Post

You can just `dd` an iso/img file downloaded from microsoft.com onto your USB stick. Trust on HTTPS and checksums, they work.

If anything agents are incredibly useful when I’m fighting with a project with clearly neglected build documentation. They really help connect the dots much faster than I can, I still think it’s important to have that troubleshooting skill but is it a good use of my time?

Isn’t is partially a trade secrets thing? Distributing binaries obfuscates the source enough, even with decompilers, that there’s plenty of friction to prevent copying. Though I suppose LLMs could reduce that friction…

I guess you’d like to hear the new initiative from the Open Source: bootstrapable software. In a nutshell: a build system that pulls everything from source — compilers, tools, etc., everything to compile and build software from bare scratch. Controvertial ideas. Interesting tooling.

(To be clear: the agents are the antivirus I'm referring to)

I use the Inno Installer for Windows. Open source and maintained. jrsoftware.org/isinfo.php

And we can memoize the patched DOM peer-to-peer so we're only spending the compute on novel responses.

the leftpad incident itself was about 10.5 years ago

If I were to treat agent scanning like antivirus, I'd probably spend a fair amount of time scaffolding prescans that are both agentic and nonagentic to try to cut down on the "Say this isn't a virus" concern

i'm of the belief that ecosystems like Node's (and to some extent, Python, etc) are just fundamentally broken and can not be trusted. large dependency graphs are impossible to fully analyse and any malicious actor will always have the upper hand on circumventing any kind of automated check

Honestly it's been a scale/risk thing already for decades. Source/verified code with controlled builds is the only way in a lot of places. I've seen binary attacks live (other places)

The two things are quite different. Mac and Windows store signings/notarization provide some proof of who the binary came from. Attestation provides some proof of where/how it was built. But non-technical users only care about the who, not the where/how.

But they are just files either way

(Also wix builds windows installers on mac and linux) github.com/wixtoolset

RETVRN

Hate that one because you never fucking know but, that sure ain’t where things point right now

the agent-audits-before-you-trust-random-code workflow is the actual fix, the windows installer thing is just the excuse that finally made someone do it

If you have the displeasure of getting windows 11 installed correctly, you quickly learn that YOU CANNOT EVEN MOVE THE TASKBAR OFF THE BOTTOM OF THE MONITOR. IT'S 2026 WHAT ARE WE DOING HERE?

Linux distros generally have several official packages for making install USBs. I don't know if that counts as not random... I'm thinking of just running the installer creator inside a virtualized windows environment, but maybe there are other options. Maybe GoReleaser can package whatever.

Don't worry Microsoft will fix it by requiring you to buy an expensive certificate and store it in an expensive HSM , this works because criminals have neither time nor money , oh wait

My bad, I misread your post. I dont know actually, that wasn't the guidance I found when googling. One dynamic that showed up with the installers is that they all wanted an FAT format and needed to split up one of the files in the iso to get under a size limit.

en.wikipedia.org/wiki/Dd_(Unix)

Yes, there is a reason. I did this recently (for a relative's Win 10 machine) - you can dd the iso to a usb - you can even kind-of boot from it - the installer will fail Kept happening until I found another windows machine and used the MS disk creation tool.

three agents in a trenchcoat

FWIW, I can vouch for this working using only native tools and an image from Rufus.