How much security is needed for windows 10?

[alexnoot]

Jezzuusszzzz   ...  WTF is ET phoning home...

15 minutes to boot ?  WTF is that ?

My workstations are *ALL*  systemd free.
They boot an INIT SystemV  the very old fashioned way.

All checks are made in run level 1
disks are safely checked and run level 3 enters only after all passed OK

Run level 3 starts about 3 minutes after and put server mode in a minute long..
If ALL ( i mean it all ) goes 100% pass OK XWindows took over in 15 seconds flat.

And I am always wondering how to save 5 or 10 seconds... every boot.

Jezzus WTF is ET doing in your life...
Paul

I'm no Windows fan, most of my computers are either Linux or macOS, but this is obviously something that has been fucked up somewhere. It could be the install itself, an old 5400rpm drive, anything really. My one remaining Windows PC, which I basically only use for gaming, boots in less than 10 seconds.

Computers can be slow and get borked, no matter the operating system. And your passionate hate for systemd is getting a bit old and repetitive, I usually prefer Debian or some of it's derivatives (meaning they run systemd) ... and they boot pretty quick too.

[Red Squirrel]

I'm a lucky guy using MS windows 10, for years  without any kind of problem ( at least that I know), Also use Linux, and have a place for both

My only problem with my Win10 box (quad Xeon, 48 GB RAM) is that it takes a ridiculous amount of time to boot from a cold start, even after a proper shutdown. As in, it takes minute to start. And then when I log in I see 100% activity on the hard disk, and that just makes everything painfully slow until that stops doing whatever the hell it's doing.

Ah yes the dreaded "startup lag" I like to call it.  You'd think MS would have fixed that by now.  It seems after a cold boot you need to let it "warm up" for a few minutes before it's usable.  Especially true on a regular hard drive.  SSDs are better, but that is just masking a problem not fixing it.   

Part of the actual boot process is because of UEFI though.      I find UEFI boards take super long to POST compared to older style bios, so more than half of the boot time is pre OS. 

That said, Linux is not perfect either in this regard.  Talk to me about SystemD. 

[PKTKS]

(..)
And your passionate hate for systemd is getting a bit old and repetitive, I usually prefer Debian or some of it's derivatives (meaning they run systemd) ... and they boot pretty quick too.

Nope.. do not get it wrong.  It will affect your perspective.

I use POTTERIX systems where no security is required.
Where no important critical steps are required.

It is impossible  to discuss setups, security and proper system initialization avoiding that  POTTERIX fork of UNIX.

I do not rant or hate, it is a simple fact.
POTTERIX is a fork and requires proper mention whenever needed

I will do so when it comes necessary like booting with critical safe checks at expense of some time and fancy logos..

no hatred.  It is impossible to avoid such mentions

personally I do not use POTTERIX - but i setup POTTERIX for others fine.
although with strong advice of caution

Paul

[alexnoot]

Calling Linux 'potterix' (I assume it's Linux you mean) is somewhat hateful and belittling. Childish even?
It is also impossible to discuss something when one side presents their arguements in such a way. I don't know quite enough to have a good and educated opinion on the pros and cons of systemd, but I would like to learn something. Unfortunately, it's hard to learn something from someone who argues in a tantrum-like 'just because' kind of way.

All I've learned from you from the posts I've seen on this forum is that you are 'that-anti-systemd-guy'.

No disrespect, you seem like a knowledgeable guy. But yelling 'systemd baaaad' over and over gets old.

[bd139]

Hey I’m also the anti systemd guy and anti freedesktop guy. I just complain a lot less about it 

Potterix is a perfect characterisation of the incursion against sound engineering and in favour of ego driven development. 

[PKTKS]

Calling Linux 'potterix' (I assume it's Linux you mean) is somewhat hateful and belittling. Childish even?
It is also impossible to discuss something when one side presents their arguements in such a way. I don't know quite enough to have a good and educated opinion on the pros and cons of systemd, but I would like to learn something. Unfortunately, it's hard to learn something from someone who argues in a tantrum-like 'just because' kind of way.

All I've learned from you from the posts I've seen on this forum is that you are 'that-anti-systemd-guy'.

No disrespect, you seem like a knowledgeable guy. But yelling 'systemd baaaad' over and over gets old.

No this term is widely used and seen in forums discussing the problems (the really big issues) underneath the wide adoption of the SYSTEMD thing as a whole.

You see.. that folk is being paid to implement a business model.
That model FORKS UNIX in every single rule on the book..

These folks crammed a huge pile of things which should never ever be glued..
thus creating the "POTTERIX" system(D)..

It is not my term.. I just find it a perfect suit for the "NEW" *NIX created..
if that can be called NIX...

I use POTTERIX for people expecting a dummy drop in replacement for MS.

Kinda install and point and click and puff...

For myself .. using *NIX a long time POTTERIX is a shitshow or  EGOTRIP..
but the folk is being paid.  nothing against that..

I just will not use that thing on serious systems

Paul

[PKTKS]

Hey I’m also the anti systemd guy and anti freedesktop guy. I just complain a lot less about it 

Potterix is a perfect characterisation of the incursion against sound engineering and in favour of ego driven development.

TRUE..  it mostly boils down to the EGO of that folk..

But the folk is being paid to do that shitshow..

ME? Like it or not a LOT of people think think it is good..
It does fill the gap as a drop in replacement MS  LOOK AND FEEL AND BEHAVE

But it is a security hazard and a tragic glue of ideas..

Paul

[bd139]

The worst thing is everything is stateful, opaque and behind distributed RPC which is the opposite of everything Unix.

In fact it's basically Windows+DCOM reimplemented badly.

[alexnoot]

No this term is widely used and seen in forums discussing the problems (the really big issues) underneath the wide adoption of the SYSTEMD thing as a whole.

So it's like a circle-jerk term amongst the anti-systemd-guys then? I've never heard the term, and it still teaches me nothing and leaves me still uneducated about what's actually bad about systemd.

Not all Linux users are of the point-and-click type. I started learning it as a kid on Slackware some 20 years ago, everything had to be compiled from source. But I learned.

[magic]

Okay, I will teach you.

The fundamental problem of system-d*** and other software from that guy is that it simply sucks. It solves problems you may or may not have, but it's shipped with your distribution (and can't be easily removed) because it claims to solve problems that others have. One after another it absorbs or replaces utilities you have been using so far and the replacement inevitably comes with bugs that have been solved in the original years ago. Some more bugs come with new features that you don't care about. And if you complain, their answer is invariably "we are all human, no software is perfect, stop wining and file bug reports". And then another bug, and another stupid issue, and a security vulnerability long solved by others, and a stupid quirk that they refuse to fix, and a request to put a kludge in the kernel to mitigate their stupid design, and ...

Just say no.

[DiTBho]

and can't be easily removed

Yup, that's the annoying point. It comes already installed, it has a lot of dependencies, it's fully integrated, and it takes times and effort to *remove* it.

[PKTKS]

No this term is widely used and seen in forums discussing the problems (the really big issues) underneath the wide adoption of the SYSTEMD thing as a whole.

So it's like a circle-jerk term amongst the anti-systemd-guys then? I've never heard the term, and it still teaches me nothing and leaves me still uneducated about what's actually bad about systemd.

Not all Linux users are of the point-and-click type. I started learning it as a kid on Slackware some 20 years ago, everything had to be compiled from source. But I learned.

Not exactly as you say... 
things are far more complicated.

The folk behind the "POTTERIX"  thing  is being paid to devel something that ultimately must make *NIX (all LINUX and as of today another folk is replicating that to BSDs) to behave just like MS Windooze since they removed all user interaction with the boot (circa win2K).

By removing users the system should:
- boot unattended and (hopefully) initialize all hardware and software stack
- bring everything ON as soon as possible to mimic a fast OS
- bring everything ON regardless safety and user intervention
- put that process under PRIVILEGED level 1  being the root/father of all others.

It is obviously meant to fill a niche business on the CLOUD so to rent images.
Those can be rented unattended and regardless user specific fits. 
Rent and vanish images.

It is also obvious that by removing users and system admins....
all specific tasks - mostly the critical ones related to safety are now under control of that thing  in which the other business model can be placed on top like selling security as kits of ant-this anti-that  scan-malthis scan-malthat...
anti-virus and user daemons firewalls (away from kernel ring)

The paid project started by including almost all functionality of file system, partition tables, process control.. and just kept growing to insanity by adding DNS resolvers and even home directory total control....  a total insanity egotrip - very cocky arrogant one

ISC (the BIND consortium) has put decades of research and devel into BIND.
BIND is one of the most critical part of Internet and every safe machine.
Every experienced folk will confirm you that DNS resolvers are the most vulnerable critical part of safe systems.

No surprises that systemd thing includes a DNS resolver..
and absolute pathetic unsafe..

To make things even worse.. 
MODERN UEFI can boot ANYTHING REMOTELY using http protocol and a built in TCP/IP stack..

It is not hard to see how a dummy systemd thing can boot your hardware using ANY image remotely replacing everything w/ a custom one. It has a resolver built in.

Nevertheless that thing spread cocky fooling all users with a MODERN  linux that everyone should use and every 15 days removing essential tools and incorporating that into a flaw lame limped systemd part... impossible to find a proper term...

It has gone insane and being forced into everybody throats without options..
that is the worst part.  - IT IS FORCED BY FINANCED INTERESTS - not an option

You see all packages on LINUX and UNIX are "optional" and can be integrated or not.

But not POTTERIX systemd. THEY ARE NOT removable

It is not meant for that. 
Meant to FORK UNIX into POTTERIX  thing..

controlled and dictated by those who are financing that..
And everybody knows who..

Fortunately a lot of folks see the show going under...

Paul

[DiTBho]

The Linux kernel is algo in perpetual regression, and it sounds no good, but even if Linux will go down hills there is always HOPE for Haiku and FreeBSD

[DiTBho]

Oh, and Minix v3 is still a true *NIX and now using NetBSD packages.

[PKTKS]

The Linux kernel is algo in perpetual regression, and it sounds no good, but even if Linux will go down hills there is always HOPE for Haiku and FreeBSD

it seems to be taken by assault by private interests with heavy finance/sponsor capabilities.

Google ANDROID
MS jerks using WSL and Wayland layer..
MediaTek ARM party under SAMSUNG interests.
IBM CLOUD
XXX CLOUD.

.xx cloud (fill yourself)

and several small form factors notebooks tablets and gizmos..

in which no user intervention should ever be allowed on the core OS.
They are the landlords.

It seems so for a while
the days of a secure free open OS are gone - they are left on 90/00s

Paul

[DiTBho]

Wayland layer

I don't know, but I am really worried about the new "open compositor" model introduced by Wayland because it will be pure hardware-vendor' duty to write it.

MediaTek ARM party under SAMSUNG interests.

I have no experience with MediaTek' SoMs, I am considering the purchase of R64 board to develop a new project based on MTK MT7622, but it's still an hypothetical target. I don't know about SAMSUNG' interests, just ... if their interests are like those of Allwinner then there is no good in the near future, only bugs and more kernel regression.

[PKTKS]

I have no experience with MediaTek' SoMs, I am considering the purchase of R64 board to develop a new project based on MTK MT7622, but it's still an hypothetical target. I don't know about SAMSUNG' interests, just ... if their interests are like those of Allwinner then there is no good in the near future, only bugs and more kernel regression.

Almost  *ALL*  SAMSUNG models I have been taking apart to repair or inspect have some sort of MediaTek ARM processor inside.

The KERNEL has a full branch very very well maintained with MediaTek chipsets

Just check it out for yourself

Paul

[alexnoot]

(...)

Thanks you for taking your time explaining. I knew systemd was a monster of everything-in-one, but I didn't know that much.
I have been looking into systemd-free alternatives, but I probably won't do anything about it until I build a new computer, I really dislike changes 

[bd139]

If it’s any consolation as much as I hate it I still use it because I can’t be bothered with it.

[PKTKS]

(...)

Thanks you for taking your time explaining. I knew systemd was a monster of everything-in-one, but I didn't know that much.
I have been looking into systemd-free alternatives, but I probably won't do anything about it until I build a new computer, I really dislike changes 

OK welcome.

Try any systemd free distro of your choice and you should be far more suited...

Also for the record this is the folk :
"Hey look ma I wanna be POTTERIX"

putting that aberration into all BSDs as well

I wonder WHY  Apple will ever allow him to do that.. 

Check
https://anetbsduser.wordpress.com/2021/08/24/initware-comes-to-macos/

https://www.itsfoss.net/initware-as-a-systemd-fork-also-for-macos/


The bad news for OpenBSD in which they will put the same unsafe business into that as well

Paul 

[DiTBho]

The bad news for OpenBSD in which they will put the same unsafe business into that as well

For Linux it may * somehow * be acceptable as it is considered a sort of * Swiss army knife for * NIX, but for an OS like OpenBSD that has always made security its strong point, forcing SystemD is rather like betraying the founding ideals.

[DiTBho]

Yesterday I ordered a Lenovo AIO 3 IdeaCentre All in One from Amazon.

Paid 300 UKP thanks to a promotion. A big parcel arrived today with a 21" Full HD display, AMD Athlon Silver 3050U, 256GB SSD, 8 GB of RAM, DVD±RW, USB-keyboard and mouse, and "Windows 10 Pro" already installed.

Not bad for the money, enough decent to be dedicated to mobaXterm (kind of ssh + X11 support for Windows), plus a couple of RDP applications like TeamViewer and Suprema.

But ... I powered on the computer this morning before having lunch, and as soon as I connected to the internet it started downloading *hundred* MB of updates and billion billion patches, so many that it took until dinner to complete downloads, update things, and restart.

hundred MB of updates ... it must be related to the level of security, I guess

[bd139]

Ah first rule of Lenovo club is can the updates immediately and create some new latest windows 10 media from MSFT’s web site. Then wipe and install off that. Then only download the Lenovo drivers for the bits that don’t work after that is installed and updated.

On my T495 that is only the hot keys utility 

[Q8]

damn this topic was/is a good read... if i only knew what 'folk" is... :<

[Nominal Animal]

The problem with security in software is that it has to be designed in, as it cannot be bolted on afterwards.  This has been proven time and time again.
Unfortunately, designing security badly is too easy: see e.g. Sendmail and BIND for historically horrible security track records.

The true issue with the current situation is that we have at least one generation of desktop users who do not understand security, and see it as a hindrance instead of a tool.  So, any attempt to make things better is just plastering over the problems.  Many of those users have become developers, so it is the misunderstanding and bad practices that spreads, rather than proper understanding and security practices.

(Even though I use Tux as my avatar, the same problem affects Linux just as badly.  As mentioned by e.g. bd139 above, the defaults in Linux distributions aren't that secure either.  Making any OS –– even OpenBSD –– secure for given tasks takes a lot of effort, the overwhelming majority of which is about humans and their behaviour.)

I too have dealt with security issues, from oblivious users who keep their passwords on a post-it note stuck to their display in a publicly accessible office environment (and only grudgingly moved it –– to the bottom of their keyboard, of course), to intrusions, and to sysadmins who were so averse of being responsible and their actions trackable that they did absolutely all tasks using sudo su - so as to leave a plausible deniability wrt. system logs whether a given command was run by them or by another sysadmin.

The question of what level of security is sensible –– how much effort to spend –– in any given situation, is an interesting one.  I cannot help with Windows 10 myself, though.