This is becoming known the software supply chain space, but Acronis software tampers with backups and lots of companies are dropping it. “True Image” couldn’t be further from the truth. Recommend Clonezilla for sure.
>These files are also missing Product Name, Company Name, and Product Version in the ETW fields and much of this information is also missing from the sigcheck output.
I have no clue what vendors do this, especially MS themselves. Has the exact look of files that were installed by a virus.
This is wrong. Malware authors put in a lot more work to make their software look legitimate, even including valid version information and digital signatures.
I don't think anyone who's run Acronis would be surprised at this. The whole thing feels clunky. I had a weird issue where it would crash my Dante audio setup every time it kicked off a backup.
Windows ends up being a thousand cuts situation when you have enough software like this installed. If you want a responsive and stable system you end up spending a good amount of time troubleshooting freezes or mystery CPU/disk usage.
As of yesterday (this started suddenly) any time Backblaze is performing a backup my whole system gets bogged down for no reason. Was fine days ago, so who knows what automatic update for what app caused it. It's probably an interaction with some other filesystem filter on my system, like Defender or Acronis True Image (which I am stuck using since every other disk imaging tool I've used is worse). Seeing this post on the front page has me wondering whether it's actually Backblaze's fault or it's Acronis, now...
I've previously tracked down random system freezes caused by some part of the NVIDIA driver interacting with one of my monitors, where the first unlucky process on my system to call certain graphics APIs after a boot or wake-from-sleep would cause the video driver to hold a lock and enumerate display modes for 10+ seconds. The end result was a "frozen" PC still responding to input, just unable to send new pixels to any of its displays. The fun part of that one was that profiling would blame these freezes on whatever user mode process was unlucky enough to make that graphics API call - Steam's browser overlay, Visual Studio's WPF rendering, the list goes on. The troubleshooting process for this one was expensive because I got to the point of replacing components before I figured it out.
I'm curious whether people who daily drive mac or linux encounter these sorts of system configuration gremlins. My experience using linux on servers and VMs has had some situations like this but I don't know whether the everyday experience just running Linux or OS X on bare metal is actually perfect at this point.
> I'm curious whether people who daily drive mac or linux encounter these sorts of system configuration gremlins.
IMO these issues occur any time you have third party software that does the job the operating system should be doing itself. Backup/snapshot software (this should be a feature of the file system), clipboard software (the OS clipboard should cover these needs), hot key software, window management, “anti cheat” (or really anything that needs to be a kernel module), antivirus, antimalware, the list goes on.
A properly architected system should have an operating system in charge of managing apps and resources and hardware, and apps which mind their own business. Cross-cutting “horizontal” stuff like what Acronis is doing here are reimplementing things your OS should be doing, and thus aren’t tested along with the OS itself, and are bound to have issues like these.
Or you run macOS and the first party stuff is so buggy (spotlight I’m looking at you) that you’re screwed either way.
Explorer extensions such as the dlls which set the overlay icons used by Google Drive, OneDrive, Git, SVN, etc. are notoriously buggy. We want programmers to provide these extensions, but the documentation is bad and the interfaces are hard to program (measured by the amount of crashes caused by even a Google authored tool). I think Microsoft should have provided a test suite for these implementors to run or a certification program.
> I'm curious whether people who daily drive mac or linux encounter these sorts of system configuration gremlins
Friend of mine dailies Arch. He described a few days ago a situation where he stopped being able to take screenshots from one day to the other, eventually finding out the root cause thanks to this fix: https://github.com/flameshot-org/flameshot/pull/4127
Whenever Linux package management and shared dependencies are mentioned, people always seem to be quick to mention how it's good for security that you can upgrade dependencies without the consent and knowledge of the developer of each software you're using. To me, issues like this come to mind instead. Or how I heard multiple times acquainted developers complain that packagers modified their software downstream and broke it in some ways, only for users to come complain to them instead of to the distribution.
There's a recent(?) trend of circumventing distro repos and static linking things though, and I work with Go software pretty often, which I believe static links by default: they're a joy to deploy and use. Just nice, single, self-contained binaries. But it's really not the "one true Linux way" from what I can tell, so I'd imagine it's pretty against the grain, which should tell you a lot about the situation overall. I know I'm not itching to switch, and these are only a sliver of my gripes too.
Try Veeam for Windows. It's free and it will not get more light weight that this. Tried Acronis last 15 years ago and they went from amazing to bloated and slow and terrible. I assume it still is.
Speculation, since I don't have the relevant software:
- the Windows icon cache is dependent on the display configuration (in particular, bit depth, and maybe pixel density)
- unplugging a monitor therefore flushes the icon cache
- the relevant file is an explorer icon overlay handler (which is identified by the registry key one needs to mitigate the problem)
- therefore flushing the icon cache causes a mass refresh
- the handler is probably looking to see if some True Image process is running †
- maybe it needs that to show different icon overlays?
- it's probably also doing that for every icon (i.e. the caching isn't happening across different icons, at least when the cache is flushed)
† in hind sight, this is better done via a named pipe or mutex or something
(Edit: added line breaks)
This is becoming known the software supply chain space, but Acronis software tampers with backups and lots of companies are dropping it. “True Image” couldn’t be further from the truth. Recommend Clonezilla for sure.
>These files are also missing Product Name, Company Name, and Product Version in the ETW fields and much of this information is also missing from the sigcheck output.
I have no clue what vendors do this, especially MS themselves. Has the exact look of files that were installed by a virus.
This is wrong. Malware authors put in a lot more work to make their software look legitimate, even including valid version information and digital signatures.
I don't think anyone who's run Acronis would be surprised at this. The whole thing feels clunky. I had a weird issue where it would crash my Dante audio setup every time it kicked off a backup.
Windows ends up being a thousand cuts situation when you have enough software like this installed. If you want a responsive and stable system you end up spending a good amount of time troubleshooting freezes or mystery CPU/disk usage.
As of yesterday (this started suddenly) any time Backblaze is performing a backup my whole system gets bogged down for no reason. Was fine days ago, so who knows what automatic update for what app caused it. It's probably an interaction with some other filesystem filter on my system, like Defender or Acronis True Image (which I am stuck using since every other disk imaging tool I've used is worse). Seeing this post on the front page has me wondering whether it's actually Backblaze's fault or it's Acronis, now...
I've previously tracked down random system freezes caused by some part of the NVIDIA driver interacting with one of my monitors, where the first unlucky process on my system to call certain graphics APIs after a boot or wake-from-sleep would cause the video driver to hold a lock and enumerate display modes for 10+ seconds. The end result was a "frozen" PC still responding to input, just unable to send new pixels to any of its displays. The fun part of that one was that profiling would blame these freezes on whatever user mode process was unlucky enough to make that graphics API call - Steam's browser overlay, Visual Studio's WPF rendering, the list goes on. The troubleshooting process for this one was expensive because I got to the point of replacing components before I figured it out.
I'm curious whether people who daily drive mac or linux encounter these sorts of system configuration gremlins. My experience using linux on servers and VMs has had some situations like this but I don't know whether the everyday experience just running Linux or OS X on bare metal is actually perfect at this point.
> I'm curious whether people who daily drive mac or linux encounter these sorts of system configuration gremlins.
IMO these issues occur any time you have third party software that does the job the operating system should be doing itself. Backup/snapshot software (this should be a feature of the file system), clipboard software (the OS clipboard should cover these needs), hot key software, window management, “anti cheat” (or really anything that needs to be a kernel module), antivirus, antimalware, the list goes on.
A properly architected system should have an operating system in charge of managing apps and resources and hardware, and apps which mind their own business. Cross-cutting “horizontal” stuff like what Acronis is doing here are reimplementing things your OS should be doing, and thus aren’t tested along with the OS itself, and are bound to have issues like these.
Or you run macOS and the first party stuff is so buggy (spotlight I’m looking at you) that you’re screwed either way.
Explorer extensions such as the dlls which set the overlay icons used by Google Drive, OneDrive, Git, SVN, etc. are notoriously buggy. We want programmers to provide these extensions, but the documentation is bad and the interfaces are hard to program (measured by the amount of crashes caused by even a Google authored tool). I think Microsoft should have provided a test suite for these implementors to run or a certification program.
> I'm curious whether people who daily drive mac or linux encounter these sorts of system configuration gremlins
Friend of mine dailies Arch. He described a few days ago a situation where he stopped being able to take screenshots from one day to the other, eventually finding out the root cause thanks to this fix: https://github.com/flameshot-org/flameshot/pull/4127
Whenever Linux package management and shared dependencies are mentioned, people always seem to be quick to mention how it's good for security that you can upgrade dependencies without the consent and knowledge of the developer of each software you're using. To me, issues like this come to mind instead. Or how I heard multiple times acquainted developers complain that packagers modified their software downstream and broke it in some ways, only for users to come complain to them instead of to the distribution.
There's a recent(?) trend of circumventing distro repos and static linking things though, and I work with Go software pretty often, which I believe static links by default: they're a joy to deploy and use. Just nice, single, self-contained binaries. But it's really not the "one true Linux way" from what I can tell, so I'd imagine it's pretty against the grain, which should tell you a lot about the situation overall. I know I'm not itching to switch, and these are only a sliver of my gripes too.
Try Veeam for Windows. It's free and it will not get more light weight that this. Tried Acronis last 15 years ago and they went from amazing to bloated and slow and terrible. I assume it still is.
Spent an hour trying to get Veeam to work and it can't connect to an agent installed on the same machine. Sigh. Thanks for the suggestion though.
Clonezilla is another alternative. I haven’t used it in years, but it used to be pretty good.