zlacker

>>myster+(OP)
I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this.

Absolutely no reason a text editor needs internet access.

I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

>>Saris+8G1
Which firewall software do you use? I should probably start using firewalls in my computers as well...

>>just_t+o92
I've been using Fort: https://github.com/tnodir/fort

It's the best one I found after trying a few, because it's pretty easy to use, and lets me disable notification popups which is a part that always frustrates me about other options.

>>Saris+Ki2
Why am I hearing about that specific FW in year 2026, this seems really good, at least the features written if it really supports rules based on parent processes, wildcards, SvcHost granularity without gotchas. Been wrangling with Windows FW for ages, trying to get some badly behaved programs to update like Discord, Teams and others that change install paths or updater executable names or hiddenly use msedgewebview2. PolicyAppId and tagging based rules have given some success but Windows FW is still really broken. Definitely giving Fort a try.

>>valbu+u93
> A "Core Isolation: Memory Integrity" feature of Windows 10+ prevents creating such memory area (leading to BSOD).

> We tried to attestation sign the driver via new EV certificate by MS to fix the driver's limitation, but failed (see #108).

> So for now users have to disable the "Core Isolation: Memory Integrity" feature

Disabling HVCI doesn't sound like a good idea honestly. I mean they abuse kernel memory protection to bypass EV Certificate restrictions leaving the system in a state where another driver can mess with FW's internal structures using the same trick.