60 days, long enough for the US to exploit the vulnerabilities discovered by Claude Mythos, short enough to plausibly be bureaucratic corporate awfulness by Microsoft when all is said and done. Basically freezing you and other security software out of protecting the bad guys they particularly want to get at until after the bad guys get got, then everything goes back to normal and Microsoft says "oops, here, we fixed your access."

This is stupid. If Microsoft wants people to stop writing kernel drivers, that's potentially doable (we just need sufficient user mode driver equivalents...) but not doing that and also shortening the list of who can sign kernel drivers down to some elite group of grandfathered companies and individuals is the worst possible outcome.

But at this point I almost wish they didn't fix it, just to drive home the point harder to users how little they really own their computer and OS anymore.

> Effective October 16, 2025, Microsoft will initiate mandatory account verification for all partners in the Windows Hardware Program who have not completed account verification since April 2024.

> Partners who fail to complete Account Verification by the deadline, or who do not meet the requirements, will have their status set to Rejected and will be suspended from the program.

https://x.com/shanselman/status/2041974138253013205

https://github.com/rustdesk/rustdesk/discussions/13025 https://github.com/microsoft/winget-pkgs/pull/345601

tl;dr: ESET Antivirus flags RustDesk as a "Potentially Unsafe Application" because it is a remote administration tool, despite not flagging similar commercial products in the same way, and the WinGet Community repo policy is to block anything flagged as such. Since they were unable to update the repo the RustDesk team requested that the older versions be removed to prevent users from unknowingly installing old versions that could potentially be a security issue in the future. Apparently this has been an issue for a lot of applications especially in the VPN and remote control categories.

There is a discussion about how best to handle these sorts of situations where legitimate and desirable applications get flagged as "potentially unsafe" or "potentially unwanted" but so far it's just been a discussion with no actual changes proposed yet.

https://github.com/microsoft/winget-cli/issues/6107

It should be illegal for these companies, just like utilities, to deny service to anyone or any entity in good standing for dues.

There is little hope for getting this through in the US where most politicians of any stripe hate the public, and the ones that don't have hardly any power. But it might be possible to do this in the EU.

Then, we non-EU folks need to apply for Estonian e-residency [1] which may get us EU regulatory coverage.

[1] https://en.wikipedia.org/wiki/E-Residency_of_Estonia

<Tin foil hat on> Microsoft doesn't want to allow software that would allow the user to shield themselves, either by totally encrypting a drive, or by encrypting their network traffic! </Tin foil hat on>

Microsoft even supports Wireguard in Azure Kubernetes Service.

This is the same thing that's happened every time I've tried to have a Microsoft account. I don't think Microsoft wants to have customers who aren't rich.

If it weren't for the current administration, I'd say it's time for regulatory action.

Do not discount complete, total, utter, profound fucking incompetence as the driving reason behind this.

Getting the business verification was an astounding shitshow. With a registered C corp and everything, massively unclear instructions, UI nestled in a partner site with tons of dead ends. And then even after all the docs, it took another week because -- in an action that nobody could possibly have ever foreseen -- we had two different microsoft accounts due to a cofounder buying ONE LICENSE of O365 for excel and doing domain verification because it suggested it.

My advice is don't use a MS account if you can, at least not for anything critical. You don't need it for development, you can use 3rd party CAs for signatures.

More regulation won't help here, because the regulation-maker is itself the hostile party.

What would help is full control over the supply chain. Hardware that you own, free and open-source operating systems where no single person is the bottleneck to distribution, and free software that again has no single person who is a failure point and no way to control its distribution.

Also “there is no appeal possible” should be plain illegal.

The old model where the user decides which software or apps to run on their machine, is basically already replaced by a whitelist system that is managed by companies who have no interest or obligation to approve developers. Factors like ”being an individual”, an open source developer or god forbid reside outside the USA, you rely on a combination of L1 support doom loops, unjustifiable high recurring prices, kafkaesque and changing requirements, internal inconsistencies. Windows is the worst, but all platforms (except Linux) suffer from this and you can and will get hurt, delayed, and gaslit. If you haven’t, it’s just a matter of time.

I have been blocked for 6 months now with Digicert code cert renewal, for my app Payload, which will never get any media attention. The app doesn’t matter though, the approval process is per-entity (usually, a company). The point is that nobody gives a shit, because they have a monopoly/cartel and they start the validation process after they take your money.

If you are not an app publisher, the best way I can describe it is the ”pre-let’s encrypt” era of SSL certs, but more expensive, strict and ambiguous. In fact, I’ve never gone through any worse approval process in my life, and that includes applying for residency in two countries, business licenses, manual tax filings etc.

https://x.com/i/status/2041698657368703484

https://en.wikipedia.org/wiki/Paul_Le_Roux

https://web.archive.org/web/20260000000000*/https://www.true...

And now they're locking down Window OS, hard. Expect github and vscode to follow.

Are there some ways to combat such decisions legally?

It was never as good as freshmeat.net even in its heyday.

Because Sourceforge is horrible to use and was at one point actively pushing malware? It's pretty obvious tbh.

It's easy to paint the big gov as bad, but this is a case where unfortunately the populace seems to be in agreement with the big bad gov. While most US citizens support encryption, 76% or so, the vast majority 63% also favor government "backdoor" access for national security reasons.

I guess either we believe in democracy or we don't. It could be said that if Veracrypt isn't/can't be backdoor'd, perhaps the gov is simply implementing the will of the people :( via Microsoft.

I don’t know the number. But personally I think using the services and ‘simply’ only use them if the disappearance isn’t catastrophic and have the price be low or free while it works isn’t too bad a trade-off.

Admittedly that’s a big ‘if.’

It's decent, but it's not all roses at all, and I wouldn't inflict it on non-techies yet.

I don't think Microsoft cares (about anything besides making mo' money), but there are plenty of (state) actors that can influence the decision-making at Microsoft when it comes to these issues.

No tinfoil needed.

https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis...

?

Who cares if it's OSI-approved or not, a line saying "M$, Google, and the like need written permission for every use case" would help to make those leeches honest. Just learn from the JSLint example.

Because the Democrats were better at keeping them on a leash? No. Clinton was in charge 30 years ago and blew it.

Seems rather clear that he doesn't want French jurisdiction.

https://alf-s-room.com/etc/nandarou/binbows/binbows_english....

https://www.youtube.com/watch?v=QRIklga9IBQ

The FTC wasn't doing their job between 1980-2020 because of their ridiculous standard of, "if it doesn't raise consumer prices, it must be allowed." This lead to massive consolidation in many industries which of course ended up raising prices and hurting consumers anyway.

Recently they've had some wins but overall they're still failing to do their job.

It's possible that they could start issuing separate certificates upon specific request for code signing purposes, but it's doubtful they would be willing to meet Microsoft's requirements for such certificates, so their code-signing CA would not be added to Windows's trust store, rendering the certificates it issues useless.

The ACME protocol, the key automation technology that makes Let's Encrypt possible, performs domain validation only. It verifies that you, the person (or bot) making the request, are an authorized administrator of the DNS records, or port-80 HTTP server, for that domain. This is directly relevant to, and generally considered sufficient for, HTTPS.

However, domain validation is almost completely irrelevant to, and insufficient for, code signing. Microsoft's rules (and Apple's, incidentally) require establishing the identity of a legal person (individual, or preferably, company). There is no way the ACME protocol can do this, which means that the process is totally out of Let's Encrypt's wheelhouse.

But if OSes are being locked down and software has trouble distributing security updates through official repositories for Windows... that's a good reason to finally make the switch. Same as why my family is on Android: I can install f-droid, disable the google store, and don't have to worry about them installing malware / spyware / adware

There's different degrees of openness. Android till 2026 was an acceptable compromise (let's see how it goed forwards). Windows is also on the decline with their account policy, not sure about this certificate revocation thing (thankfully haven't had to deal with it yet; I'm not a user myself) but it sounds like they're moving to a walled garden also

When the degree changes and gets even less open, yeah you can say "well of course, they were never truly open, they're commercial" but it's still a change and might lead people to alter their choices

I really believe most "open source" big projects have been compromised long ago. We have saw all those "Foundations" taking them over with all their governance, bureaucracy and goal which do not make any sense at the first look.

One example is Fedora, which is part of "The Digital Public Goods Alliance" [0], "a multi-stakeholder initiative that accelerates the attainment of the Sustainable Development Goals by facilitating the discovery, development, use of, and investment in digital public goods."

The Digital Public Goods Alliance has about every governments as member plus all the usual suspects: Gate Foundation and co.

All the leaderships have usually no background or experience in open source or even computers but are just magically placed there. But you can't say anything because they are mostly women.

You read the goals and roadmaps of those foundations and find out it has nothing to do with software or open source. It is basically there to control those projects and then have them implement all the age verification, digital id, etc.

So yes this is not a surprise all those projects are now all in absurd features such as age verification.

- [0] https://www.digitalpublicgoods.net/

If Veracrypt was a honeypot, the powers that be would go out of their way to make it as easy to use as possible. They'd instantly sack whoever made this decision, and reverse it.

My guess was that he got caught up in some house-cleaning. My theory being that he's still signing his code the way malware authors also do and got flagged by some automated review that's meant to force him to go get WHCP certified or whatever the new route is.

are there any books or good articles with good sources about this? I'm very interested in what happened in the 80s through the mid 90s.

Pretty sure there were historically a lot of apps that stole peoples contact lists and were signed properly. Certainly in the Android world.

A signature is a signal, not an absolute. Although, to be fair, if Microsoft (or most other CAs) had done a better job, then that trust would have carried more weight than it does currently.

We're in an interesting spot here and the tension is tangible.

Don't do math that way! That math is illegal! Good boys and girls don't keep secrets!

These people sound ridiculous

Could this be the one exceptional case where people agree with the direction of policymaking? Sure. Is that likely? No, not really.

If this requirement was in place they would be a bit more careful about terminating accounts because the cost equation would incentivize it. Maybe they would be more careful in their automation or require more than one level of human review before cutting off access.

These companies are gatekeepers for their platform. It isn’t crazy to require them to act more responsibly.

It wouldn't. For example, before Gmail, email was often free or nearly free (bundled with your internet service), but in most cases, you could talk to a human if you had issues with the service.

What we couldn't do is turn these business models into planetary-scale behemoths that rake in hundreds of billions of dollars in revenue. In essence, you couldn't have Google or Facebook with good customer support. I'm not here to argue that Google or Facebook are a net negative, but the trade-offs here are different from what you describe.

It's actually the only thing that provides any kind of assurance to users. It's not like end users know if FuzzCo is the correct developer for FooApp but they know fooapp.com.

I would be ecstatic to be proved wrong on this, but experience tells me that is not likely to happen.

And if it were related to some kind of scan and malware flagging, the cert would have been revoked. It is not.

Then again, this was something like 20 years ago. Back then, Sourceforge was something closer to GitHub today. It was the de facto public source repository. You could even get an on-premise version, IIRC.

Actually, this is sounding a lot like GitHub these days… not sure what that means.

There are legitimate reasons for governments to intercept information, with the correct oversight -- enforced legally in an "checks and balances" manner. The fact that there is a breakdown of trust between government and people won't be solved with more encryption.

There’s no apparent mechanism to do so. Support was clueless. The privacy email address responded weeks later with “not out department”.

Start worrying about the erosion of your rights as a consumer.

Perhaps cachyos should maintain LTS metapackages for more than just the kernel. Video drivers, boot managers and whatnot.

For a "non-gamer" I would probably keep them on Fedora or even Debian.

If Microsoft amounts to a sentient entity (i.e. is able to care about things), we have a bigger problem.

If we put the wall of metaphor between us and that interpretation, it still remains likely that "users shielding themselves" is of primary concern to Microsoft's bottom line.

In digital services there's no such thing. There's only a damned corporation employing idiots who don't care about community.

But yes, there's a lot of critical single maintainer projects.

> The Department of Justice, now under Bush administration attorney general John Ashcroft, announced on September 6, 2001, that it was no longer seeking to break up Microsoft and would instead seek a lesser antitrust penalty

https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor...

Look at the Windows start menu. It used to be trivial to switch users. Two clicks, one to open the user list, another to switch - done. Now it's four: user panel, three-dots, switch user, pick user.

Look at the login sequence. They want their Windows Hello and they don't care if it works well or not - no way to get a pin or password prompt instantly, you gotta click three times (one to show a method picker, another to pick PIN entry, and lastly one to focus the goddamn field) despite no reasons to hide this UI.

It's not like they're trying to scam or sell user into something. It looks like some internal decision-makers that don't ever dogfood their decisions losing touch with the common sense.

Apple has that too, and this rot spreads elsewhere. But it's not intently malicious, a lot of things simply don't make sense - just total lack of self-reflection capabilities at the corporate level.

I've been thinking, and said before, 90s Microsoft was far from perfect, but they at least seemed to care a lot about the quality of Windows. 2020s Microsoft seems to see Windows users as a captive audience they can exploit for whatever the corporate executives fancy at the moment. It seems more like a gradual transition.

In any case, it seems to be getting more clear that Linux is destined to be the best OS for power-users.

Quite obviously. Look at the out of box new user experience on a Windows 11 Home installation. What you get when you open a new $600 laptop from Best Buy for the first time. The entire thing is designed to drive users towards perpetual monthly recurring subscription billing for various MS services for life (OneDrive, Office, Xbox Live, Xbox game store purchased games, etc). It's a platform which is built atop a rent seeking cloud services ideology that shows no sign of ever letting up.

I think he was trying to scream “Run!” without actually screaming “run”.

Everything else about complying with the wacko age verification law is up to distro builders.

>When my oldest son [Linus Torvalds] was asked the same question: "Has he been approached by the NSA about backdoors?" he said "No", but at the same time he nodded. Then he was sort of in the legal free. He had given the right answer, [but] everybody understood that the NSA had approached him.

so the assumption here is that TC were also asked to accept "contributions" from bioluminescent individuals, and chose not to. "just use Bitlocker" was a deafeningly loud dogwhistle, don't you think?

Which is 90% of the use of a computer. And Steam is taking care of the other 10%.

For the vast majority of people an operating system is whatever comes with the computer the kid at Best Buy told them they should buy or their IT department gave them. Asking anyone to switch is basically impossible.

There is nothing in a piece of random software obtained from some random source that authoritatively connects it with a particular domain. Without bringing an App Store or other walled garden into the picture, the operating system must evaluate an executable file according to the contents of the file itself. On cold launch, the information in the certificate can be presented to the user, and the certificate issuer can be checked against the O/S trust store, but nothing equivalent to the HTTPS domain check can be done.

DV certs work for the web because of that intrinsic connection between web site and domain. They fail for arbitrary software because of the lack of such a connection. The trustworthiness of code-signing certs comes from the relatively difficult process necessary to obtain them, and not the name attached to them. The identifiable legal entity to which the certificate was issued is more useful to the O/S vendor, as a harder-to-evade ban target, than it is to the end user.

Nothing in the Apple site or phone stuff would even clue the user in to what was happening, much less how to resolve it.

I grew up being able to download software and install it, and actually prefer that model (relying on reputational trust of the party publishing it, my own verification from other signals researched, or sandboxing techniques where appropriate).

Most users may not be aware, but a rare gem of a version of Windows that refreshingly doesn't even come with the store (or a bunch of the other unwanted bloat) is IoT Enterprise LTSC.

As a lifelong Windows user, the premise of Microsoft controlling what goes on my PC is revolting. I'm buying a tool from them, not a set of handcuffs. If it was some non-profit, open-source group running the store I might be more inclined to trust it. But ultimately the only gatekeeper on a product I own should be me. Otherwise I don't really own it, which leads to problems like this one.

The contrasting approach, where one designs a platform that remains secure even if the owner is allowed to run whatever software they like, may be more complex but is overall much better. There aren’t many personal-use systems like this, but systems like AWS take this approach and generally do quite well with it.

That's what Big Tinfoil wants you to believe!

Microsoft the corporation may only care about making money, but a lot of very high ranking folks within MS Security aren't just friendly to intelligence agencies, they take genuine pride in helping intelligence agencies. They're the kinds of people who saw nothing wrong or objectionable with PRISM whatsoever, they were just mad they got caught, and that the end user (who they believe had no right to even know about it) found out anyway. The kind of people who openly defend the legitimacy of the FISA court.

This aren't baseless accusations, this comes from first-hand experience interacting with and talking to several of them. Charlie Bell literally kept a CIA mug on a shelf behind him, prominently visible during Teams calls, as if to brag.

Remember - Microsoft was the very first company on the NSA's own internal slide deck depicting a timeline of PRISM collection capabilities by platform, started all the way back in 2007. All companies on that slide may have been compelled to assist with national security letters. Some were just more eager than others to betray the privacy and trust of their own customers and end-users.

They've since moved on to the SSS strategy: Ship, Slip, Slop.

plus n-word dot com hosts information about the plus n-word license which purports:

- The software will not be used or hosted by western corporations that promote censorship

- The software will not be used or hosted by compromised individuals that promote censorship

- Users of the software will be immune to attacks that would result in censorship of others

More specifically, it used to be feasible to distribute software between me (the developer) and my customers (the users) without a mandatory gate keeper that looks at me and decides whether I’m worthy, am from the right country, have good intentions etc. This is currently necessary on all desktop and mobile platforms except Linux. There is exactly 1 gatekeeper per platform (the platform owner who controls your device), except windows, which effectively have like 3-4 CAs that’s shrinking every year due to mergers and private equity ownership.

Software curation and reputation systems can be good, either with whitelists (say steam) or blacklists (say antivirus). I can see some use cases for it, but they should be within user control. What we have now is worse than a fearmongering Stallman rant. It’s incredibly bad, both pragmatically and philosophically.

Open source developers are doing Microsoft a big favor when they support Windows and publish Windows builds and installers. It's a substantial effort, and apparently that effort isn't appreciated.

If all open source software dropped support for Windows, it wouldn't really affect the open source community that much. It would definitely cause headaches for Microsoft however.

The ones that tell you there’s a problem with your MS365 subscription, but don’t tell you which one are an especially exciting challenge to deal with. Bonus points if they warn about “possible data deletion” without specifying what.

For the vast majority of people MS365 is a requirement, but really the issue is that even minor fixes require the command line on Linux and that makes it unusable.

This should be considered child abuse.

I hope Linux never succumbs to the lowest common denominator and people who actually enjoy tinkering will always have somewhere to go and something to learn. If that's being stuck, I hope it stays stuck.

My wife has used Linux for many years successfully and has never used the CLI once.

Any OS that requires even once going to the command line is unusable for 99% of the population (and for me I just shouldn't ever have to).

Anyway, even if you could get your own cert it would be same thing: MS could revoke or blacklist your indicate cert (though usually the grounds for doing so are much less shaky than your account being suspended for vague “tos violations”)

I have stay far away from that process for a long time. Apple MacOS seems like the worst in that department IMHO.

If I submit it manually for every update it tends to go better. If more people download and install it whitelists faster. But that is highly annoying, orwellian bullshit. Might even be anti-competitive or downright illegal.

Like none. Literally the best office you MIGHT KIND OF be able to run in 2016, but probably more like 2013.

Valve focused on games, that is awesome and really helpful…

But there are 10,000 distros and instead of putting real resources to put even rickety bridges over MS’s moat, no sorry, this team is making duplication-of-effort distro 10,001 which is now identical to thousands of others but the taskbar is in the middle of screen.

The people working on Linux are consistently uninterested in then things people would need to drop windows.

What ? On my computer ? Microsoft really has some nerves. My Microsoft account is scheduled for deletion.

There's a lot that one can gripe about Amazon as a company about, but credit where credit is due -- their inversion of responsibility is game-changing.

You see this around the company, back to their "Accept returns without question" days of mail order.

Most critically, this inversion turns customer experience problems (it's the customer's problem) into Amazon problems.

Which turns fixing them into Amazon's responsibility.

Want return rates to go down because the blanket approval is costing the company too much money? Amazon should fix that problem.

Too often companies (coughGoogleMicrosoftMetacough) set up feedback loops where the company is insulated from customer pain... and then everyone is surprised when the company doesn't allocate resources to fix the underlying issue.

If false positive account bans were required to be remediated manually by the same team who owned automated banning, we'd likely see different corporate response.

That would be both hilarious and horrifying if the only thing stopping the corporate dystopia is that Microsoft doesn't want to say the N word.

It's outrageous. MS is simply enforcing some Government crackdown on encryption software that would interfere with backdoors.

Valkey is better because all of the new development work happens on Valkey, not because of the license. If the actual developer changed the license, that would be a different situation.

These are real? I get these in my spam box all the time and they have all the hallmarks of a phishing scam, urgency combined with vague description with no verifiable details that aren't gleaned from my email address itself.

No it isn't actually, not for the majority, my wife (former Sales Person and Manager) uses Google office tools and used LibreOffice Write and Calc for years successfully.

You just needs something that opens a browser or a simple app. Nothing is more minimal and clear at the same time than Gnome, imho. Click Icon - Open App - Have clock at top. What more does one need?

https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT_ou...

Right now, if a handful of tech companies crater they'll take the whole world's financial systems out with them, so the government could easily be made complicit in any scheme they can conceive of to bolster their finances.

I was always convinced that Skype was bought by microsoft so CIA/US intelligence agencies to have listening capabilities.

The first thing Microsoft did after the Skype purchase was making it easier to tap into the calls by removing p2p calling and routing calls using centralized servers.

It also reminds me of the case of the entire family who lost all of their payment-linked individual accounts including business data and an academic dissertation because the son allegedly behaved inappropriately with a bot. Collective punishment on top of technofeudal instant banishment.

I agree that supporting Windows helps its ecosystem.

But also open source software on Windows is an important gateway to the free world. When you are already used to Firefox, LibreOffice and VLC, you might as well switch to Linux painlessly, but if those didn't run on Windows, switching to Linux would require relearning everything.

I myself am quite different. I have thoroughly had it with my current iPhone and am eyeballing /e/OS, before that I really started to find Android boring, before that Windows mobile (the nice one with the cards). I switch Gnome, KDE, some other DE (now getting ready to try Niri) every year or 2. I don't get the struggle, for me a new env is like a present (even though I normally hate presents). So much niceness to explore, so much to optimize. I love it. But I'm also one of those guys that reads the oven manual and tries all functions in week 1.

I'm not weird, all you people are weird.

Also I hate linux repos with a passion, because they are optimized for CLI usuage, and (like the whole OS) the GUI parts are a total unoptimized afterthought. Never mind that they are a dumping ground for whatever code anyone shits out, with virtually zero management or curation. With a CLI you don't see this, with a GUI it's a total mess.

I'm fine with app stores, but they need to be actively managed and curated. If not, I far far prefer just downloading .exe's from the source.

The Microsoft Store account was painful to set up, I'll note. My developer account had also been cancelled by Microsoft for unknown reasons, and I ultimately had to set up a brand new one. New email, new name. My new account has my middle initial because I couldn't clash with the existing, closed account. My first and last name alone are banished forever from the store.

The "same thing", as you concede, isn't the same thing. Quantity has a quality of its own: one happens all the time and we're reading an article about it happening right now. In the comments there's another prominent maintainer who it happened to, and it happened to me personally! That's three right here! The other happens so infrequently that people in this same HN thread are complaining that it isn't happening enough. Can you find an example that's like Veracrypt and WireGuard? In practice, it seems they rarely do this, even when they should. You can actually view the list under "Manage computer certificates" > "Untrusted Certificates." On my computer the entire list is 20 certificates.

I'm standing by my suggestion, 100%. These aren't equivalent risks at all.

tbh, I thought that I had built enough reputation on this particular MSI release, until testing it just now. Hate to see it :(

Why the hell would you want that? Office365 is a buggy piece of nightmare.

At least it reached its goal if it entertained you

The catch is, views like those must be kept to a fairly modest level by the people who hold them. Discussing them with ideologically aligned colleagues may be fine, but for example, when someone makes statements or asks questions with such pro-privacy framing on stage directly to security leadership at internal company conferences, that is a quick way to a severance package not only for the person on stage, but also for dozens of folks in the audience who clapped a little too enthusiastically at the onstage remarks.

MS went from "developers, developers, developers" to being a nightmare for everyone involved.

I actually liked Visual Studio 6 and the old MSDN. Now I only wish they were gone.

It could have grown into a massive, self-service testing playground where any developer could submit their product and put it through an arsenal of basic, automated evaluations (e. does uninstall leave tidbits behind?), with paid upgrades to more tailored services. They could even publish scores to help consumers coarsely compare workmanship across different vendors, and encourage an emphasis on quality across the whole ecosystem.

Instead they decided to just become overpaid bouncers who take your money, check your ID, and don't even bother about what you bring through the door.

Microsoft and Apple uses their OS store to slowing take away control and ownership from device owners.

A sudden lack of software on windows will increase user migration. If we all keep publishing for windows, users will just stay there because their needs are already met.

I just migrated to MS artifact signing and, thank the lord, had an actually easier time getting verified than I did with the Sectigo and Comodo in the past. I’m sure I’m not representative of anyone else’s experience but having already had a developer account (with a different email and without an Azure account!) that I had already been using for the Microsoft Store might have helped, as well as the fact that I had a well-established business history (I’ve heard businesses younger than 3 years can’t get verified??), but reading all the comments here makes me very uneasy about the future.

It’s good to know the HSM route isn’t a complete non-starter. The main reason I panned it is that when I started looking into this I found that a number of companies that had previously offered the HSM route had done a bait and switch and were now keeping custody unless you were big enterprise (meaning willing to put up with 10k/yr fees). I did find a few that would allow OSS devs to sign their work, but read horror stories on Reddit and elsewhere about their freezing the account and issuing no refunds if you ask them to issue the cert in the name of your LLC or corporation instead of with your personal name (which I expressly did not want). Also, they actually were more expensive than Azure artifact signing even after the HSM cost was taken out.

downloading an exe is "whatever code anyone shits out" cause that's exactly what built binaries are

A lot of the programs you use on Windows are actually the exact same ones on Linux be it VLC or Chrome. If you want to download binaries directly "from the source" and run those.... well that was always allowed. But remember the entire stack delivering the entire internet to you at any time is open source code that "anyone shits out".

distros are catering to server installs most of the time. if you want a gui you install that entire stack but for most classic distros like debian the GUI is not the main thing. if you want a GUI from start to finish go with Fedora or the new KDE distro.

Hold your nose and work on WINE if you need to think that way. But MS has moats, and office is one of the widest.

https://www.tiktok.com/@etong_winter_palikir/video/739554877...

https://www.youtube.com/watch?v=urglg3WimHA

https://www.goodfellow.com/usa/tin-foil-group

No, that's the thing; they ideally would only need to replace the OS. Many long years ago, when I switched from Windows to Ubuntu (this was back when it was good), part of why it was so easy is because I mostly kept the same applications. If you use eg. Firefox, VLC, open/libreoffice, audacity, etc., then you can install a new OS, reinstall the same applications, and barely have to change anything. That's huge.

This is a little like the joke: "Madam, would you sleep with me for 1 million dollars?", to which she replies "I would". "Madam, would you sleep with me for 1 dollar?", to which she replies, "Sir, what sort of woman do you think I am?" To which he replies "We have already established what sort of woman you are, now we are just trying to establish your price!"

By agreeing to this initial Age Verification, companies are establishing that they are willing to implement checks on age for their users, now we will see just how much more they are willing to do - all to protect the children of course.

[1] https://comodosslstore.com/code-signing/comodo-individual-co...

If you, as a parent, make yourself open to this attack, you will find that you are making us less free of a society by expecting others to parent for you.

For a freedom you didn't have to pay for at all? Why accept this absurdity?

If you oppose the law to force liquor stores to deny service to minors, but people are still upset about minors getting alcohol, you have no right to be surprised when the next proposal is to ban alcohol for everyone, and you have no right to be surprised if it passes.

LibreOffice also has bad UI choices and glitches.

It’s not like we’re talking VLC vs OS Media Player here.

You can stomp your feet, but the world uses Exchange and Office and not for no reasons at all.

https://learn-attachment.microsoft.com/api/attachments/f8eac...