This commit unifies executable ID structure across categories and
scripts, paving the way for more complex ID solutions for #262.
It also refactors related code to adapt to the changes.
Key changes:
- Change numeric IDs to string IDs for categories
- Use named types for string IDs to improve code clarity
- Add unit tests to verify ID uniqueness
Other supporting changes:
- Separate concerns in entities for data access and executables by using
separate abstractions (`Identifiable` and `RepositoryEntity`)
- Simplify usage and construction of entities.
- Remove `BaseEntity` for simplicity.
- Move creation of categories/scripts to domain layer
- Refactor CategoryCollection for better validation logic isolation
- Rename some categories to keep the names (used as pseudo-IDs) unique
on Windows.
This commit updates the YAML schema to permit explicitly setting
`recommend: null` or `recommend: ~` in scripts within collection files.
Previously, the schema only allowed string values for the recommendation
field, restricting it to 'standard' or 'strict'. By introducing the
`RecommendationLevel` definition, the schema now supports both string
and null values, providing more flexibility in specifying
recommendations in collection YAML files.
This commit introduces a new shared function to centralize all usages of
`reg delete .. /va`. The new function generates comments in code and can
recurse through subkeys. This enhances maintainability and reliability
by avoiding potential misuse or syntax errors.
Key changes:
- Add `ClearRegistryValues` function
- Update scripts to use the new function
- Add ability to recurse subkeys for registry value deletion, addressing
issues where desired data was not deleted.
Other supporting changes:
- Improve documentation of the changed scripts.
- Add missing registry paths in scripts.
- Change value removal to value/subkey removal for correct behavior.
- Remove removal of undocumented keys.
- Rename related scripts for clarity.
- Adjust script recommendations.
Before this commit, license deletion used `reg delete .. /va /f`, which
deletes all valued under a key. However, the license data did not exist
under the specified subkeys, making the logic ineffective. This commit
changes it to delete the license registry key completely to correctly
remove the license data.
Changes:
- Change `reg delete /va` to delete the correct registry data.
- Create shared function for deleting license data for better
maintainability.
- Add comment in generated script code for license removal.
- Add documentation for the scripts.
- Include a missing script to clear Visual Studio 2013 telemetry.
- Remove redundant lines of code in `CreateRegistryKey` and
`DeleteRegistryKey` that initialize an unused variable.
This commit reorganizes scripts related to disabling Defender's data
collection and telemetry into a dedicated category. This improves
usability for users focused on enhancing privacy without needing to
understand technical details of each option.
Changes:
- Create "Disable Defender data collection" category
- Move related scripts under new category
- Improve script documentation and naming
- Add alternate configurations to some scripts
- Fix extended cloud check feature being enabled instead of disabled
- Update script recommendations to 'Strict'
- Restructure and expand rename CEIP-related scripts for clarity and
granularity.
- Add missing tasks and registry keys for comprehensive CEIP disabling.
- Improve documentation with detailed explanations and references.
- Rename scripts for better user understanding and consistency
- Fix incorrect revert behavior in some scripts
- Introduce SetRegistryValueAsTrustedInstaller function to unify setting
registry values as TrustedInstaller.
- Introduce RunPowerShellWithMinimumWindowsVersion function to unify
Windows version specific registry modifications.
- Add more documentation for scripts using TrustedInstaller.
- Correct revert code for affected scripts to match default OS behavior
(setting registry value back) instead of just deleting keys.
- Add comprehensive documentation with security cautions
- Expand SmartScreen disabling for Internet Explorer
- Fix registry data for Internet Explorer SmartScreen disabling
- Add disabling of `smartscreen.exe` process, resolving #385
- Implement additional SmartScreen disabling methods
- Correct registry key for Store apps
- Simplify script names for clarity
This commit updates the Windows scripts to handle Firefox installations
acquired through the Microsoft Store. It adds support by modifying
script functions to clear and delete profile directories specific to
this version of Firefox.
Optimize PowerShell script invocation to differentiate actions based on
Windows version. This revision introduces a more efficient way to handle
version-specific scripting within Windows collection by abstraction
complexity into dedicated shared functions.
This commit changes the mechanism to disable services using
TrustedInstaller privileges, improving consistency and flexibility.
Key changes:
- Introduce `DisableServiceInRegistryAsTrustedInstaller` as a shared
function to standardize the disabling process. This function aligns
with existing ones to facilitate easier testing and method switching.
- Update the revert logic to avoid unnecessary service restarts when
they are manually started.
- Enhance readability with added comments in generated code sections.
- Improve documentation for `DisableService` and
`DisableServiceInRegistry` to reflect new functionalities.
- Support multiline code in `RunInlineCodeAsTrustedInstaller` for
complex scenarios.
Other supporting changes:
- Remove redundant TrustedInstaller privileges in the `Sense` service
disabling.
- Document default service statuses to inform about service behaviors
across different Windows versions.
This commit improves the scripts configuring Edge. It improves their
categorization, naming and adds scripts to disable Bing ads and Search
bar along with others to disable ads/data collection.
Changes:
- Add new scripts to configure Edge, such as blocking ads and AI
features that collects data.
- Improve categorization and documentation consistency.
This commit adds scripts to block automatic updates for Microsoft Edge
and WebView2 on Windows, aimed at enhancing user privacy as per the
issue #309.
Changes:
- Create a new category for scripts targeting Edge and WebView2 updates.
- Add scripts for disabling automatic update services, scheduled tasks,
and executable blocking, along with registry configurations.
Other supporting changes:
- Remove comments in code that indicates reusing of small text parts.
This approach does not encourage creating unique content.
This commit improves the script organization, documentation and code for
Edge and Chrome browser by simplifying naming, categorizing
configurations, and unifying documentation and generated code.
Changes:
- Rename "Edge (Chromium)" to "Edge" for clarity, with "Edge (Legacy)"
detailed explicitly in the script titles.
- Flatten Edge settings under a unified "Configure" category.
- Enhance script documentation to improve clarity.
- Move "Your browser is managed" warning from script titles to script
documentation.
- Introduce shared functions for configuring Edge and Chrome, leading to
better consistency in generated code.
- Update scripts to include restart suggestions in generated code.
- Improve documentation of affected scripts.
- Split some scripts for increased granularity, easier maintenance and
focused documentation.
- Fix some Windows UI scripts being incorrectly categorized as Edge
configurations.
This commit introduces a placeholder ifle creation step necessary for
the uninstallation process of Microsoft Edge on Windows 10, as discussed
in #309. The file simulates the presence of Microsoft Edge (Legacy),
which newer uninstallers check for before proceeding with the
uninstallation.
This change resolves the observed issue where the uninstaller fails to
recognize the absence of Legacy Edge, hindering the uninstallation
process.
Changes:
- Add placeholder file creation/removal for legacy Edge.
- Update and improve the documentation.
If Edge is uninstalled using an existing installer, it may delete other
installers. When the script attempts to use these deleted installers,
it results in an error: `The system cannot find the file specified.`.
This commit addresses the issue by checking for the existence of the
uninstaller during the iteration and handling cases where it is missing.
This commit introduces type validation for parameter values within the
parser/compiler, aligning with the YAML schema. It aims to eliminate
dependencies on side effects in the collection files.
This update changes the treatment of data types in the Windows
collection, moving away from unintended type casting by the compiler.
Previously, numeric and boolean values were used even though only
string types were supported. This behavior was unstable and untested,
and has now been adjusted to use strings exclusively.
Changes ensure that parameter values are correctly validated
as strings, enhancing stability and maintainability.
This commit improves the validation logic in parser, corrects Windows
collection files to adhere to expected structure. This validation helps
catch errors that previously led to incomplete generated code in scripts
for disabling VSCEIP and location settings.
Changes:
- Add type validation for function call structures in the
parser/compiler. This helps prevent runtime errors by ensuring that
only correctly structured data is processed.
- Fix scripts in the Windows collection that previoulsy had incomplete
`code` or `revertCode` values. These corrections ensure that the
scripts function as intended.
- Refactor related logic within the compiler/parser to improve
testability and maintainability.
This commit improves collection file editing and error detection
directly in the IDE. It adds YAML schema, IDE configuration and
automatic tests to validate it.
- Introduce a YAML schema for collection file.
- Use `yaml-language-server` for enhanced YAML support in VSCode.
- Add telemetry disabling in `configure_vscode.py` to respect user
privacy.
- Add automated checks to validate YAML file structure against the
schema.
- Remove unused properties and do not allow them in compiler.
Previously, scripts under the 'Clear operating system logs' category for
macOS were misaligned due to a lack of individual script
recommendations, as the category itself wrongly used the `recommend:
strict` property. This misconfiguration caused none of these scripts to
appear recommended.
This commit assigns accurate `recommend:` values to each script
within the category.
Key changes:
- Introduce individual recommendations for each script.
- Document scripts to justify recommendations.
- Standardize deletion operations through shared functions.
- Improve script and category naming for clarity.
- Simplify code by unifying redundant path references.
- Add comments in generated user script code.
- Fix specific issue where clearing daily os logs inadvertently affected
configuration files.
This commit corrects a syntax error that prevented the 'Disable text
and handwriting data collection' script from being included since
version 0.13.4. The error was identified in a previous syntax validation
update (commit 6ecfa9b954).
Changes:
- Add a missing dash before 'Disable location access' category. This
fixes the script omission as reported in the issue #369.
- Remove the dash from `revertCode` of `HarvestContacts` registry
modification code, fixing the revert code for 'Disable text and
handwriting data collection' script.
This fix addresses the build errors introduced by stricter syntax checks
and ensures that the script is now properly recognized and executed.
This fix is part of ongoing efforts to improve data handling robustness
and management in script processing.
This script fixes the recommendation property syntax in Windows script
collection. This syntax error prevented the application from
recommending these scripts, even though they were intended to be
recommended.
Affected scripts:
- Disable app access to physical movement
- Disable app access to eye tracking
- Disable app access to human presence
- Disable app access to screen capture
Previously, these scripts used the unsupported 'recommended: standard'
property, which was identified as incorrect after implementing stricter
property validation.
Related commit: 6ecfa9b954
Related issue: #369
This change update these properties to the correct 'recommend:
standard', resolving issues where scripts were not being recommended as
expected.
This commit consolidates scripts and categories under a unified
'Executable' concept. This simplifies the architecture and improves code
readability.
- Introduce subfolders within `src/domain` to segregate domain elements.
- Update class and interface names by removing the 'I' prefix in
alignment with new coding standards.
- Replace 'Node' with 'Executable' to clarify usage; reserve 'Node'
exclusively for the UI's tree component.
Revert scripts for removing shortcuts previously used hardcoded paths.
These paths are now replaced with system environment variables to allow
for broader configuration compatibility.
This commit adjusts the recommendation level for disabling captive
portal detection from 'Standard' to 'Strict'. This aligns macOS settings
with equivalent recommendations for Linux and Windows.
It improves documentation to provide additional context on implications,
facilitating a better understanding of the change.
This commit improves blocking of execution of executables, providing a
more reliable way to stop execution of unwanted executables.
Introduce a new function to block shell execution of an executable. This
logic is extracted from disabling Chrome Software Reporter tool with
improved logic which does no longer or reset if there is other rules.
This resolves potential issues if there was a blocking rule using same
number which privacy.sexy before overwrote or restored on revert.
Other scripts which terminated executables on launch does now block
their shell execution too for more reliability. A common function is
introduced which streamlines blocking execution of an executable all
known ways which is now reused by these scripts.
This commit additionally improves the Google Software Reporter disabling
script. It removes the code that adds denies permissions on its
installation directory as the new way of preventing executable from
running should be enough. It also adds missing documentation to the
related scripts.
This commit improves the existing Firefox privacy scripts and improves
the categorization and documentation to be simpler and more clear.
Changes:
- Rename and reorganize scripts for disabling browser telemetry and
default browser agent reporting to simplify the structure.
- Improve documentation across scripts to provide clearer guidance on
how the changes improve user privacy.
- Fix revert scripts by removing unnecessary registry key configuration.
This commit updates documentation to clarify the impacts of disabling
firewall services, specifically how they affect Windows Sandbox, Docker
and WSL.
This update responds to user feedback from issues #115, #152, #364. The
documentation now guides users more clearly on the consequences of their
actions, potentially preventing unintended service disruptions.
Changes include:
- Expand the caution notes to explicitly mention the impact on
virtualization and isolation features like Windows Sandbox, Docker and
WSL.
- Expand script titles to briefly mention affects on these features.
- Expand documentation to suggest system restart.
- Add an informative message to restart the computer in terminal outputs
after service changes to ensure the settings are applied.
This commit adjusts the recommendation level for scripts that disable
UWP app access to accommodate user issues #121, #339, #350. It also
extends their documentation to reflect the new changes and with
cautions.
Changes:
- Add caution text for all scripts about potential impacts.
- Move disabling app access to notifications from 'Standard' to
'Strict'. This addresses #121 and #339, where users report lack of
notification as unintended side-effects.
- Move disabling app access to phone calls from 'Standard' to 'Strict'.
This addresses #350 where its effect on the Phone Link app was
reported as an unintended side-effect.
- Consolidate removal of printing UIs under the same category.
- Improve documentation for printing app removal scripts.
- Add removal of previously unlisted 'Print Queue' app, #279.
- Combine removal of `Microsoft.Print3D` and `Windows.Print3D`
into a single script.
- Highlight the importance of removing 'Print 3D' app due to
security risks and recommend it on 'Standard'.
This commit improves the documentation of RSA key handling script and
changes its recommendation level to address potential issues with
Hyper-V (as reported in #363).
Changes:
- Add documentation to describe potential disruptions caused by stronger
RSA key requirements.
- Move RSA key script from 'Standard' to 'Strict' due to its impact on
Hyper-V VMs.
- Use bullet points for easier expansion in cautions of secret key
hardening scripts.
This commit improves disabling app access by correcting minor issues,
adding missing access control configurations and adding more
documentation to increase maintainability and user understanding of
privacy settings, resolving #138.
- Introduce shared functions to streamline modifications of app access,
improving maintainability and simplifying the codebase.
- Move disabling app access to first position in the category.
- Improve code comments for better clarity on generated outputs.
- Resolve error display in revert codes due to incorrect use of `reg
delete` commands.
- Fix disabling app access to trusted devices disables access to account
information, name and picture on older versions of Windows.
- Add missing privacy settings and configurations.
- Add more documentation to scripts
- Rename script names for consistency and clarity.
- Move disabling access to SMS/MMS to phone access disablement category.
- Set empty `REG_MULTI_SZ` values to null for GPO access settings to
maintain registry integrity.
This commit standardizes the management of registry keys and their
corresponding revert on delete action across all scripts using
`SetRegistryValue` function.
It improves script reliability, addresses previous errors, and corrects
the revert actions to match the default OS state when not explicitly set
by the OS.
Key changes:
- Use SetRegistryValue for uniformity.
- Remove error messages for non-existent registry keys, recognizing them
as expected states rather than errors.
- Add missing revert actions to scripts where they were absent.
- Correct the revert logic in existing scripts to match the default OS
configurations, particularly when the OS does not set a default value.
- Update documentation about default OS state for the related scripts.
This change improves maintainability by centralizing and standardizing
registry interactions, reducing the risk of errors and inconsistencies
in script behaviors.
This commit restructures the categorization of network security-related
scripts to improve clarity and align with user expectations. It involves
renaming and reorganizing categories to more accurately reflect their
functions beyond just IIS configurations.
This reorganization helps users find and utilize network security
scripts more efficiently and ensures that the categorization accurately
reflects the broader application of the scripts beyond server
configurations.
Changes:
- Merge network security enhancements under a single category.
- Rename categories for simplicity and increased technical accuracy.
- Flatten nested categories to streamline navigation and enhance
clarity.
- Update documentation to match the new category structures.
- Revise script recommendations to encourage broader use.
- Fix revert codes of some related scripts to reflect default OS
settings.
This commit addresses the issue where scripts fail to execute on Windows
environments with usernames containing spaces. The problem stemmed from
PowerShell and cmd shell's handling of spaces in quoted arguments.
The solution involves encoding PowerShell commands before execution,
which mitigates the quoting issues previously causing script failures.
This approach is now integrated into the execution flow, ensuring that
commands are correctly handled irrespective of user names or other
variables that may include spaces.
Changes:
- Implement encoding for PowerShell commands to handle spaces in usernames
and other similar scenarios.
- Update script documentation URLs to reflect changes in directory
structure.
Fixes#351
This commit refines the configuration of TLS and DTLS protocols on
Windows to enhance compatibility and stability across different
Windows versions.
Changes:
- Enable TLS 1.3 exclusively on Windows 11 and newer, addressing
stability concerns with previous Windows versions, and resolving
issue #175.
- Enable DTLS 1.2, replacing DTLS 1.3 due to lack of support in
Windows. DTLS is enabled only on Windows 10 version 16007 and later
for compatibility.
- Reorganize script categories for better clarity and manageability.
- Update revert codes for registry deletions to prevent false negative
error outputs.
- Adjust recommendation levels to encourage more scripts due to system
stability and documentation improvements introduced in this commit.
- Remove incorrect registry keys previously set for .NET apps.
- Add missing 64-bit registry keys for .NET apps.
- Rename scripts for improved simplicity and consistency.
- Improve documentation for affected scripts, correcting the
misleading information about DTLS 1.2 vulnerability.
- Convert hexadecimal values to decimal in scripts to improve
clarity.
- Introduce shared functions to reduce redundancy and improve
script maintainability.
- Add more comments in generated code and simplify existing comments.
This commit modifies the blocking behavior of `r.bing.com` due to its
extensive use across multiple Windows features, including Copilot and
Maps. Previously, included in the 'Cortana and Live Tiles' block list,
this host was causing issues for Copilot functionalites, as noted in
issue #329. By excluding `r.bing.com` from block list, this update aims
to prevent unintended disruptions without compromising the privacy gains
of other scripts.
Changes include:
- Exclude `r.bing.com` from the "Cortana and Live Tiles" block list.
- Improve documentation to clarify the role and exclusions.
- Improve documentation with consistent header for blocked hosts.
This commit groups scripts related to disabling protocols under same
category, streamlining the process for disabling protocols like NetBios,
SMBv1, and various TLS/SSL versions. It improves the documentation and
scripts of the related scripts.
Key changes:
- Introduce new category for disabling insecure protocols and move
related scripts under it.
- Remove .NET configuration from TLS 1.0 disabling to prevent unwanted
side effects on .NET applications, maintaining system integrity.
- Remove the script disabling DTLS 1.1 as this protocol does not exist.
- Recommend previously not recommended scripts:
- SSL 2.0 in 'Standard' because it's already removed from Windows.
- SSL 3.0 in 'Standard' because it's already disabled by default.
- TLS 1.0 in 'Strict' as it's deprecated on Windows.
- TLS 1.1 in 'Strict' as it's deprecated on Windows.
- Rename and reorder scripts for consistency and enhanced readability.
- Fix revert codes to accurately reflect successful operations, by
adding `2>nul` on `reg delete` commands.
- Expand documentation to include detailed precautions and references,
aiding users in understanding the implications of their actions
(addressing user feedback from #57, #131, #183, #185).
Other supporting changes:
- Convert hexadecimal values to decimal to enhance script readability.
- Refactor scripts to utilize shared functions, improving maintainability.
- Add detailed comments within the scripts to aid in comprehension.
- Minor updates to other crypto scripts for consistency.
- Reorganize protocol listing by age for a logical script flow.
- Standardize comments across various TLS configuration scripts for
clarity.
- Fix enabling DTLS 1.3 being categorized as disabling insecure
connection.
This commit addresses reports in issue #131 about third-party cloud
services like MEGA and Dropbox being affected by hash disabling. It
updates the documentation to guide users on the potential impact,
adjusts the recommendation levels along with other minor improvements.
- Recommend hash disabling scripts in 'Strict'.
- Expand and refine documentation, adding warnings to inform user
decisions (addressing issues #57, #131, #175, #183).
- Add a new shared function to standardize hash disabling, increasing
code maintainability.
- Change from hexadecimal to decimal in scripts for clarity.
- Improve code comments for better understanding.
- Add comments in generated to code to make it easier to follow.
- Fix revert codes showing errors by using `2>nul` in `reg delete`
commands.
- Rename scripts for consistent naming conventions.
Supporting changes in other SSL/TLS handshake scripts:
- Update documentation for consistency.
- Rename shared functions for consistency and clarity.
- Improve generated code comments for clarity.
Due to changes in how Windows handles the Snipping Tool, this commit
reclassifies the tool's disablement into its own distinct category.
This update introduces alternative methods to disable the tool,
enhances documentation, and improves script functionality.
Changes include:
- Move Snipping Tool removal to a standalone category for clearer
navigation.
- Expand documentation to better describe the tool's impact on privacy.
- Add methods to disable the tool without removing the app.
- Implement a shared function to disable specific Windows hotkeys.
- Rename Cortana shortcut disablement script for consistency.
- Introduce 'Disable insecure ciphers' category to organize and group
cipher disabling scripts.
- Expand documentation, adding cautionary notes to help users make
informed decisions, addressing issues #57, #131, #175, and #183.
- Implement `DisableCipherAlgorithm` function to standardize the
approach to disabling cipher algorithms, enhancing maintainability
and promoting code reuse.
- Replace hexadecimal numbers with decimals in scripts to improve
readability.
- Add comments to generated code for better understandability.
- Update revert codes to avoid incorrect error messages when
operations are successful, using `2>nul` in `reg delete` commands.
- Rename scripts for consistency, incorporating 'insecure' in titles.
- Adjust recommendations to disable all insecure ciphers in 'Strict'
mode due to security risks, and recommend disabling `NULL` in
'Standard' mode as it removes encryption.
- Remove disabling of `DES 56`, correcting a redundancy as this cipher
configuration does not exist.
This commit improves script clarity and user guidance on disabling
insecure renegotiations.
- Update script name for clarity.
- Improve documentation for better understanding.
- Recommend the script as 'Strict' to align with its security focus.
- Modify revert codes to suppress misleading error messages upon
successful reversion by including `2>nul` in `reg delete` commands.
- Convert hexadecimal to decimal in registry commands to improve
readability.
Reorganize and document scripts for disabling network features,
enhancing their discoverability and manageability. This commit
categorizes scripts related to disabling insecure network connections,
improves documentation, and makes these scripts more accessible.
- Group scripts under `Disable insecure connections` category.
- Move SMBv1 and NetBios disablement scripts to this new category.
- Improve documentation, highlighting the security improvements
and potential compatibility issues with older systems.
Addresses issues #57, #115, #183, #175, and #185 by simplifying the
process of troubleshooting and reversing changes if necessary.
This commit refines the reversion process for disabled services,
including handling cases where a service is missing, and enhances
documentation related to default service states. It corrects the
startup mode for the `gupdatem` service from 'Automatic' to 'Manual'.
Key changes:
- Add documentation on default service states and startup types.
- Introduce `ignoreMissingOnRevert` to skip errors when reverting
missing services, improving the user experience.
- Standardize script titles for consistency across service
disablement scripts.
- Correct the startup type for `gupdatem` to 'Manual', aligning
it with its actual default state.
Supporting changes:
- Update `DisableService` function to support `ignoreMissingOnRevert`,
allowing more flexibility in handling missing services on revert.
- Change `treatMissingStateAsOk` to `ignoreMissingOnRevert` for
clarity and consistency.
This commit enhances the documentation related to disabling the firewall
services in Windows, with a focus on the `winget` CLI's functionality,
resolving #142.
Changes:
- Expand documentation to include implications on `winget` CLI,
addressing the issue #142.
- Add documentation for disabling `mpsdrv` service.
- Align documentation for disabling `mpssvc` service to match updates
made for `mpsrv` to maintain consistency across documentation.
- Introduce documentation for parent categories affected by scripts
that disable these services.
- Add documentation for parent categories for disabling these firewall
services.
The documentation aims to provide users with a comprehensive
understanding of how these changes affect both system performance and
security posture.
