It’s not quite as bad as presented here; yes Microsoft is in the process of deprecating kernel mode drivers as part of its current security push, however it’s following Linux and implementing eBPF as a more secure alternative that runs mostly in user land and in a sandbox in kernel space. For the type of thing that this app does, it’s a logical change of direction that does not require the same level of EV code signing.
Microsoft no longer signs Windows drivers for Process Hacker
441–450 of 543 posts
Re: Microsoft no longer signs Windows drivers for Process Hacker
#442Earlier quoted context omitted.
I genuinely miss the days of playing with DOS, Windows 9x and then all the excitement of Windows XP. All on my own hardware, which was whatever I could scrape from parents, savings, neighbours. I could do what I wanted with these old PCs. There was an openness that existed in the world of computing. Despite all that was said of Microsoft back then, and much of the complaints about proprietary software were true then…
I completely agree with your points. > I don't feel the same way towards my garden hose or washing machine. We just built and furnished a remote vacation home from the ground up and the shiny new appliances and even some fixtures (mostly ordered or approved by my wife) default to stubbornly demanding cloud access, often before they will even perform their most basic functions. At the moment, internet is only via 4G h…
Well, when the story began I though this sounds like a pleasant getaway, and I was happy to read you've acquired such a place.
Then the rest of it was just a dour decline. Man, oh man. The worst of it is that all these devices could integrate genuine 'smart' functionality, but a user-respecting way would be locally run from a central box with open and interoperable protocols across devices. Exactly how a router and server works on a LAN. It isn't impossible to design this in a consumer-friendly way either. But the will and the demand just isn't there.
I wonder how these devices will be when the remote servers are inevitably switched off. I learnt this lesson very early on with online games (think GameSpy), the servers are not forever.
What has come over the population? It wasn't that long ago that they burnt identity cards in the UK (at the end of the second world war), the public were glad to see the back of them despite the touted 'benefits' by some politicians. My grandmother shuddered at the thought of giving any financial details online. In the early days, I never used my real name anywhere on the Internet. There is just so much passivity now.
Re: Microsoft no longer signs Windows drivers for Process Hacker
#443The article mentions Process Explorer. Since Sysinternals were bought by Microsoft many years ago and the tools are distributed directly via Microsoft, such tools are unlikely to have an issue being signed. A brief history of the process for those not following it. Originally for kernel-mode drivers, you needed a code signing certificate cross signed by Microsoft's root . This means that the certificate follows a cha…
> This is because most CAs won't issue EV certificates to individuals, even if those individuals happen to have detailed knowledge of cryptography and all the pkcs
.
Honestly the majority of Orgs don't have these chops. There's really no go way to proof anyone.
I think the rationale for Orgs is just that they have more to lose.
Re: Microsoft no longer signs Windows drivers for Process Hacker
#444Earlier quoted context omitted.
Where did they actually do nice things? VSCode is still not entirely open source and the official builds have spyware included.
It's honestly weird to see "Telemetry" labeled as "Spyware" by a technical people that, quite frankly, should know better. Spyware is NOT the same as gathering Telemetry data. You can also just turn off Telemetry in VSCode in the settings. I think a vast majority of people on HN gather data on customer usage of the products that they build. Because it ultimately makes us able to tailor the products better for our cus…
> It's honestly weird to see "Telemetry" labeled as "Spyware" by a technical people that, quite frankly, should know better.
It's precisely because it's technical people who know better that you see "telemetry" labeled as "spyware", which it is, and it's how we called it back in the 1990s/2000s.
The only reason people these days call spyware "telemetry", is because it got normalized by large companies, and is now defended by devs who figure it's better to ship spyware to people than to give a damn and talk with users.
Re: Microsoft no longer signs Windows drivers for Process Hacker
#445Earlier quoted context omitted.
In a future where laws mandate signed software, the only way out is to somehow make our own hardware. We'll never be truly free unless we can manufacture free computers at home just like we can write free software at home. There is no software freedom if the processor refuses to run our code. Right now the chip fabs require billions of dollars in investments in order to make our processors. They are single points of…
Well people have already made decently fast homebrew computers with FPGAs. The problems are threefold: - To what extent do you interop with existing (closed?) hardware, vs trying to recreate the world from scratch. Do you implement usb, pcie, etc, or do you make your own philosophically free equivalent that isn't compatible with existing devices? - In any case you will have to cope with the fact that homebrew CPUs wi…
Personally I think the practical solution is companies like frame.work & valve making open hardware and creating software shims like proton because it's part of their value prop and business model to make open hardware.
If valve doesn't make Linux a viable gaming platform, they are going to be chess maneuvered into a checkmate by MSFT and Apple. Epic recognizes a similar issue too which is why even if they are competitors, they recognize the greater threat and are working together somewhat with Epic porting EAC to Linux & proton.
Re: Microsoft no longer signs Windows drivers for Process Hacker
#446It’s not quite as bad as presented here; yes Microsoft is in the process of deprecating kernel mode drivers as part of its current security push, however it’s following Linux and implementing eBPF as a more secure alternative that runs mostly in user land and in a sandbox in kernel space. For the type of thing that this app does, it’s a logical change of direction that does not require the same level of EV code signi…
Microsoft's eBPF is a very different beast from Linux's eBPF. It is contained to very few subsystems (Currently network, filesystem to come) and doesn't have the same facilities Linux has with dynamic probes to hook arbitrary kernel functions.
Windows also has DTrace, which does support arbitrary kernel hooks, but it requires booting in a special mode with bcdedit /set dtrace ON, which makes it unusable for machines not under your direct control.
None of those give enough visibility in the kernel structures to fully subsume kernel mode drivers. And further, they don't allow some of the advanced capabilities that are provided by things like ProcessHacker, such as killing PPL, forcefully closing remote handles, and a bunch of other stuff that is only possible via a kernel driver.
Re: Microsoft no longer signs Windows drivers for Process Hacker
#447Earlier quoted context omitted.
Ah, I don't really care about telemetry, but their amazing outlook.com SMTP service rejects mail from small senders, and there's no way to successfully appeal. Yeey, brave new megacorp world!
What’s the difference between a small sender and a spam host?
My old university mailbox got migrated to Microsoft, and now people who don't use a professional mail provider (gmail, yahoo, etc..) basically can't send to that address.
We (small devshop + some hosting + self-hosted email) hosted a few things for a foundation for years, and about two years ago they migrated the mail stuff to MS. (We continue to host a few sites, domains, DNS.) Now when they need something and send us an email we can't reply, because our IP is "listed".
Okay, I know spam can be bad, and fine-tuning spam filters is a PITA, so let's go through the delisting process, surely with enough perseverance eventually MS will tolerate us into their graces.
Well, it has been more than a year now, and still no luck.
---
We have completed reviewing the IP(s) you submitted. The following table contains the results of our investigation.
Not qualified for mitigation x.x.x.x Our investigation has determined that the above IP(s) do not qualify for mitigation.
...
¯\_(ツ)_/¯
Re: Microsoft no longer signs Windows drivers for Process Hacker
#448Earlier quoted context omitted.
Honest question: how do those apps know your phone is rooted, and can you still use their websites for equivalent functionality?
The most popular root solutions have a "hide" feature so apps you specify can't tell you are rooted. It is slightly more complicated with custom roms. I have Google Pay and several banking apps on my rooted phone without issue.
Does your phone pass hardware attestation?
Google can make it mandatory at any moment and then you won't be able to "hide" anything.
Re: Microsoft no longer signs Windows drivers for Process Hacker
#449Earlier quoted context omitted.
> And how can grandma get boot time malware at Home? Depending on the demographic, they can: get caught up in during some (possibly unrelated, likely automated) attack, click the wrong ad, or load the wrong common page with JS.
Can you please provide some sources for JS ad-based boot time malware you mentioned that one can get off the web?
Usually JS part it's just exploit that is just a first step. After there is compiled and native "loader" malware that required to setup actual trojan / rootkit.
Re: Microsoft no longer signs Windows drivers for Process Hacker
#450Earlier quoted context omitted.
Microsoft shouldn't rely on this too much honestly. They still have mass, money and maybe an edge but the rest of the world changed, and is potentially ready to pick up the pieces if need be. I thought recent efforts of MS were a sign of wisdom somehow.
...and maybe an Edge? No, they sold out to Google on that already.
unintended pun, gods spoke through me