Hacker News new | ask | show | jobs
by delta_p_delta_x 5 hours ago
To anyone reading this: please don't use ISOs downloaded from not-official sources.

Use an autounattend.xml, the mass graves, and a WinGet JSON to customise an online image.

[1]: https://schneegans.de/windows/unattend-generator/

[2]: https://learn.microsoft.com/en-gb/windows/package-manager/wi...

4 comments

The tool linked by the parent doesn't download ISOs from non-official sources.
Do be aware that an autounattend.xml can cause Windows setup to execute arbitrary code. Their provenance matters too. It's relatively easy to encode scripts (or even binaries) into the XML to run during or after Windows setup. You can eyeball them, for sure, but I bet most people don't.
Indeed. I mention this in light of the high-profile supply-chain attacks recently across diverse platforms (Arch AUR, Shai-Hulud, etc). Any online tool that purports to modify an entire install medium should be heavily and continually scrutinised. I'm not saying the developer can't be trusted, but the infrastructure and people in general can't.
Fine, but this is Chris Titus we're talking about, not Red Star
I use uup dump myself, which downloads the components directly from MS and builds the ISO locally
Did you even read what I wrote?
I did. You said:

> to get a NEW ISO which you then install

This is not good.

You provide an official Windows 11 ISO and the tool modifies it to get the new ISO. The tool is open-source here: https://github.com/ChrisTitusTech/winutil

I don't see the issue.

LOL. The entire ISO transformer code is open source.