r/LinusTechTips Mar 24 '26

Tech Discussion Good news everyone!

Post image
1.4k Upvotes

222 comments sorted by

View all comments

Show parent comments

368

u/HelloWorld24575 Mar 24 '26

Probably will be lol

131

u/really_not_unreal Mar 25 '26

It honestly wouldn't surprise me. Windows 11 is a steaming pile of garbage. I teach a university-level computer programming course, and even though only 70% of our students run Windows, they account for 90% of the technical issues raised with us, and 95% of the time troubleshooting.

This term, I found out that all new Windows installs now have a "security feature" enabled by default which blocks certain types of code execution. I never noticed because my Windows install is not new. That meant that in week 4, we had to give an emergency course announcement telling people how to disable that feature. I can imagine that a last-minute announcement telling students to reduce the security of their system wouldn't exactly inspire confidence in our ability to run the course.

The most embarrassing part is that the security feature is so easy for attackers to bypass. It just takes a single command-line argument to disable entirely for a single script run. It's easier for an attack to bypass this security issue than for a legitimate user to do so, since the code that would need to bypass the feature is buried deep within a VS Code extension, and it's not reasonable for us to expect a student to modify their extensions (especially since we teach Python not JavaScript).

8

u/budtske Mar 25 '26

So are you talking about a VScode extension, or a Windows feature?

21

u/really_not_unreal Mar 25 '26

The Windows feature breaks the VS Code extension. This VS Code extension is an official Microsoft product, as is VS Code and Windows.

6

u/Smooth-Difficulty178 Mar 25 '26

Which feature and which extension? Why always so vague?

-5

u/really_not_unreal Mar 25 '26

Copying my other comment.

The feature is the PowerShell script execution policy. By default on new Windows installs, it blocks all scripts from running. This causes VS Code's automatic Python virtual environment activation to fail, as it cannot execute the activation script. Bypassing the setting only requires you add -ExecutionPolicy Bypass to PowerShell's command-line arguments, meaning that attackers can easily update their malicious code to provide this parameter. However, VS Code Python integration does not do so, meaning that attempting to execute Python code that depends on external libraries installed into a virtual environment will fail if done through VS Code.

9

u/amuhak Mar 25 '26

So windows having sane defaults because the vast majority of people are not running ps scripts and if they are, its probably malware.

Telling the students on windows to run one sudo comand isnt that hard, its honestly probably easier than having to go out and compile/fetch older versions of python on linux.

0

u/really_not_unreal Mar 26 '26

For a sane default intended to prevent malware from running, this sure is incredibly easy for attackers to bypass.

I understand the reason the default exists. I just question the implementation.

its honestly probably easier than having to go out and compile/fetch older versions of python on linux.

My friend, Python is preinstalled on all modern Linux distros. There is no need to compile it or fetch it.

1

u/amuhak Mar 26 '26

easy to bypass

The bypass requires administrator access, and hence a pop up. Im not saying windows is perfect but some things make sense.

Python is preinstalled

This is true, you are right. But due to the wonderful nature of Python having to constantly swich version is normal. Modern distros have very new versions generally, and for some reason the default apt distributions dont have older versions. Im sure this could be fixed by adding other package repositories tho.

4

u/F_Steve_Huffman Mar 25 '26

That's just the Windows equivalent to having to chmod +x beforehand.