Any sufficiently advanced uninstaller is indistinguishable from malware (devblogs.microsoft.com)

Article summary

The article discusses a crash in Windows Explorer caused by a sufficiently advanced uninstaller that was indistinguishable from malware. The uninstaller was trying to delete a file, but due to a detour, it ended up calling into an unknown location, causing the crash. The author suggests that instead of using code injection, a self-deleting binary can be created using a simple script. The article highlights the importance of proper uninstaller design and the potential consequences of abusing the system.

Main themes

• Windows internals
• uninstaller design
• code injection
• self-deleting executables
• JavaScript vs other languages
• security trade-offs
• PowerShell vs WSH
• system abuse and stability

What commenters say

• Some commenters appreciate the article as a deep dive into Windows internals and a showcase of the author's expertise.
• Others discuss alternative ways to create self-deleting executables, including using DLLs and rundll.exe.
• The use of JavaScript for uninstallers is questioned, with some arguing that it is not a suitable choice for this purpose.
• The article's suggestion to use a WSH solution is seen as outdated, with some commenters pointing out that PowerShell is now the official scripting language for Windows.
• There is a discussion about the security implications of using unsigned scripts and the trade-offs between security and convenience.
• Some commenters share their own experiences with creating self-deleting executables and the challenges they faced.
• The article's title is seen as provocative, but ultimately, the content is appreciated for its technical insight and value.