Extremely promising Windows security hardening tool: HotCakeX

She isn’t “paid by Microsoft”, she is someone promoting improving basic user security without the reliance on third-party software. With that logic, you can say that the developer of secureblue is “paid by Redhat” and shilling them due to his project. It’s nonsensical.

I don’t understand the rhetoric that “X operating system is not safe.” Your OS is only as safe as YOU make it. In my opinion, windows gives more options to its users in that regard. And undeniably, any product from big tech is SAFE but not PRIVATE of course.

1 Like

Her “About me” says she’s “𝙼𝚒𝚌𝚛𝚘𝚜𝚘𝚏𝚝 𝙼𝚅𝙿” and links to a profile which states she’s a “Windows Developer”.

This statement, undeniably, is not true. Doesn’t mean the complete opposite is true, of course.

It’s only as easy as you allow it.

Use full-disk encryption. Don’t open random attachments. Don’t share passwords. Don’t run unsafe proprietary software.

She literally promotes her own third-party software and shills products like Microsoft Authenticator which technically is third-party software on iOS and Android when there are much better TOTP authenticators out there that don’t require cloud syncing. And cloud storage like OneDrive isn’t secure. It’s better to backup data on your own external storage that doesn’t require any network. Sounds like a Microsoft shill to me.

And calling the secureblue developers Red Hat shills is as bullshit as calling PG and Techlore Mullvad shills when Mullvad doesn’t even have an affiliate program.

Wrong. Any product which is proprietary is NEVER safe.

1 Like

I’m unfortunately about to be obliged to use Windows for work for the next couple of years at least. I’ve spent a lot of time researching Windows privacy improvements, probably more than is healthy. I looked at HotCakeX as it’s the main recommendation for advanced tweaks in Techlore’s most recent Windows Privacy & Security Guide. While it is undeniably focused on secuirity rather than privacy, I’ve still learnt a few useful things reading through the website.

1 Like

I think what @anonymous378 is getting at is you need to consider the target audience. These are users who “care” about privacy and security but only if its in a convenient one click format. It is highly unlikely they have gone through and enabled FDE or researched privacy / security outside of skimming recommendations on PG (maybe) and Reddit. I guarantee the vast majority who use the recommended settings do not read what those settings do beforehand and have no clue what the tradeoffs between a local and domain account are.

I think for users here, the tool is much more of a convenient dashboard to customize Windows settings how you see fit, regardless of the devs recommendations.

Well then if they get hacked because they didn’t bother to do the basics and opened random crap then it’s their own fault they got hacked. They shouldn’t force us to do things their way thinking we don’t know any better.

And there are other tools to customize Windows with an actual focus on privacy and de-bloating Windows.

I am not sure anyone is being forced to do anything in this situation…

The market is full on one-click solutions. To me, what stands out, is this at least provides a one stop shop to change a lot of Windows settings without going through the Windows UX. I find that nice. To each their own :smiley:

Microsoft forcing everyone to use Windows with an online account for “security”

2 Likes

ahh I didn’t quite understand what you were getting at.

yeah this is super annoying.

Not how it works

2 Likes

This is something anyone can become if they contribute software/writeups and are nominated by a Microsoft employee. It is not a paid or volunteer position at Microsoft.

Does this mean Windows Developers aren’t paid by Microsoft too? Like if I just write any program that runs on Windows I can write that I’m a Windows Developer in my Bio?

Anyway, my answer was to

so even if she volunteers for Microsoft, doesn’t change much. She develops Windows hardening tool, would be strange to expect her praising Linux security.

lol what?

MVP is an award for professionals who contribute to the Microsoft community that you need to be nominated for as @AstraKitten alluded too.

Microsoft MVP Award recognizes exceptional community leadership.

Key benefits to MVPs include early access to Microsoft products and direct communication channels with our product teams. MVPs have a very close relationship with the local Microsoft teams in their area, who are there to support and empower MVPs to address needs and opportunities in the local ecosystem. Other benefits include an executive recognition letter, a Visual Studio technical subscription, and a Microsoft 365 subscription.

I think “Windows Developer” in this context just means they develop software for the Windows OS. Not that they work for Microsoft as a developer.

MVP Profile

1 Like

Exactly.

This is why I wouldn’t take advice from any Windows developer/MVP. They are obviously biased towards Microsoft and against open, privacy-respecting software. Regardless, her guide only focuses on security at the cost of privacy.

Beerisgood’s Windows hardening repo isn’t much better.

avoid insecure software like 7-Zip (which lacks Anti-Exploit and MOTW support) and also Forks, Open/ LibreOffice, Firefox, True/Veracrypt, …

Doesn’t explain why LibreOffice is insecure and fails to mention any insecure proprietary software. Is he suggesting all open source software is bad?

While DNS encryption isn’t perfect both Quad9 and Cloudflare are recommend.

Cloudflare recommend my ass.

Use the only browser which provide defense in depth: Edge

Enjoy your mandatory Microsoft telemetry.

instead of passwords, use Passkeys

Use a Microsoft account.
Use Windows Mail app as your mail client.
Use free versions of MS Office applications (Word, Excel, PowerPoint) already available in Windows.
Do not be paranoid about Microsoft telemetry.
Changing your web browser from Edge to Chrome requires installing third-party software or extensions to achieve the same level of security.

:face_vomiting:

Does the Windows mail app even support PGP? Because if it doesn’t, nothing else matters.

I wont disagree with you that they are “bias” towards Windows. They make it blatantly clear they have a passion for Windows. I also wont disagree that their views of privacy are quite a bit different than mine or most on the forum.

It is clearly false that they are against open source, or even privacy enhancing software. It just so happens they have very different belief in what privacy / anonymity should be.

Regardless this persons personal views really don’t affect the tool itself, outside of their presets which you are not forced to use.

Privacy advertisements, advocates, tools, programs are all fundamentally flawed. All they can do at best is to change which entity or company has access to your data. They can’t prevent the data from being collected in the first place.

Even the offline/local or self-hosted programs?

Tor network is an inherently defective privacy instrument.

The majority of open source programs are unsigned, meaning they don’t have a digital signature, their developers haven’t bought and used a code signing certificate to sign their program. Use Azure Trusted Signing which is affordable.

So open source programs are bad because Microsoft doesn’t approve of them?

Sounds to me like they are against open source and privacy enhancing software. The last thing we need is more Microsoft/Google/Apple propaganda.

You are sniping bits out of context to feed your POV.

we discuss privacy, which is the right to control what information is collected and shared about oneself. Privacy is important for maintaining personal autonomy, dignity and security.

As I said they have a different perspective but, it seems silly for you to caim they are against open source when most, if not all, of their work is literally open source apps for Windows.

It seems obvious, if you look at this person in good faith, they care about privacy and open source. You just happen to disagree with how.

1 Like

Is it that hard to read the whole sentence?

Thank you for clarifying for the second time the thing I already knew, but I just said that “𝙼𝚒𝚌𝚛𝚘𝚜𝚘𝚏𝚝 𝙼𝚅𝙿” leads to a profile which states she’s a “Windows Developer”.

Thank you for your opinion, it is very important to know that you think so.
How do you think, if I regularly update my Ubuntu, can I write in my Bio that I’m a Linux maintainer?

To my knowledge, developers usually write about their technology stack, something like “Python/Ruby/whatever developer” or their projects, like “Whonix/GrapheneOS/Windows hardening tool/whatever developer”.

I might be wrong. Doesn’t change anything really.

1 Like

yeah, when its utter nonsense.

True, you just look silly…

Under the permissive MIT license. Does she enjoy writing Microsoft’s proprietary code?