cCleaner

Basically windows as distributed runs in the same way as most modern LINUX systems. Your session is stripped of admin rights and you have to explicitly select them when needed. If a user without admin rights tries to do something that requires admin rights they get prompted to run as a different user.

Dave

They have even been known to talk in clear texts in public toilets...

-- Those who want slavery should have the grace to name it by its proper name. They must face the full meaning of that which they are advocating or condoning; the full, exact, specific meaning of collectivism, of its logical implications, of the principles upon which it is based, and of the ultimate consequences to which these principles will lead. They must face it, then decide whether this is what they want or not.

Ayn Rand.

I said that., BUT it was still backrwards compatible with DOIS

It doesn't have sudo*, which makes repetitive admin jobs a pain if you have a decent password. But you shouldn't need admin privileges often, mainly when installing or setting unusual file privileges. If you have applications which frequently require admin privileges, then they were written by amateurs.

When Office was installed, and not a web app, then every user of a computer had to run every component of Office for the first time as an admin user. That was a nuisance, but at least it was a one-off.

I don't use Windows often now, but it's very rare I need admin privileges. I can remember when many admin tasks actually needed the admin user to be logged in, but I don't think that happens a lot now. Usually it's just necessary to enter the admin user's password, and as I say, I don't do that often. My first job with a new Windows computer is to create (and test!) an administrator user, then when I'm sure it works, drop my own account to unprivileged.

• formatting link

Whereas Windows only needs Kerberos and LDAP, neither of which were written by MS.

My first job as a linux user is to give root a password so that I don't have to use sudo if I am doing extensive tampering

It actually needs much more those, but all the things you need come on one DVD image that is supported on one phone number for one inclusive price per desktop.

When you are trying to jump through the hoops of PCI, HIPAA, Common Compliance, NIST and a 1001 other security and privacy standards then having one supplier who delivers all the patches that you all hate but which you need to install, measure , monitor and report on to comply with those standards, makes desktop windows attractive.

As this guide to Linux patch managements says:-

... of course you will all say you don´t need to patch Linux but if you want to retain the above compliences, and if you want to handle credit card, health, government data, then you have to patch, otherwise when your security auditor runs the penetration tests and you fail its an issue.....

... of course its not easy on windows, but it is what it is, I am just happy to be retired and not have to deal with it..

Dave

Actually, Win11 does have sudo under

Settings > System > For developers > Enable sudo

For Sdelete, that is simple, but sdelete also burns up wear life on an SSD.

sdelete64.exe -z C: # First operation cleans clusters, second operation cleans $MFT data storage (unused slots). # Small files fit entirely in the $MFT slot and that's a significant leak mechanism. # Using TRIM does not clean the $MFT data storage area.

Here, I have created two text files. Hello.txt fits entirely in a 1KB MFT slot (both the filename and the content). BigHello.txt is using cluster storage for the bulk data. The $MFT slot has the file name.

File 45 \Hello.txt $STANDARD_INFORMATION (resident) $FILE_NAME (resident) $OBJECT_ID (resident) $DATA (resident) <=== The word "Hello" in the text file, is inside the $MFT 1KB slot for the file My password could be stored in such a "tiny" file. File 46 \BigHello.txt $STANDARD_INFORMATION (resident) $FILE_NAME (resident) $OBJECT_ID (resident) $DATA (nonresident) logical sectors 109934208-109936247 (0x68d7680-0x68d7e77) <=== 2040 sectors of cluster storage, as 255 4K clusters

What sdelete64.exe does is *one* pass of zeros on the white space.

The sdelete is perfect for VM usage (sdelete before a "compact"), perfect for HDD (wear does not matter), a bad idea for SATA SSD or NVMe sticks.

What is a cluster tip ? The following example stores a TEXT file using two clusters (8 sectors for each cluster, 16 sectors, 8KB).

While you are using your text editor, it consults the length field and it only attempts to read 12 sectors. The cluster tip is not normally accessible. And if you attempted to read the sector after the 12 valid ones, the EOF() is going to trigger.

So why would the storage of "BBBB" be a problem ? It's a problem if your enemy uses a hex editor to examine the partition for secrets.

If the 16 B's file had been cleaned at delete, it would be all zeros. Then when the 12 A's file is stored, the cluster tip would be clean. The cluster situation can also be identified, by using the length() field and working out which sectors could be a problem.

When I tested a Windows file system for leaks (I think I used SDelete), I was *shocked* at just how many security failures I detected on the hard drive. I wouldn't give a plug nickel for my knowledge of how the storage works -- based on how badly my attempt to hide secrets went.

The Heidi Eraser people, went to a good deal of trouble to perfect their effort. But I haven't spent any time testing that, so I have no idea whether anything shows up while scanning with HxD hex editor.

The swapfile on Linux, and the pagefile on Windows, can be a problem, but both OSes offer options to clean those files on shutdown. The last time I checked, my pagefile seemed to be zeroed, but that could be happenstance.

The Hiberfile on Windows is more of a problem, as when restoration is complete, the file is "marked invalid" via a header trick. No attempt is made to clear the large payload area of the file. The file is lightly compressed, so the file isn't exactly plaintext. The handling of the file is consistent with not wearing out an SSD. When you hibernate, the whole hiberfil.sys is not written for you. Only the occupied parts of RAM are written out.

The Hiberfil.sys is turned off here, so I cannot Hibernate, but I also cannot fill a rather large statically allocated space with chacha.

Summary: You should security test, whatever tool you have been using that was illustrating such a good security result.

Computers... leak. Better to stick your password on a PostIt Note. Anything "secure" is unpacked into %temp%, and then you have to check that area for leaks.

Paul

OK, I think I've seen that. Maybe a Command Prompt window that went full screen ? When they do that, they make the window big enough that the decorations go off the screen (they do this on purpose, it's not a bug).

You can use alt-F4 to

With (1) you can easily escape from an oversized full screen window. I don't know if the <esc> key works for those or not.

We were using alt-F4 in Windows 8.0 because the Metro.Apps at the time, had no "X" in the upper right corner of the window. The "X" went back up into the upper right hand corner in Windows 8.1 .

Paul

Alt-space for the control menu, them M to move, then use arrows to re-align the window into view.

Must be written by some Microsoft employee. No one 'patches' Linux.

AS usual its all mandated by government who are paid by microsoft to ensure nothing else meets the spec. BTDTGTTS

And yet these are teh organisations who have regular million item data breaches.

Well yes. We tried to bid for government/EU business once or twice, but it wasn't worth trying.

It was all stitched up so that only the people with massive organisations able to correctly fill in 1000 page compliance documents (written by the big companies consultants in the first place) need apply.

However it hasn't stopped a few governments 'going Linux'

- "South Korea switching their 3.3 million PCs to Linux

- "Italy’s Ministry of Defense is pioneering the use of open-source office tools by migrating 150,000 PCs to Libre Office (OK not linux, but ...)

- "Indian Government’s BOSS (Linux) operating system set to replace Windows, ward off hackers

- "German State abandons Windows for Linux.

-Other examples of governments and government agencies that run on Linux.

The U.S. Department of Defense

The U.S. Federal Aviation Administration

The U.S. National Nuclear Security Administration

The Government of Brazil

France’s national police force

France’s Ministry of Agriculture

The French Parliament

NASA

CERN

etc etc.

Perhaps they know something about security you don't, or perhaps there is a fortune to be made advising them....

The fact is that desktop Linux is now a better and safer working environment than Windows is. The handicap is that the major third party apps people are not developing their software for it

I think that is the bunny. Yep that works on the MATE desktop at least.

I'll remember that...

Used to work in Windows too, but now looks as if AI Copilot has hijacked Alt-Space

FFS. Is nothing sacred?

-- “The fundamental cause of the trouble in the modern world today is that the stupid are cocksure while the intelligent are full of doubt."

- Bertrand Russell

Still works for me - brings up the top left menu.

No, they are simply big enough to be able to build their own systems. In the UK there are 371 independent local authorities. Whilst I have been retired 10 years, as far as I know they all run a windows infrastructure, probably because they don´t have the teams to build a Linux infrastructure.

I never said it wasn't. What I said was it was harder to achieve security standards compliance using it. The two are not the same.

The handicap is that the major third party

Well this is like rocket science. Limited market means its not profitable to develop apps which means it does not achieve critical mass.

Dave

Alt-space in Windows 11 here (desktop focus), doesn't raise a response.

If CoPilot is hiding under the sofa cushions, it must have fallen asleep.

Paul