works?

> How does this skill works? I've been using computers for 40 years, have never installed and have always disabled malware scanners, and never had a virus. Maybe I'm special. But I'm not that special. There are 3 billion Android uses in the world, almost all of them don't have malware scanners, and almost all of them have never been infected by a malware. Ditto iPhone users. To be fair, I haven't used Windows for the…

I've used computers a bit less since 90s, and I'm also careful not to do dumb stuff on it. But I can't guarantee that any of any PCs at any time is virus free, because I don't know it and can't know it. And that includes Linux btw, though statistically it is much safer. But Linux is beside the point, the whole topic is about removing a Windows component, and on Windows there are millions of different malware.

Re: I ruined my vacation by reverse engineering WSC

#186

Post by 71bw »

devwastaken wrote: post #130
71bw wrote: post #59

Earlier quoted context omitted.

And yet I have none of these issues on 11 LTSC 24H2? Sounds like you forgot to disable Tamper Protection

its been disabled. defender group policy auto re-enabling is readily reproducible. i have a screenshot showing defender detecting the group policy change as a malware detection. any control you think you have over windows is imaginary.

Once again: Tamper Protection

Re: I ruined my vacation by reverse engineering WSC

#188

Post by BenjiWiebe »

dangus wrote: post #118
BenjiWiebe wrote: post #117

Earlier quoted context omitted.

We use some software that stores each record in a separate file; basically using the filesystem as a database. Without adding an exception to Windows defender, that software is unusably slow. Once the exception is added (or defender is turned off) the software is nice and fast again.

It sounds like adding an exception is the intended way to do exactly what you’re doing and resolves the issue entirely. It also sounds like you wrote bad software that didn’t consider the architecture of the parent OS.

Why blame me? I didn't write the software, I only use it. But yes, I consider it badly written software due to that design. I would use SQLite for that particular use case. It would make the programming easier and more performant.

Re: I ruined my vacation by reverse engineering WSC

#189

Post by SSLy »

animuchan wrote: post #184
SSLy wrote: post #92

Earlier quoted context omitted.

> Who would've thunk that merely playing a 8K European documentary in VR would require configuring DirectShow filters found on GitHub. Dios Mio, get mpv, enable gpu-hq

Thanks! How do I run it in VR though? Can't find it in the manual[1] [1]: https://mpv.io/manual/master/

via Virtual Desktop I suppose. So mpv would do all of the video stuff and then would blit a SbS video onto VD, and VD would warp the two halves on a spherical surface?

Honestly I've never thought about that before.

Re: I ruined my vacation by reverse engineering WSC

#190

Post by tmcdos »

mr_toad wrote: post #76
stuffoverflow wrote: post #53

Earlier quoted context omitted.

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…

> I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. It’s much less likely than it was 20 years ago. A lot of attack vectors have already been fixed. But hypothetically a bug in the network stack could still leave an internet connected machine vulnerable.

Do not connect it directly - use a dedicated router device.
Post reply on HN