關閉與開啟 Windows 10 內一堆侵犯與增強隱私的設定

DuckDuckGo 前陣子整理了一篇關於如何調整 Windows 10 的文章,洋洋灑灑列了十五條方式供使用者調整:「How To Protect Privacy On Windows 10」。

像是可以將無線網路的 MAC address 隨機化的方式就頗不錯:

然後有一堆要把資料送回 Microsoft 的...

微軟的 Time Service 回應錯誤的時間...

看起來會有不少災情 (像是 SQL Server 遇到使用 server side 的時間的 SQL query):「Windows Time Service is sending out wrong times and that’s a big problem」,報導裡引用了 Reddit 上「PSA: time.windows.com NTP server seems to be sending out wrong time」這邊的討論串。

為了避免這種情況,不同單位會用不同方法解決。像是財力充足的 Google 就自己搞了原子鐘,然後還放 Google Public NTP 出來給大家用。可以不倚靠外部裝置確保自家時間的正確性。

另外是有人用 Raspberry Pi 收 GPS 訊號轉成 NTP service (像是「The Raspberry Pi as a Stratum-1 NTP Server」這邊介紹的方式),不過之前有發生過 GPS 送出來的時間差了 13ms 的事情,也不是完全可靠 (不過相較起來應該還是可以接受):「GPS error caused '12 hours of problems' for companies」。另外可能的方案有 GLONASS (俄羅斯的系統)。

也許之後有機會會需要自己架...

修改 User-Agent 讓 Office 365 服務變快...

Facebook 上看到剛剛在 Hacker News 上熱起來的「Onedrive is slow on Linux but fast with a “Windows” user-agent (2016)」這篇,引用了 2016 年在 Microsoft Community 上的討論:「Onedrive for Business open is very slow on Linux (Chrome/Firefox) but with very fast with a "Windows" user-agent」。

Reddit 的「Office 365 Onedrive looks at user-agent to determine performance.」有更多的討論。

因為工作上也會用到 Office 365,也覺得在 Ubuntu 上用起來超級慢,然後看到有使用者也講了 Linux 下的 Google Chrome 也會有類似的問題:

I just tried this same thing--changing the OS in the user agent--on Chome on Linux. The difference really is incredible. Normally I find 365 to be so slow as to be borderline unusable, now it's almost as quick as Google docs. Even the institutional log-ins for my university are faster.

EDIT: Just to clarify, I was testing specifically the web apps for Word and OneNote hosted by my uni. I tried loading them both in normal tabs and ones where I had changed the OS useragent in Chrome's developer panel. The normal tabs hung badly as usual (30+ seconds to load the UI), while the modified tabs loaded very quickly. I tried this several times, but I suppose YMMV.

所以我也拿「User-Agent Switcher for Chrome」加上 IE11 的 user-agent 後測試:

最明顯的差異就是 redirect 變少了,然後開 Word 與 Excel 的速度變快好多 @_@

在原討論串上的官方回應是:

As Office 365 for Business services(e.g. SharePoint Online, including OneDrive for Business, Exchange Online) are not supported on Linux as shown below, for the best experience, we recommend the operating system listed in the article.

所以只能拿老招出來,把 User-Agent 改成 IE 後就變得超~級~快~

然後最 helpful 的回答是:

Thank you
I go back to Google Apps suite.
DL

棍 XDDD

用 SessionGopher 拉出機器上各種密碼與 Key

同事在 Slack 上提到 fireeye/SessionGopher 這個工具,可以從機器上拉出各種敏感資訊:

SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.

方法是掃 registry 或是硬碟:

SessionGopher works by querying the HKEY_USERS hive for all users who have logged onto a domain-joined box at some point. It extracts PuTTY, WinSCP, SuperPuTTY, FileZilla, and RDP saved session information. It automatically extracts and decrypts WinSCP, FileZilla, and SuperPuTTY saved passwords. When run in Thorough mode, it also searches all drives for PuTTY private key files (.ppk) and extracts all relevant private key information, including the key itself, as well as for Remote Desktop (.rdp) and RSA (.sdtid) files.

是個... 好玩... 的... 東西...

將 Windows 10 侵犯隱私的程式都關光

alirobe/reclaimWindows10.ps1 這個 gist 提供了 script 將 Windows 10 侵犯隱私的程式都關閉:

"Reclaim Windows 10" turns off a bunch of unnecessary Windows 10 telemetery, removes bloatware, and privacy invasions. Review and tweak before running. Scripts for reversing are included and commented. Fork via https://github.com/Disassembler0 (different defaults)

翻了一次發現東西好多啊... 把 user 當作商品的感覺 @_@

微軟預定在 2017 年的西洋情人節淘汰 SHA-1 certificate

經過多次改動後,微軟這次宣佈 SHA-1 certificate 將在明年淘汰:「SHA-1 deprecation countdown」。

影響的範圍包括 Internet Explorer 11Microsoft Edge,在 2017 年 2 月 14 日之後不信任 SHA-1 certificate:

Starting on February 14th, 2017, Microsoft Edge and Internet Explorer 11 will prevent sites that are protected with a SHA-1 certificate from loading and will display an invalid certificate warning.

與其他家類似,還是提供了管道讓企業內部建立的 SHA-1 certificate 可以用:

This will only impact SHA-1 certificates that chain to a Microsoft Trusted Root CA. Manually-installed enterprise or self-signed SHA-1 certificates will not be impacted, although we recommend for all customers to quickly migrate to SHA-256.

Lenovo 開始出 Microsoft-only 機了,其他的 OS 都會被鎖住不能用

有人在 Reddit 上抱怨買了一台 Lenovo 的機器卻不能裝 Linux,因為會抓不到硬碟:「Warning: Microsoft Signature PC program now requires that you can't run Linux. Lenovo's recent Ultrabooks among affected systems.」,官方回覆是:

This system has a Signature Edition of Windows 10 Home installed. It is locked per our agreement with Microsoft.

取自這邊:

喔耶...

OpenType Font Variations

AdobeAppleGoogle,以及 Microsoft 聯手推出新的 OpenType 規格,讓字型變得更小:(沒有找到 Apple 的新聞稿...)

Google 給了兩個範例:

Adobe 也給了範例:

藉由額外的定義來描述字的各種變化,而不是直接設計多個字型塞進檔案裡。這樣可以減少字型的大小。

Firefox 49 將可以吃系統的 Certificate Trust Store

在「Upcoming Changes to Root Certificates in Firefox on Windows」這邊看到 Firefox 49 將會有選項可以讓 Firefox 多吃系統的 Certificate Trust Store:

This feature is available in Firefox 49 and up (currently in beta). To give it a try, set the preference security.enterprise_roots.enabled to true. After that, Firefox should connect successfully to sites using certificates issued by 3rd party root certificates that have been added to the Windows trust database.

這對企業來說會比較方便管理。

These features are still in the early stages, so if you encounter any unexpected behavior, please feel free to file a bug.

然後正在測試階段,有問題的可以去戳...

微軟也推出圖片辨識的 API 了

微軟也推出類似於 Google CloudVision API 的服務了:「Microsoft Cognitive Services - Computer Vision API」。

微軟這次推出了三個功能,Analyze an image (類似於 Google Cloud 這邊的 Label Detection)、Generate a thumbnail (Google Cloud 沒有對應的功能) 與 OCR (對應到 Google Cloud 的 OCR)。

微軟的每千次都是 USD$1.5,而 Google 的 Label Detection 則貴多了 (最開始是 USD$5,到最大的量是 USD$2),不知道兩邊辨識的品質如何...

而 OCR 的部份 Google 開始是 $2.5,到最大的量是 $0.6,兩邊的定價策略也蠻有趣的。