Hacker News Reader

Comment by MikeUt | Hacker News Reader

It's the official Microsoft stance that torrent software is considered PUA (potentially unwanted application) on Enterprise. Perhaps they're expanding that to consumer versions? They define PUA very vaguely, with rather disturbing language. Phrases like "safeguard productivity" and "help deliver delightful Windows experiences" are not what I would expect in security software documentation:

Our PUA protection aims to safeguard user productivity and ensure enjoyable Windows experiences. This protection helps deliver more productive, performant, and delightful Windows experiences.

Microsoft uses specific categories and the category definitions to classify software as a PUA.

Torrent software (Enterprise only)

https://docs.microsoft.com/en-us/windows/security/threat-pro...

View on HN

Interestingly, that document states that "PUAs are not considered malware."

PUA detection and removal also seems to be a separate toggle from general malware protection, so running

  Set-MpPreference -PUAProtection Disabled

From an admin powershell session should prevent this behavior. It sounds like a bug/unintentional if it's being flagged on non-enterprise SKUs of Windows, though.

It does seem that torrent software is very likely unwanted by the customer on enterprise, where the customer is the business.

Hmm, many Linux distro are distributed via Torrent. As well as many video platform also use webtorrent. It is a just protocol like http. And when one is downloading a really large file, torrent can arguably be much better than direct download.

Sure, I use BitTorrent for Linux isos at work in a highly controlled environment, but for every one of me there would be hundreds pirating software at work, and tens accidentally killing their businesses bandwidth/quota by seeding too much.

Enterprise also expects certain kind of user awareness, or if not then certain amount of admin-set restrictions on the machine. Not these kind of big daddy policing decisions.

Is defender a ‘big daddy policing decision’?

You’re welcome to disable it via group policy if you like.

Defender working this way by default is a ‘big daddy policing decision’. The default should be to not do this, and people that want it should have to enable it via Group Policy.

Are you saying that insecure by default is a good idea?

Defender enabled by default would save billions annually, and not just from businesses but also grandma who’s entire photo collection just got ransomware’d.

That big daddy policing move was the single best action taken by Microsoft.

I'm not saying that Defender should be disabled by default. I'm saying that it shouldn't flag BitTorrent clients by default.

For sure, then set the seeding and upload rate limit. In general torrent is still the more reliable (decentralised) ways to share large files.

That might be true, but let's be real here: torrents are overwhelmingly used to pirate software/videos/music. The categorization is "potentially unwanted", not " definitely unwanted", so I think the classification is justified. Also, despite "linux iso torrents" being a meme in many circles I have rarely actually used that to download isos. The default option of http is almost always fast enough and the increased hassle of booting up my torrent client isn't worth it.

Yes but in practice people often use BitTorrent on their work computer to download music, movies and malware.

Hence the P for potentially.

PUA definitions are probably different enough to warrant segregation. Games on an enterprise system are probably equally PUA

I suppose that in enterprise environment Defender acts as a simple agent reporting to a control center that can be set with a lot more granular rules on whether something is wanted on a specific workplace.

I'm gonna go out on a limb and say that most of the people with these issues are using pirated Enterprise versions of Windows, not trying to install a BitTorrent client on their work computers. It's definitely not impacting Home or Pro versions.

Reply on news.ycombinator.com