Hacker News Reader

Comment by nicklecompte | Hacker News Reader

ETA: I jumped to conclusions a bit - I thought the Bob Pony ISO distributions were shadier than they were and misread part of the installation details. See the discussion below about the challenges with hosting these older Windows ISOs.

From the README:

> Is this project legal?

> Yes, this project contains only open-source code and does not distribute any copyrighted material. Neither does it try to circumvent any copyright protection measures. So under all applicable laws, this project would be considered legal.

From install.sh:

  if [[ "${VERSION,,}" == "win7x64" ]]; then
    DETECTED="win7x64"
 
  VERSION="https://dl.bobpony.com/windows/7/
  en_windows_7_enterprise_with_sp1_x64_dvd_u_677651.iso"
  fi

Along with other similarly shady links.

Look, IANAL, nor am I hooting and hollering for Microsoft's profits. But that README seems dishonest, any competent user should be suspicious of a "bobpony"-distributed Windows ISO.

View on HN

Theres no easy solution there, directly linking windows ISOs is a direct violation of the TOS on the website, but there is permission to host the ISOs for your own reasons.

Agree that this should be in the documentation, but you can get into legal trouble if you directly link against microsoft.com in distributed code or binaries.

You can also get in legal trouble if you download and install a flagrantly pirated Windows ISO :)

AFAICT this software would solve all its legal problems[1] if it replaced these hard links to clearly unlawful websites with user variables, $URI_TO_WIN10ISO or something. The fact that the README is basically lying to its users makes things even worse. I would go so far as to call this malware.

[1] In the sense of "successfully foisting legal difficulties onto end users"

Rehosting the same ISO is permitted though.

Unless what you're saying is that this is a modified ISO to remove activation.

if thats the case then, I agree wholeheartedly. Just explaining why you dont/cant use the standard microsoft.com links.

Ah - I misread your comment earlier, and I also didn't see that the other ISOs were hosted by Microsoft. In fact I misread most of this project because I was pre-emptively suspicious :) I guess the real problem is these older installations are in a bit of a grey area so I can see the value Bob Pony is actually providing here.

I'm pretty sure these ISOs are NOT modified though I am a bit skeptical of some of these sources. Editing my first comment to clarify that I misread this...

And the bigger question:

Why the hell are we trying shitty workarounds to dockerizing Windows? It's all dumb legal crap we have to work around... All the while, there's this Linux thing that just works.

And you usually don't actually need Windows. It's an application ON windows you need. So, try Linux/wine docker and dockerize it in WINE.

> but there is permission to host the ISOs for your own reasons

I'm not searching for the exact wording, but hosting for an unlimited and unrestricted access is a distribution in a legal sense and is not allowed

I think you are right, but I never made that particular point.

Nothing the client is doing is unlawful afaict; I would prefer it if it was documented and easy to swap out the URL.

FWIW I had this exact issue when using vagrant/packer and it was always painful because we couldn’t target windows ISOs easily but equally we didnt want to self-host them on a public repo because of the dubious legality and negative speculation as we’re discussing here.

Those bobpony ISOs could be backdoored even if they’re not breaking laws for the client user. Would be good to walk through the legal way to generate the download link.

> but I never made that particular point.

Nor I insisted or implied anything. Just something from my memory through the years of similar problems of the dubious legality of tools to ease the day to day tasks for people.

> Would be good to walk through the legal way to generate the download link.

There is a proper way, just like you said: an easy way to inject http/s URI. Hosting a bunch of ISOs is a solved problem, objectively even easier than hosting a Docker registry.

Ah, I just assumed you were agreeing with the parent given the context.

Glad we agree. :)

It's extremely easy to swap out the URL of the ISO, you can put just any URL you want in the VERSION variable. This is also documented in the FAQ under "How do I install a custom image?".

If you dont provide an URL they are automaticly downloaded from the Microsoft servers using this script: https://github.com/ElliotKillick/Mido It generates a completely legal download link automaticly.

And those bobpony ISOs for versions that the above Mido script does not support are all unmodified retail versions. I checked their SHA256 checksums, and I would invite anyone with doubts to do the same.

It downloads all the ISOs from the official Microsoft servers for every recent version. For older versions like Win7/Vista/XP it is impossible to download them from Microsoft, because they are not available anymore on their servers.

So for those I had to use an alternative mirror (BobPony), but I checked all the SHA256 checksums to make sure they are unmodified retail versions. If someone does not trust it, they can check the checksums of the downloaded ISO themselves or just dont use this container for anything below Windows 8.1.

It is way worse. Search for `local_key` in the source.

I found what you are referring to on line 76 of the assets/win7x64.xml answer file (under the “Key” directive).

So I googled the key to see if it was a widely circulated known cracked key I found.

It turned up on this site: https://www.windowsafg.com/keys.html which implies (strongly) that its a placeholder key that doesn't activate windows, they’re used for installation only.

Oh, that's the generic install key used for volume activation later. Same thing that happens when you click "Skip product key" in Windows setup.

Reply on news.ycombinator.com