[HN Gopher] The Mutable OS: Why Isn't Windows Immutable in 2025?
___________________________________________________________________
The Mutable OS: Why Isn't Windows Immutable in 2025?
Author : ndegruchy
Score : 14 points
Date : 2025-04-09 15:26 UTC (7 hours ago)
(HTM) web link (degruchy.org)
(TXT) w3m dump (degruchy.org)
| ndegruchy wrote:
| Hey all--this is something I've been thinking about for a while
| in my day-to-day as a desktop support tech. We've made huge
| strides in OS security, but immutability is still seen as exotic,
| and I don't think it should be. Curious to hear thoughts or
| counterpoints from folks who've wrestled with these same issues.
| westurner wrote:
| I'm working with rpm-ostree distros on workstations. The
| Universal Blue (Fedora Atomic (CoreOS)) project has OCI images
| that install as immutable host images.
|
| We were able to install programs as admin on Windows in our
| university computer lab because of DeepFreeze, almost 20 years
| ago
|
| "Is DeepFreeze worth it?"
| https://www.reddit.com/r/sysadmin/comments/18zn3jn/is_deepfr...
|
| TIL Windows has UWF built-in:
|
| "Unified Write Filter (UWF) feature"
| https://learn.microsoft.com/en-us/windows/configuration/unif...
|
| Re: ~immutable NixOS and SELinux and Flatpaks' chroot
| filesystems not having SELinux labels like WSL2 either:
| https://news.ycombinator.com/item?id=43617363
| westurner wrote:
| Universal Blue immutable OCI images;
|
| ublue-os/main: https://github.com/ublue-os/main :
|
| > _OCI base images of Fedora with batteries included_
|
| ublue-os/image-template: https://github.com/ublue-os/image-
| template :
|
| > _Build your own custom Universal Blue Image!_
|
| Microsoft took Torvalds, who also devs on Fedora FWIU.
| ndegruchy wrote:
| Huh, I had no idea that UFW was a feature of Windows and I'm
| kind of surprised to not see more widespread adoption for
| workstation rollouts. DeepFreeze was great (excepting updates
| and other minor issues) and actively reduced a lot of
| nuisance issues that we might otherwise have to deal with
| when I worked for a school.
| westurner wrote:
| > _On September 20, 2024, Microsoft announced that Windows
| Server Update Service would no longer be developed starting
| with Windows Server 2025.[4] Microsoft encourages business
| to adopt cloud-based solution for client and server
| updates, such as Windows Autopatch, Microsoft Intune, and
| Azure Update Manager. [5]_
|
| WSUS Offline installer is also deprecated now.
|
| And then to keep userspace updated too, a package manager
| like Chocolatey NuGet and this power shell script: https://
| github.com/westurner/dotfiles/blob/develop/scripts/s...
| EvanAnderson wrote:
| UFW has a nicer admin automation "story" than Deep Freeze
| (for which I have a decent amount of experience), in my
| opinion. "Unfreezing" UFW volumes for updates (known as
| "Servicing Mode") via script isn't hateful.
| EvanAnderson wrote:
| Unfortunately Unified Write Filter is SKU-limited. It has
| been a feature of the produce since the Windows NT Embedded
| 4.0 days but nobody knows about it and, if you do, you can't
| use it because you don't have an eligible SKU.
| westurner wrote:
| Immutable:
|
| Idempotent:
|
| Ansible is designed for idempotent tasks; that do not further
| change state if re-run.
|
| Windows Containers are relatively immutable. Docker Desktop and
| Podman Desktop include a copy of k8s kubernetes and also
| kubectl IIRC
|
| Do GUI apps run in Windows containers?
| ndegruchy wrote:
| The MSIX apps can opt to run in a sandbox. It's not perfect,
| but it's _something_. Plus MSIX helps ensure clean
| install/uninstall as well as delta updates.
|
| Again, not perfect, but serviceable.
| theamk wrote:
| if you are willing to break backwards compatibility, why even
| bother with Windows anymore?
|
| As you correctly say, Windows is all about backwards
| compatibility. It would be unreasonable to expect any
| innovations from it, expect innovations in putting ads in more
| and more places.
| bsder wrote:
| > immutability is still seen as exotic, and I don't think it
| should be.
|
| Two big problems:
|
| 1) Because Linux filesystems still suck. You need efficient
| copy-on-write overlays (and the ability to handle lots of
| them!) with some level of deduplication to make immutable
| operating systems not suck.
|
| 2) Because the Linux linker sucks. Take a look at the reasons
| why Nix has to patch binaries and prepare to feel sick in your
| stomach.
|
| The "UNIX Architecture" is increasingly creaky for the things
| we want to do on modern machines (see: io_uring because the old
| select/poll stuff doesn't cut it, for example). We're going to
| have to sweep a bunch of that underbrush away.
| mystified5016 wrote:
| Probably because third party vendors want to push malvertising to
| un-consenting users through windows update. Windows will just
| install shit for no reason, like the "Dell delivery service" I've
| uninstalled six times, or any printer driver
| ndegruchy wrote:
| Well, putting the idea of malvertising aside, I don't think
| this would even prevent it. An app 'layer' would be separate
| from the OS. Though they wouldn't be able to taint the OS, so
| that's a plus.
|
| I don't agree with the idea of installing extra apps,
| especially to paying customers, but that's a separate
| discussion.
| fsflover wrote:
| If you care about security, consider Qubes OS, https://qubes-
| os.org, which achieves security through compartmentalization
| based on strong, hardware isolation. My daily driver, can't
| recommend enough.
| ndegruchy wrote:
| I am actually interested in Qubes, it seems to take security
| very seriously. Probably too seriously for my own daily driver
| needs :D
| fsflover wrote:
| Unless your workflows heavily rely on GPU acceleration (and
| you can't make a GPU passthrough), Qubes is much easier to
| use than people think. It runs Debian and/or Fedora in VMs,
| so all software works fine.
| emchammer wrote:
| An operating system should be self-hosting. You should be able to
| compile it and reinstall it on the same machine. Obviously,
| Windows and macOS are closed-source, but I would if I could.
___________________________________________________________________
(page generated 2025-04-09 23:02 UTC)