Microsoft no longer signs Windows drivers for Process Hacker

Didn't Process Explorer start as a third party tool which Microsoft acquired?

The article mentions Process Explorer. Since Sysinternals were bought by Microsoft many years ago and the tools are distributed directly via Microsoft, such tools are unlikely to have an issue being signed.

A brief history of the process for those not following it. Originally for kernel-mode drivers, you needed a code signing certificate cross signed by Microsoft's root. This means that the certificate follows a chain up to a standard CA _and also_ one Microsoft use to approve that CA to issue kernel-mode certificates. It was not sufficient to have a certificate capable of signing code, even with MS' OIDs for that.

Then, around Windows 10 I think, Microsoft announced that one would need to acquire an EV certificate. You would then be required to submit the driver package via sysdev.microsoft.com and after spending time in Ballmer's Brewery, it would come out signed by Microsoft.

It was technically possible to use the old mechanism at this stage too, provided the end user did not have UEFI secure boot enabled. IF secure boot were enabled, the kernel would: a) if the driver was signed pre-Win10, accept it, b) if it was signed post win-10 RTM date and by Microsoft, accept otherwise reject.

Thus the only mechanism to realistically get your driver working on all Windows out of the box is to submit via sysdev. You can't realistically ask users to disable secure boot, even if this is entirely possible on all x86 motherboards.

Finally, the cross signed roots expire soon and I think some already have. Microsoft have decided that this mechanism will now be retired, and all drivers must be signed via sysdev from now on. You still require an EV certificate as well, to sign the package.

This is a bit of a mixed bag. On the one hand, Microsoft have repeatedly signed the shim maintained by redhat in order to allow Linux distributions to boot directly on secure boot-enabled hardware (UEFI binaries also go through this process and always have). Microsoft have their keys in the default keychain because they bothered to be involved in the process, unlike linux companies like Redhat. So on the one hand, they're being quite friendly to open source.

On the other hand, the push to EV certs rules out individual developers like myself[1]. I could register a company but... that entails effort and expense for a hobby project. And now hobbyist projects like this run the risk of being rejected by MS.

I mostly believe this is an attempt to reduce the number of code signing cert leaks that result in people writing malware, and lock down the Windows kernel a bit more, but still. It is a shame.

[1] This is because most CAs won't issue EV certificates to individuals, even if those individuals happen to have detailed knowledge of cryptography and all the pkcs.

In related news - ever wondered why Windows 11 can't be installed on "older computers"?

You know, the ones that don't have a TPM chip?

Now you know. Windows 11 completes the lock-up of the OS.

That's why Windows 11 exists in the first place. All other changes are secondary. Microsoft knows they would've not been able to pull shit like this as a Windows 10 update, so they were effectively forced to do a version increase. Against older promises of W10 being the last Windows version ever.

Welcome to the future that Microsoft always wanted, but couldn't have - a platform with airtight control. Just like what Apple has with its AppStore and its wonderful, wonderful 30% commission. Almost there and the lemmings didn't even notice it, distracted by the new and friendly Microsoft front, free upgrades to Windows 10 and centered Start menu in Windows 11.

Mark my words - Windows 12 will severely impede direct installation even of an user-space software, funnelling everyone to go through the store. That's the end goal and we will all be there in a couple of years, whether we want it or not.

Welcome to AAA game development on consoles, since 1980's.

Because of things like this, I'm at the point where I consider the invention of public-key encryption to be the worst thing that's ever happened to the world.

If governments had _immediately_ preemptively classified anything related to assymetric encryption—and actively enforced the classified status—as soon as the first research into it started appearing, the world would be a much better place than it is now.