Why I stopped recommending Windows utilities

The Windows software scene used to be fun. Now, it's risky.

I just uninstalled Auto Dark Mode, which is a great utility — but it no longer seems necessary now that Microsoft’s Light Switch PowerToy can turn on dark mode at sunset.

I used to use so many little Windows utilities, and they’ve gradually all been absorbed either into Windows 11 proper or Microsoft’s PowerToys package.

It’s hard to trust a random little Windows utility these days. We learned our lessons at How-To Geek. Often, Chrome extensions were sold to adware companies. Once, a writer linked to an interesting application on GitHub that many other publications were linking to — but it ended up containing malware! Thankfully, the malware wasn’t active and no readers got hurt. But the software wasn’t trustworthy.

This isn’t how Windows used to work

Back in the day — especially the Windows XP era, but also the Windows 7 era — I used so many little Windows utilities. My favorite one was Power Menu, which let me right-click any window’s title bar and toggle “Always on top” and other settings.

Windows felt like more of a platform for different tools, and everyone had their favorites. I once used a little application called musikCube as my music player. You’ve probably never heard of it, but I loved it. Windows used to be like that: You could hunt down little programs almost no one had heard of and have a great time with them. Sites like early How-To Geek, Lifehacker, and even Download Squad linked to useful little apps and utilities.

Now, I try to stick with tools built into Windows and PowerToys. If I choose something else, I have to do some serious reputation research before I trust something.

Even in the glory days, these apps were potentially dangerous. But I don’t think I was just younger and more carefree. Back then, there were also fewer malicious apps out to steal our money.

At some point, the ecosystem broke

I’m not sure when the ecosystem broke. But I remember a lot of moments at How-To Geek:

• Windows software downloaders getting bloated with adware and spyware.

• Chrome extensions getting sold to the highest bidder and becoming malicious.

• Useful tools linked on GitHub receiving updates from the developers that added malicious code.

Even if you do the work and confirm something is trustworthy before you link to it, an update a year or two later could make what you recommended dangerous. To safely recommend Windows software downloads, you have to be able to see into the depths of the developer’s soul — or see the future.

Without trust, the free-wheeling Windows software download ecosystem started falling apart.

The web and mobile are still okay-ish

When you download and run an application on Windows, you’re giving that application access to your whole computer. Even if you click through a UAC security prompt, that app can still access all your personal files and see everything you type on your PC. It just can’t modify Windows system files. That doesn’t add much security for the threats real people care about.

This is probably one underappreciated reason why web apps took over on Windows. Sure, you have to trust the web app with the data you provide — but you don’t have to give it access to every file on your PC!

Mobile platforms — Android and iOS — work differently. They sandbox apps, so you can install an Android or iPhone app without worrying it will send all your files to a crime ring or run a keylogger in the background.

How to trust the apps you install

There’s still more you can do to trust the applications you download on your PC.

• First of all, get apps from trusted sources when possible. If you install apps from the Windows Store or the WinGet command (you can use UniGetUI for this), you’re getting apps with some degree of a reputation. And you’re getting installers that don’t contain malware.

• On a Professional edition of Windows, you can use Windows Sandbox to test applications in a little isolated box. It’s fast and convenient, but those apps aren’t going to integrate well with your PC.

• You can minimize browser extensions — I use my trusted password manager, and that’s basically it. Many browser extensions get access to all your web browsing activity, and that takes a lot of trust.

• Most importantly, you have to take reputation into account. An open-source project with a good reputation that’s been around for a while is probably nice and safe. A newer little utility from an individual developer? Well — who knows.

There are lots of good open-source applications out there, but it’s more essential than ever to choose something with a known reputation. Trust matters.

For example, open-source apps like VLC, Paint.NET, Notepad++, SumatraPDF, and KeePass are still great. I seem to be mentioning only open-source tools that have existed for more than a decade. That’s the point! Anything new that just popped up on GitHub feels suspect.

PowerToys and Windows keep absorbing utilities

Microsoft clearly knows this is a problem, so it’s no surprise to see Microsoft’s free PowerToys package (and the Windows operating system itself) absorbing more and more utilities.

For example, the built-in Windows Snipping Tool replaced third-party screenshot and screen-recording tools. Night Light replaces the need for f.lux. And even Windows 11’s Start menu replaces the need for the third-party Start menus we turned to in the Windows 8 days!

PowerToys is great because it’s a package of free, trusted, updated tools. It’s replaced a collection of third-party tools I used to go out of my way to download on my various PCs. I can rename files in bulk, remap keyboard shortcuts, make Windows always on top, use an alternate keyboard-focused application launcher, and do so much else.

It’s all in one place, with just one download necessary. But there’s no doubt that Windows is less interesting for it.

Windows software needs too much trust

You know, I installed a little Windows app from a GitHub repository the other day. When I saw the Windows SmartScreen warning pop up, I paused and asked myself:

“Do I trust this person with complete access to my PC? Am I willing to assume that much good about them?”

I decided I did, but it was like taking a leap off a cliff. Running software on your PC shouldn’t be like that.

The latest from Thurrott.com

Mozilla is working on an “AI Window” for Firefox — sort of a hybrid between an AI browser and a non-AI browser. And that new Start menu is rolling out on all Windows 11 PCs. For Thurrott Premium subscribers, Paul discussed Apple’s rumored budget Macbook.

Microsoft better hurry up and get serious about PC gaming, as Valve just launched a new line of Linux-based gaming devices to compete with its Xbox hardware. For Thurrott Premium subscribers, Paul went hands-on with Windows 11’s “full screen experience” for gaming devices.