Live data from Hacker News

Microsoft no longer signs Windows drivers for Process Hacker

borncity.com

451–460 of 543 posts

Re: Microsoft no longer signs Windows drivers for Process Hacker

#451

Earlier quoted context omitted.

They've always been acting as a strong monopolistic corporation with a "fuck you" attitude. Here's a summary of Microsoft attitude these part 5 years: - rebrand as open-source friendly, only open-source whatever narrow side-projects they barely care about but could be run on other systems (VSCode, Powershell); distribute official packages with spyware - monopolize the education system by offering bribes including gra…

LOL @ "narrow side-projects" such as VSCode and Powershell ?

Yup, we're still far from having open source Windows, Active Directory, SQL Server, Teams, Github, Office... or any "central" product essential to their business offers.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#452

Earlier quoted context omitted.

> Apple doesn’t issue new certs anymore it seems This is not true. kexts are still signed by apple after being submitted and vetted.

Apple deprecated KEXTs[1], but still signs some .kexts they've chosen to grandfather in like macFUSE. [1] https://developer.apple.com/support/kernel-extensions/

Kexts are not deprecated in general-- only kexts that use deprecated KPIs are deprecated. (The page you link is the list of deprecated KPIs.)

The net effect of this: if something can be done using a System Extension rather than a kernel extension, you'll get deprecation warnings if you try to do it with a kernel extension. Kernel extension points that have not been replaced yet are still valid, will still be signed if used, and will still run on current versions of macOS.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#453
One of the comments from the comment thread below the linked post, it's a rant and I don't like the tone but it sums up well some of the reasons why me and a few colleagues recently decided to switch to Linux:

> Dave-o says:

> 2021-10-24 at 23:45

> Notice how it's now virtually impossible to disable Windows Defender nowadays? Libvirt is also having trouble getting Microsoft to cert their drivers. Etc, etc etc. Who gave them the right to limit our freedom to run what we want on our computers?

> Reviews about Windows 11 at formerly-credible websites like http://www.arstechnica.com & http://www.thevirge.com, etc are so pathetic, "oh the new toolbar! But mah techichial anayasis is that there are some old dialogs still in control panel! I wants mah new eye-candys!". And their sycophantic commenters are vastly worse.

> Truth is, Microsoft's strategy may have been FUD in the past but now it's evolved to 'slowly tighten the noose'. The reason I liked Windows was my ability to audit it. At least someone should be able to. Now with hardware-enabled DRM secure envelopes & encrypted memory regions, that is becoming impossible. Which is exactly their plan.

> Because, you see, Microsoft wants to become like Apple: "We respect your privacy; your secrets are between just you and us." Do you trust there's no and will be no future Microsoft-only back-doors in the Windows Firewall? Really?

> Who actually owns your machine? Can you actually stop your iPhone from updating? Nope. In the past I tried and their upgrade permanently broke some CAD apps I heavily relied on. And there's no way back, baby. The content I created? poof

> It used to be more a Facebook / Google thing. Post on social, they have a permanent free license to use your content and treat it however they like. All corporations are liable to their shareholders if they don't maximize profits. Why are these guys so insanely profitable? What do they actually create? They're all just leaches on our data.

> SO, either get used to the 'brave' new world: mega-corporation$ & the government own your most intimate personal information and control the devices you rely on. Or switch to linux and at least have a prayer of someone keeping the software you rely on honest by auditing it. Just someone having the ability to see what's going on inside that secure-enclave hiding in your computer is enough of a threat to keep them honest.

> These days, most folks live in their browser. Maybe play some games. Install Kubuntu and run firefox and most Windows users will barely be able to tell the difference. Getting Windows running inside a QEMU virtual machine isn't really that difficult. At least that way you have a way of firewalling Windows that's outside of Microsoft's control. It's a bit more tricky for mom but is becoming more turn-key & productized all the time.

> Linux Wine is coming along nicely. The day is fast approaching when Windows games will run great directly on Linux. Steam Deck will push this over the curve and it's all down-hill from there. Why prioritize targeting Windows when Linux becomes a large market? Multi-platform is kinda ugly but it's a thing. All other things being equal (usability, compatibility, etc) consumers will always opt for more privacy and control. And this is the way out of this privacy & control mess.

> With IPFS and distributed platform tech so close, the new future will be the public ridding themselves of these menaces both for social and their personal devices. At least I hope so.

> /rant

Re: Microsoft no longer signs Windows drivers for Process Hacker

#454

Are there TPMs where the user has more control and can configure w/ a root password to control keys? I like the idea of a secure tamper resistant security device but I don't like that the owner of the PC does not retain absolute control over this device.

Even if your TPM lets you control the keys, how do you know it doesn't have a set of secret keys known to the manufacturer and/or government?

If you're using these keys as part of a disk encryption scheme, you may find that your government deems this to be an illegal attempt to prevent yourself from complying with search warrants (even if you're not suspected of any other crime).

Re: Microsoft no longer signs Windows drivers for Process Hacker

#455

Are there TPMs where the user has more control and can configure w/ a root password to control keys? I like the idea of a secure tamper resistant security device but I don't like that the owner of the PC does not retain absolute control over this device.

> the owner of the PC does not retain absolute control over this device. This is a bit FUD-y. TPMs are key stores, the same as what Apple calls a "secure enclave." When you activate a device with a service like Netflix or a software like Windows, they stick their key in the TPM. As a user you can clear of disconnect the TPM any time you like - you're in control of your device. What you're not in control of is Netflix…

The fact that, by design, you (the owner) can't make the TPM give you all of its secret keys, means that you don't have control over your device.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#456

Earlier quoted context omitted.

Google provides attestation and it's a constant cat-and-mouse game that the rooters are usually losing. Websites can't tell, but lots of companies don't provide equivalent functionality via website. I know I can't upload check images for remote deposit unless I use the native banking app.

It's called SafetyNet [1] What irked me is sometime app developers are abusing it without asking themself "Does this app really need to check for rooted phones at all?" I'm okay if banks apps are using that. But why does fast foods apps need to use that? Most people that I know are paying with cash when they order foods online (and you can't hack paper money with rooted android phones). [1] https://developer.android.…

Here's a question I'd love for Google to answer: why do you need their special blessing to be able to make a file manager app, but not an app that uses SafetyNet?

Re: Microsoft no longer signs Windows drivers for Process Hacker

#457

Earlier quoted context omitted.

> Imagine tax software (comercial or gov provided) refusing to work unless you use an OS with TPM support for "security reasons". > I don't think this will happen any time soon (hopefully) but I can see how even making your own hardware might no be enough. This already happened in Android, at least where I lives (Indonesia). Most of Banks, Government Services, and freaking McDonald's apps will refuse to run if your p…

Honest question: how do those apps know your phone is rooted, and can you still use their websites for equivalent functionality?

Presumably a website could support WebAuthn and require you log in using a "Platform Authenticator" like Windows Hello.[0] One way or another, websites will end up requiring that only "secure" devices access them (preferably disclosing a unique serial number registered to them).

[0] https://www.hypr.com/platform-authenticator/

Re: Microsoft no longer signs Windows drivers for Process Hacker

#458
post #445

Earlier quoted context omitted.

Well people have already made decently fast homebrew computers with FPGAs. The problems are threefold: - To what extent do you interop with existing (closed?) hardware, vs trying to recreate the world from scratch. Do you implement usb, pcie, etc, or do you make your own philosophically free equivalent that isn't compatible with existing devices? - In any case you will have to cope with the fact that homebrew CPUs wi…

Personally I think the practical solution is companies like frame.work & valve making open hardware and creating software shims like proton because it's part of their value prop and business model to make open hardware. If valve doesn't make Linux a viable gaming platform, they are going to be chess maneuvered into a checkmate by MSFT and Apple. Epic recognizes a similar issue too which is why even if they are compet…

> I think the practical solution is companies like frame.work & valve making open hardware and creating software shims like proton

Right. I admire them certainly, and I'm thinking about getting a framework laptop myself, but we shouldn't really call their products free/open hardware because they use backdoored CPUs from Intel/AMD

Re: Microsoft no longer signs Windows drivers for Process Hacker

#459
post #394

Earlier quoted context omitted.

They wanted feature parity with MacOS' ability to hide processes from the user.

So basically running rootkits. So MS from spyware company has evolved to malware. Keep up the good work.

If you are worried about MS running rootkits on Windows, then I got some worrisome news for you.....

Re: Microsoft no longer signs Windows drivers for Process Hacker

#460

Earlier quoted context omitted.

Google provides attestation and it's a constant cat-and-mouse game that the rooters are usually losing. Websites can't tell, but lots of companies don't provide equivalent functionality via website. I know I can't upload check images for remote deposit unless I use the native banking app.

It's called SafetyNet [1] What irked me is sometime app developers are abusing it without asking themself "Does this app really need to check for rooted phones at all?" I'm okay if banks apps are using that. But why does fast foods apps need to use that? Most people that I know are paying with cash when they order foods online (and you can't hack paper money with rooted android phones). [1] https://developer.android.…

> I'm okay if banks apps are using that.

I'm not okay with it, to be honest. It's my money, and I trust a rooted LineageOS with it much more than I trust the default firmware of most phones. Besides, my bank lets you do the same operations from their website that you can do with the app, so in my case it's pure inconvenience, not security.

Post reply on HN