Hacker News new | past | comments | ask | show | jobs | submit login
Rufus: Microsoft is blocking Windows ISO downloads (ghacks.net)
206 points by vanburen on Aug 13, 2022 | hide | past | favorite | 101 comments



In case you want to download genuine Windows ISOs you can use https://tb.rg-adguard.net. It's a simple website that uses some sort of MS API to generate download links (directly from Microsoft servers). AFAIK MS does not publish checksums of their ISOs anymore, which means you have to rely on trusted sources to compare hashes, but at least it is a download directly from MS servers instread of some random torrent.


Did a quick test and downloaded a random ISO, can confirm that it pulled from

  https://software.download.prss.microsoft.com/dbazure/[...]


I can download Windows 11 iso from here:https://www.microsoft.com/software-download/windows11

even has a checksum.


I think most people who are looking for windows ISOs are doing so to avoid win11.




Yeah I wouldn’t trust that site. Rather, use UUPDump. It is open source, and uses the Windows update process where you can generate the ISOs yourself on your machine.


Why should I trust this site over the other one? Open source isn’t some magic bullet that means everything is okay.


It creates links to download directly from Microsoft. I've never had an issue relying on the ISO hashes from msdn.rg-adguard.net either. I just wish Microsoft didn't hide their updated monthly ISO's behind a MSDN subscription.


I have a MSDN subscription and one of my colleges wanted a Japanese Windows 10 ISO to track down a particular bug.

While I had to login to get the link to the ISO, once I had that link there doesn't seem to be any requirements to log in again. All the installs are in trial mode unless you get a key, which does require MSDN, but it would be nice if MS just had a convenient place to find these other than people using some 3rd party service. At least it would give people confidence that it's a genuine download and not been tampered with at all.


The Windows installers are not activated. You need either an OEM key in your firmware, a retail key or a volume activation server.



I wouldn't recommend using random public activation servers and hundreds if not thousands of lines of batch scripts. slmgr.vbs and ospp.vbs are your friend.


Why you wouldn't trust that site?


Especially when the final URL ends in a microsoft.com domain


Hopefully Microsoft does not accept user submitted content


If someone can spoof an ISO url, they can also spoof the page/file that contains the ISO hash.


Go to the official windows download page without a windows useragent and you get the iso instead of the crappy download tool.


> without a windows useragent

And amusingly this isn't an easy task in Firefox.


Iirc there are add-ons for it, I'd calllp that easy. Also there's the about:config way but I guess this may be considered difficult.


Opera back in and before the Presto days just had a switcher in the menu. (As well as a “cached images only” toggle, which was why I used it in the first place, but I digress.)


> Also there's the about:config way

This is only for responsive design mode in which FF mimics iPhone (Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/12.0 Mobile/15A372 Safari/604.1)

There is no straight way to just change the useragent like I could do with IE10 *grin*


> AFAIK MS does not publish checksums of their ISOs anymore

I don't know where you got that information, but if i go to the Windows 11 download page[0] right below the download button there's a "Verify your download" section with all checksums for all ISOs in all languages

[0]: https://www.microsoft.com/en-ca/software-download/windows11


> AFAIK MS does not publish checksums of their ISOs anymore

Why no more? I'm sure they could script it as part of their build process. Even PowerShell is bound to have an inbuilt get-md5 or get-sha function.


There is no technical reason. Previously, everyone could browse the MSDN (or whatever it’s called these days) catalog and view the checksums listed there. Only downloading required a subscription. This has changed. Now, browsing the catalog also requires a subscription.


Till Microsoft decides to block their servers.


That's what I thought ... 8 years ago when I started using this website.


The more attention it gets, the more likely it is to happen, of course, this site is not yet quite as popular as Rufus is. I'm guessing somebody noticed hikes due to Rufus in their logs.


This site looks like some sketchy Russian website with patched (pirated) Windows ISOs. While it may use MS API to generate download links, it still looks like some warez storage. I would never install any Windows versions downloaded from it.


Not sure if I'm missing the irony here.


No irony here. Just first impression.

Rambler TOP 100? MyNickName.com? WTF is that?

I would never trust an admin who puts such shit on his website.


Rambler was a Russian-language search engine (as well as portal and directory) back when Yandex hadn’t yet steamrollered everybody else and Google, being incapable of understanding nouns can have more than a couple of forms, was a non-starter. They were irrelevant by 2010 and gave up on mantaining their own index even earlier, I think.

Rambler TOP 100, then, is a website popularity rating from back when voluntarily placing such things on your pages using was cool and you showed them off using these buttons. I don’t think I’ve ever seen it on an English-language page (that wasn’t an obvious translation) before. Apparently it still survives in some form, though I’ve no idea who is in charge of it now.

That is to say, I have no idea why anyone would include that on their pages in this day and age, yet it is hardly nefarious. (Not that you’re supposed to know that, but if you publicly claim it is people will naturally expect you to have done some research beforehand.)


Seems the problem has already been fixed by changing some HTTP headers: https://github.com/pbatard/Fido/pull/42


Yeah, this is just people overreacting to a minor defect as if it's some kind of wide-reaching ethical choice


Look inside the commit's comment.

It's hard to believe that the request is accidentally rejected if your referrer is not Microsoft's download page.


Hotlink prevention is not a new practice


Indeed. I immediately assumed this was the root cause, but seeing the "fix" makes me wonder how ethical this change is.


"I would like to wonder about the ethics of Microsoft not giving me something for free that I've come to expect."

Oh.


To be fair, Rufus is circumventing Microsoft's download methods. It would be nice if they were more open but it's not like these aren't available from official sources:

https://www.microsoft.com/en-us/software-download/windows10I...

https://www.microsoft.com/software-download/windows11


The Media Creation Tool for Windows 10 (don't know about 11 at this point) is so annoying. Not only does it need admin rights, but the whole desktop session needs to be from a user in the Administrator group. So you can't just right click "Run as Administrator". Downloading and potentially burning a ISO shouldn't require admin rights at all.

It got actively programmed to be shitty. This is not an accident.


Especially if your OS is compromised or in a FUBAR state and you really need a simple ISO.


ISO downloaded fine on my phone.


We live in the future


I'm pretty sure interacting with storage directly (not through the filesystem) should require admin rights.


You can burn ISOs with Windows (no Third-party tools required (since Win7 or 10)) without admin rights. Just right click and select burn.


I suspect the admin rights are to loopmount wim files...

I don't think a non-admin can loopmount anything in Windows.


Which it doesn't need to do when you tell it to make an iso.


I guess it just shared some code path with Windows update (as it is exactly the same server) and thus ended require permission it didn't need to use.


I wouldn't have a problem if the tool needed admin rights. But that the whole session needs to be from an admin grinds my gears.


They are not entirely available. I think you cannot download all editions, only the latest releases, and if you use Windows it will tell you to use the media creation tool. Which is a weird thing that takes a long time and assembles an ISO from who knows what (it seems to take parts from your PC and to download other parts). It's really hard to get a vanilla ISO.


if you spoof your user agent to not show windows it'll let you download an ISO directly from MS instead of just MCT


It isn't the latest release from my experience. Microsoft releases new ISO's on MSDN every month. The one that is publicly available is usually the first major build, which can be months to even years behind.


You can download ISOs on Windows now, I just did a week ago to install a VM.

> Which is a weird thing that takes a long time and assembles an ISO from who knows what (it seems to take parts from your PC and to download other parts).

It doesn’t use your PC’s files, it does recompress the install image into 2 parts in a different Windows disk image format to fit on FAT32 (4GB file limitation), so that you could use the ISO on a USB flash drive without needing a secondary bootloader.


I assumed the media creation tool was breaking apart the ISO image & splitting any files too large to fit onto a FAT32 filesystem: https://robots.org.uk/CreatingWindows10InstallerUSBFromLinux


I agree. As long as Microsoft provides an easy way to download ISOs, it's their prerogative to deny third-party tools access.


This will just push people to get their ISOs from other, less reputable, sources. Truth is only a minority verifies the hashs of their ISO. What Rufus should do is compile a list of known hashes for every untouched Windows release and then warn the user if they attempt to flash a tainted ISO.


Will it push them to other, less reputable sources?

If a user was able to discover and find Rufus, they should be capable of discovering and finding the legitimate download on the Microsoft website too.

The article and my quick test say it is still possible.


As far as I can remember, the ISO downloads on the official Microsoft site are hidden behind a login screen.

Because of that, for the last several years my source of ISOs has been random websites I found by googling or by torrent sites. I’m sure I’m not the only one.


You can check for yourself.

https://www.microsoft.com/en-ca/software-download/windows11

There is a section titled Download Windows 11 Disk Image (ISO)

> This download is a multi-edition ISO which uses your product key to unlock the correct edition

It is annoying that it is a generated link only valid for 24 hours, but no login is required.

Quick edit: Maybe they tested requiring logins at one time? Could this change based on user agent or something else? Would they do something that ridiculous? Firefox on Debian on my end.


This must be relatively new. There was a period of at least several years prior to Windows 11 where I don’t believe it was possible to download without logging into the website.


I've downloaded virtually every release ISO of Windows 10 going back to the first one.

I don't think I have ever been logged in, mainly because I end up using a different browser with a fake macOS user agent to make it give me the ISO instead of trying to get me to download their exe.


I've been downloading ISOs directly from Microsoft without login for several years.


As noted above, from my experience these releases are often months and sometimes years behind their monthly ISO updates from MSDN.


So do more work for free to protect users because MS put them at risk for money.


It's funny because during the windows 11 insider period, Microsoft had official documentation that told the user to use Rufus (though the screenshots matched the really old version 2)


Microsoft has long had a problem with the Tech side not knowing what the Marketing / Legal side was doing

It is not uncommon for this kind of mix messaging


If you want to skip the creation tool from Microsoft's official download website, just change your browsers User agent to Android and it will prompt you to download the ISO directly.


For comparison: Apple have an unauthenticated server from which you can download any old macOS or iOS release. It's very popular.


In the Apple world, it is the hardware that is licensed, while for Windows, it is the software. It's a small, but important difference.


Really? How many non-mac computers sold without a Windows License?

That was a big thing years ago with Linux users wanting to get refunds for the Windows License they were forced to buy, and it never really changed.


Millions upon millions. Roughly every server that has ever been sold. We're not only talking about consumer Windows here.

That said, I'm skeptical of OP's idea that this makes a difference for how Microsoft offers ISOs. I don't really think it does; Microsoft OSes all have activation and they freely offer ISOs. macOS's lack of activation is attributable to the fact that they license the OS with the hardware, but I don't think it's a relevant detail for Microsoft's ISO downloads. I'd tend to think some minor speedbumps in the download process are just because Microsoft would prefer people to use their fancy Media Creation Tool instead of downloading an ISO. The Media Creation Tool replaces both the ISO download and Rufus; it's much easier to use and I can see why Microsoft would direct users to it.


>>Millions upon millions. Roughly every server that has ever been sold. We're not only talking about consumer Windows here.

We kinda are if we are talking about a comparison with MAC...

Further if your position is windows needs to block this for piracy reasons due to server sales, anyone buying an enterprise server 99% chance they have a EA, MPSA, or some other licensing agreement already and are not using Rufus to create their Windows 11 USB Keys to install of windows

Pointing to the Server market is just a weak as the defense using MAC...

>Microsoft would prefer people to use their fancy Media Creation Tool instead of downloading an ISO. The Media Creation Tool replaces both the ISO download and Rufus; it's much easier to use and I can see why Microsoft would direct users to it.

I dont think that is it at all, this a classic hallmark of legal trying to find something to do, or some one in marketing wanting people to see all of the ads for Office 365 and other services before downloading the ISO


It's also not true. MacOS is licensed very similarly to Windows, it's just that every Mac includes a license.


Most OEM PCs also include a Windows license. The difference is that Apple will not sell a standalone MacOS license to run on a non-Mac PC or on a VM.


Sure, but the license itself is almost identical. You can run it in VM though - on a Mac, if you own MacOS already.


Yet Apple required me to sign in to my icloud account to download xcode file from their developer website.


The iso/ipsw signatures expire after months/years though, so you could end up with an image you can’t install from.



I recently discovered this tool https://www.ventoy.net/en/index.html and really like it. Essentially you just copy your iso files to the usb, and then on boot it gives you a menu to choose between them.


Discovered it through the WAN show too I suppose? :)


Maybe it's just me, but that page got hung up by ads competing with each other trying to load first. I had to leave.


Reminds me once again how essential ublock origin has become to browsing the web. Most of the time you don't even think about it and take it for granted, but it's the most essential extension to any browser.


Infuriating. Especially as I've had to use specific old ISOs to work around MS bugs.

Dragging a specific legacy system up to current required an early version of 10 (version around 1707 I think? Maybe 19xx?). It would just silently fail to upgrade with a meaningless error on the current one.


Can anyone find the GitHub issue referenced in the article? I've taken a quick look but can't find it



So if you can't download an ISO of it, how do you install it?


yet another proof that microsoft has not changed. they try hard to put up a facade, but it is quite transparant to anyone really looking


But I thought Microsoft Loves Linux now? Maybe that's why they're making it hard to download Windows.


Microsoft Embraced Linux, to Extend it, with an Eye on Extinguish

Same is true for Git


How? I don’t buy it. If MSFT commits GPL code to Linux or git, then does something objectionable, how is the community any worse off than before? Worst case, revert the change. For github I buy it, it is a service which people cannot directly self host.


Well in the case of git they use github and azure devops to "extend" the workflow of software development to where developers depend upon the non-opensource features added to the workflow where things like issues, wiki's, git specific pull request workflows etc etc etc

This makes it hard to move out of the non-open ecosystem

For Linux 90% of their commits is about locking people into Azure

In both cases they are building a separate community around their flavors of the projects not the projects themselves. You use "Github" not git, you use "AzureLinux" not linux, etc etc etc

I know young devs that have no idea that GitHub and Git are different things


Sure, I agree that EEE can absolutely apply to services which are purchased and then controlled by MSFT, but if MSFT is building up a community around software, and that generates positive changes (or even just no/neutral changes) to the original, GPL'd software, then whatever community existed there before, and the users who aren't using the various services remain at best improved (if good contributions are pushed back in) or at worst completely unaffected. Just stop using Github and run your own git server, and you lose nothing that you didn't already have before Github existed.


This strikes at the common "just build your own" meme / rebuttal to everyone that complains about well anthing by big tech these days

Open Source software, like social media and most other human endeavors has a network effect to it, that is why these companies want to control the users and do not embrace open protocols,

This idea of "well just run your own git server" is fine, i do that, but if I want to have a SUCCESSFUL, and POPULAR open source project today, it almost has to be on github at this point, the idea that I would get 100's or even 10's of people to commit, used, interact with my project on a random site running gitea is just not realistic

That is the point and desire of EEE, I am not sure why people do not understand this, why people refuse to think about the network effect, etc


But these are all arguments about GitHub. Your original assertion, which is the one that I am countering, is that git will be ruined by MSFT. It will not. Github may very well be ruined, but that could be said about it anyways, since it has always been a profit driven company, even before the MSFT acquisition.


You are arguing technicalities, I am arguing practicality

Let me break this down easier

Git == Embrace

GitHub == Extend

Microsoft, through github is EXTENDING the functionality of GIT adding features and creating an entire ecosystem around those extended features making project non-portable so people can not just pickup their repo and move them to a GitLab or Gitea...

That is the 2nd part of EEE.... Of course they are not going to add those features to the GPL version of Git, that would not enable them to EXTINGUISH Git...

I am not sure what your argument is here, at some point it seems you fail to fully understand what EEE is,


> but if I want to have a SUCCESSFUL, and POPULAR open source project today, it almost has to be on github at this point

Hello have you heard of gitlab.com?


I don’t hate GitLab, and I do appreciate the open-core aspect of it and the competition. However, despite its popularity for businesses, I think GitHub, for better or for worse, is unquestionably the best choice in terms of reaching people (for most projects, at least; the benefits of GitHub may be less relevant or even negatives for certain projects, like particularly niche privacy/freedom related ones, or alternatives to GitHub or completely different version control systems).

I’d also like to note that GitLab has a number of the same possible concerns in the sense that it is not completely opensource, libre, and standard. There are paid features and features that are specific to GitLab that people rely on.

Perhaps things like SourceHut or CodeBerg (gitea) are better examples from that perspective. And I think those often fit the few projects that actively benefit from not being on GitHub due to those factors and the platforms’ views aligning more with potential contributors, etc.

For personal, private use and such, Gitea has been what I have used for years. I find it has fit my needs better than GitLab, but I would still be hesitant to use it for much else, other than internal repos as a company, etc.

edit: it only occurred after hitting submit that you might’ve been saying that GitLab itself is popular and successful despite not being on GitHub, not that GitLab brings the same benefits/negatives of GitHub. I’ll leave this post as is, though.


Seeing as all it required to be fixed was a referer header it was more likely just an nginx configuration change.


Just talk to Rufus to time travel in a phone booth to the Year 1990 and warn everyone to not use Windows or trust a man called Bill Gates. Have an excellent adventure while doing so. Problem solved.


1990 is a litle late, Windows 3.0 was already out.

From Wikipedia: "Windows 3.0 is the first version of Windows to perform well both critically and commercially. Critics and users considered its GUI to be a challenger to those of Apple Macintosh and Unix. Other praised features were the improved multitasking, customizability, and especially the utilitarian management of computer memory that troubled the users of Windows 3.0's predecessors. Microsoft was criticized by third-party developers for the bundling of its separate software with the operating environment, which they viewed as an anticompetitive practice. Windows 3.0 sold 10 million copies before it was succeeded by Windows 3.1 in 1992."

10 million copies is pretty good for a DOS world.


You underestimate the "Guy from the future 'It's a trap'!" plot Deus Ex Machina.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: