Static Windows: is this insane, or what?

I find that when the admin is also the user, you tend to log into or runas in order to do what you may not trust anyway. So as I have pointed out elsewhere, LUA vs Admin is not the cure for it. This is not ground breaking news of course.

The thing that I personally struggle with is just how much effort do I personally go through testing something before I install it? It does not matter if I am Admin or User, I still must trust it to use it. So, is it malware? Virus? Does an AV scan give me 100% certainty that the software (presumably) is going to behave? Do I do everything in vmWare? Do I need to run a firewall to see what is happening, or a HIPS to really KNOW?

Some time ago I decided to stop playing that game. If I know what it is, and generally trust its source, I might install it into sandboxie (especially if I don't want to clean it up) and sometimes vmWare. But I have chosen to focus more on imaging rather than heavily testing something.

It lightens my load (time) so that I know, as long as my critical data is backed up, if everything goes wrong, a reboot and 5 minutes later it is back to normal. I try to use only the built in security measures as much as possible, for simplicity. User knowledge, as we all know and agree, is really what keeps you in the clear anyway.

My systems are pretty static unless there is a need to put patches/updates on. Video cards, NICs, BIOS, OS, audio, all of them rarely get changed unless there is a true need.

I still sleep at night, and now that I don't go through 99 different steps to make SURE a file/program is safe, I get a lot more done. To date, my vigilence has paid dividends. Time spent examining the OS, being suspicious, running firewalls and hips and the gaggle of other tools has been a great way to learn that much more. Knowledge is power they say, and for me it has been the power of freedom from worrying too much about things that just don't happen to me.

I truly do believe that rollback/imaging software will be the way in the near future that vendors turn to in order to help thier casual customers.

Sul.

 

Except for one system that I'm constantly experimenting on, I rarely switch to administrative mode. It's just not needed for my normal usage. I run several operating systems, 98FE thru XP-pro. Many of these don't have built in LUA. I use SSM to separate user and administrative privilege. Different tools, basically the same end results.

The process sounds worse than it really is. A lot of it can be done in the background. A full system backup of an OS takes 2-5 minutes. The VirusTotal scan takes a few minutes. I'm usually browsing on another tab while it runs. Monitoring the install with Inctrl5 is effortless. Just start it first and let it launch the installer. Using a test system means I have to install twice if I'm going to keep the software. I can't really figure out a realistic time cost for this. Over half the software I try never gets past the test PC for one reason or another. There's more work and time spent on the testing system but less on the regular ones. I don't install much on the regular systems. Something gets installed on a good PC maybe 3 or 4 times a year. Reading the SSM prompts isn't usually too bad. With most of the apps I install, there's about 6 or so. If you're installing something like OpenOffice, then it's another story. Most of the time, I don't want all of the "features" installed by new software. Too many of these "features" are useless to me and just add extra load to the system. By reading the prompts and being selective in what I allow, I can effectively strip down many apps during the install process. As for the firewall, I rarely see anything out of it during installs unless an app tries to call home. Most of the time, that ends the testing. Calling home is a behavior I don't accept from anything, software or system.

I've also grown tired of all the games but chose a different route to deal with them. Default-deny has enabled me to just drop out of this "arms race" between users and malware. IMO, AVs as resident protection are a joke that should have died years ago. Malware creation kits have made them nearly worthless, save for keeping the vendors in business. I do like Sandboxie as a way of isolating the attack surface, but not as a standalone solution. On one PC, I use it to create a more permissive workspace but the core of that system is still protected by the same package I use on all my PCs. Relying on sandboxing or virtual systems to create a more default-permit type of environment just puts you back into the arms race, requiring you to keep the apps patched and up to date for their protection to be reliable.

That's about the same amount of time it takes me to restore from a backup. I also separated the operating systems and my data long ago.

Totally agree regarding knowledge keeping you safe. Total opposite on the choice of tools. I like the Windows environment but I don't trust MS at all. IMO, they're more like a necessary evil that you can't turn your back on. It's all their games that I dislike the most, user control and lock-in, planned obsolescence, controlling hardware compatibility, etc.

Same. With older operating systems, those updates often hurt performance, and I don't believe that it's by accident or a side effect of making it work better on newer systems. I'm betting that it's all part of planned obsolescence.

A lot of people seem to have this misconception that those who use classic HIPS and rule based firewalls spend their time sorting through prompts and alerts to the point that it harms productivity. That must come from those who have tried apps like SSM and Kerio 2 but never got them configured. I configured SSM to work with the UI disconnected by default, which is user mode. There are no prompts in user mode. On most days, it stays in user mode. There's no need to do otherwise. Since the system doesn't change, Kerio doesn't have anything new to alert me to. I don't worry about what a user might do, what an AV might miss, or what the next MS patch will break. I enjoy having a system that behaves exactly the same every time I use it. Building it was time consuming. The learning process was long and is ongoing. Maintaining the system takes almost no time. For the most part, it takes care of itself. Even defragmenting isn't necessary when the system doesn't change. The swap file is in a dedicated partition, shared by each OS. The browser cache is on a RAMdrive. There's no cleanup.

That would work provided that there's also something that provides real time protection against keylogging, data theft, etc. All the default-permit based solutions have that weakness, no protection from malicious code that runs in memory or from a temp location. I believe that there's a wide open market for a remote administration service for home users that could employ any number of security policies or combinations of several. It's an idea I want to explore, if I can ever find the time.

 

I am just the opposite. If I am not fiddling with the OS or some application, then I am gaming. LUA is only a pain for what I like to do, not very friendly at all. But I see exactly your point, and in that situation I would agree that it can be very "set and forget".

True. However, for those of us who really want to understand what we are about to install/run, this is not enough. It might be overkill, but I have saved myself extra work by going through the effort of extensive testing before introducing things into the real system.

I agree, but I don't really see M$ in quite that manner... anymore. I used to. Now rather than having a 3rd party tool, I would prefer to do what can be done natively. Perhaps the imaging has calmed my fears, or perhaps it is just that with some vigilence, I don't really percieve there is much problems that can't be easily dealt with.

I don't really think advanced users have that sort of misconception about HIPS. I believe personally that advanced users use HIPS to KNOW WHAT IS GOING ON. I can see your position, where things stay static in regards to not only the OS, but also the software/drivers. Why would you want to see all those prompts. But when I used HIPS a lot, that is why I used HIPS, to see what was happening. I know I could always turn HIPS/firewalls into "deny most" mode, where only what was allowed to happen could happen, and everything else silently "disappeared". But that was not why I used them in the first place lol.

Nice collection of thoughts.

Sul.

 

That's one of the biggest points why I don't really like my current setup.
(I am running under LUA with AppLocker)

I like the default-deny from AppLocker. It will never allow me to run anything that is not white-listed by me and stuff like that.

but unfortunately LUA isn't perfect. Unfortunately developers don't want to focus much on LUA...

Unfortunately A lot of applications, games I like don't want to run under standard user.

So I will give them Admin priveleges, even though I know doing so I am compramising main aspect of my security (LUA and AppLocker.)

But I really have to
That's why on my last post I said that user will overwrite it's own security.
Clear example myself...

I do give games admin privileges (Because they are poorly coded and just don't run under LUA)
That's why in situations like this my setup becomes useless. Directly by my fault, Indirectly by fault of those developers and Microsoft...

That's why I am still on search. I hope some day I can just find something and leave it alone, like you guys did.
Sometimes I wonder do I really care? For so many years I run only AV... Do I really need default-deny now... Does the hassle of security get balanced with what I gain? When I don't really have anything to lose. E-mail, some accounts, Bank (which is nowadays insured by Bank against phishing and malware)

Anyway, sorry for changing topic a bit

And back to topic.
Static Windows it's great and stuff like that.
But same questions as above. Is it worth the hassle/restrictions?
It may be perfect for corporate environment, but for what about personal use? All those restrictions just to secure static OS..