Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft no longer signs Windows drivers for Process Hacker

borncity.com

Post reply on HN
Print view View original

461–470 of 543 posts

Re: Microsoft no longer signs Windows drivers for Process Hacker

#461

Post by will4274 »

josephcsible wrote: post #455
will4274 wrote: post #432

Earlier quoted context omitted.

> the owner of the PC does not retain absolute control over this device. This is a bit FUD-y. TPMs are key stores, the same as what Apple calls a "secure enclave." When you activate a device with a service like Netflix or a software like Windows, they stick their key in the TPM. As a user you can clear of disconnect the TPM any time you like - you're in control of your device. What you're not in control of is Netflix…

The fact that, by design, you (the owner) can't make the TPM give you all of its secret keys, means that you don't have control over your device.

Does it? I can't make my microwave work with the door open either. The whole "point" of a TPM is that the user can create, use, and delete keys inside of it, with the promise that the keys won't come out. TPMs are just smart cards. Would you say that you don't have control over a smart card because you can't get the keys out of it? I'd say I DO have control over the smartcard, because I authorize and de-authorize the keys held within, and the whole point of a smartcard is to permit authorization of a physical entity, which requires the physical entity to resist leaking its keys.

To me, operating with a well designed model, when and if I choose, with the ability for me to shut it down at any time - that's control.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#462

Post by _8j50 »

ogurechny wrote: post #82

Keep in mind this has happened because people agreed that they can't (normally) run code not singed by someone else (Microsoft) on their own system for “security” reasons. Well, it was not security, it actually was a way to keep keys to themselves, and hold the user system as a hostage. And it has been explained many times by many people. If you care about software freedoms, even just a tiny bit, you wouldn't touch “…

That is blatant false-dichotomy. You don't need to undermine the immense level of security improvement introduced by driver signing. Kernel mode rootkits are very hard to detect and eradicate. Right now, windows kernel mode rootkits rely on exploiting vulnerable drivers (very easy to detect when vulnerable drivers are loaded). It's not just signing but MS requiring valudation. If only Linux distros required this by default (with a boot option to turn off validation).

If you wouldn't touch Microsoft open source but you would touch Google open source (say Chrome or their contributions to the Linux kernel), I would love to hear how that is different. Personally, the software I use is not a matter of ideology but a matter if the best tool for the task at hand. But your observation on how MS is using adversarial compatibility against Linux (flipping the table) is correct. I just don't see how post-systemd gnu/linux is all that different, perhaps because it is many megacorps contributing and controlling Linux? It's not exactly driven by software freedom anymore.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#463

Post by _8j50 »

29athrowaway wrote: post #335
ogurechny wrote: post #82

Keep in mind this has happened because people agreed that they can't (normally) run code not singed by someone else (Microsoft) on their own system for “security” reasons. Well, it was not security, it actually was a way to keep keys to themselves, and hold the user system as a hostage. And it has been explained many times by many people. If you care about software freedoms, even just a tiny bit, you wouldn't touch “…

The user wants convenience, and then, under the premise of convenience, corporations create systems that give them the convenience they want in exchange for their privacy and freedom. Being spied on, having forced updates, a remote kill switch on your computer, "telemetry", advertisement, and the best of all: your government being bullied and lobbied on with the money you paid... it is all worth it because you can ru…

Usability triumphs everything. Even privacy. Either pass pro-consumer laws or compete with them using free alternatives. Why do you expect a corporation to care about your privacy or well being? They would be using small children, paying them a loaf of bread a week making it illegal to not do business with them if they could. People have rights and equality before the law , corporations not so much.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#464

Post by seltzered_ »

my123 wrote: post #55
urthor wrote: post #37

Earlier quoted context omitted.

Very informative. And presumably on OSX none of this applies because it's all BSD underneath? Or is OSX different again to just running BSD out of the box?

On macOS, you have those options: - SIP off (totally, or just driver signature enforcement) - kernel driver (deprecated, Apple doesn’t issue new certs anymore it seems) - system extension (user-mode driver, explicitly intended for device compatibility)

Also, if there is non-profit org work, recall that one can supposedly setup an organization and request a developer fee waiver: https://developer.apple.com/support/membership-fee-waiver/

(no idea how this actually works in practice, wonder if one could wrap open source work under a non-profit organization)

Re: Microsoft no longer signs Windows drivers for Process Hacker

#465

Post by KatrKat »

zahllos wrote: post #151
hvdijk wrote: post #66

Earlier quoted context omitted.

> Microsoft have their keys in the default keychain because they bothered to be involved in the process, unlike linux companies like Redhat. The status quo was that systems could boot any operating system the user wanted. Microsoft tried to force OEMs to lock operating systems other than those on a very short list (they tried to force Secure Boot to be enabled with no way for users to turn it off, and you can confirm…

There are two sides to this coin. Firstly there's the hardware vendors who make firmware, who decided to incorporate UEFI presumably because intel pushed it hard (original efi booted itanium and is also found in older Macs). But it was certainly possible for a Linux vendor to have got a key into the kek and dB lists: https://mjg59.dreamwidth.org/12368.html That's from Matthew Garrett, who along with Peter Jones, were…

> I don't believe any entirely locked down firmware ever made it into any x86 board.

There are some Android x86 devices that won't boot unsigned firmware and won't let you change the signing keys. But I've only seen that in non-BIOS, non-UEFI devices.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#466

Post by rossy »

ddingus wrote: post #369
matheusmoreira wrote: post #245

Earlier quoted context omitted.

No, Stallman was right about pretty much everything. It's impressive how far into the future he saw, much earlier than many of us, including myself. There is no computing freedom without software freedom, and there is no software freedom without hardware freedom. Control of data is a related problem. It's absolutely relevant but it's not in any way opposed to computing freedom. In fact, they are aligned. Computing fr…

Exactly right. The move to ARM will highlight the hardware freedom in a big way. People are used to ARM being different and are that much more likely to forget open, general purpose computing right along with that "old" x86... Heh, I always disliked x86. But now? I look at it fondly. Strange times. Edit: It is the IBM PC lineage I speak of here, not just the ISA.

No, I don't think it will. I hate this trend of pretending that our relative freedom on PCs has anything to do with the platform. Our freedom on UEFI Secure Boot PCs was hard fought and could be taken away at Microsoft's whim*. They literally hold the keys.

Remember the drama about whether Linux would be allowed to run under Secure Boot at all? That was last decade's reminder about hardware freedom and it had nothing to do with a new ISA. Thankfully Microsoft graciously decided that all Windows 8 logo hardware should allow users to load their own keys, but there's nothing intrinsic about the PC platform that forced them to make that decision, and nothing forcing them to keep it.

* This Ars article seems to say it's already been taken away. I'm trying to confirm Microsoft's current UEFI requirements in their docs, but I can't find them. https://arstechnica.com/information-technology/2015/03/windo...

Re: Microsoft no longer signs Windows drivers for Process Hacker

#467

Post by marcosdumay »

cromka wrote: post #370
ptx wrote: post #362

Earlier quoted context omitted.

What if you repeatedly fail to anonymize the information and also collect user-entered data like command line arguments? https://github.com/dotnet/sdk/issues/6145

Well, you make my point. What you linked to is definitely not telemetry.

> What you linked to is definitely not telemetry.

So, the OP was correct in calling it just spyware?

Why do people jump into defending corporations that repeatedly abuse their customers when they do unknowable hidden actions?

Re: Microsoft no longer signs Windows drivers for Process Hacker

#468

Post by samplatt »

ogurechny wrote: post #107
zahllos wrote: post #23

The article mentions Process Explorer. Since Sysinternals were bought by Microsoft many years ago and the tools are distributed directly via Microsoft, such tools are unlikely to have an issue being signed. A brief history of the process for those not following it. Originally for kernel-mode drivers, you needed a code signing certificate cross signed by Microsoft's root . This means that the certificate follows a cha…

qBittorrent developers just said fuck it three years ago, and let the world burn with unsigned installer. I suggest everyone to join the civil disobedience. If you don't, you'll soon find out you can't run your programs.

I was wondering about that. Every update when it says it's unsigned I get really nervous and triple-check the source and monitor traffic during the install.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#469

Post by cma »

ryanlol wrote: post #342
cma wrote: post #172

Earlier quoted context omitted.

> but they don't impede or force users to use Mac App Store. They briefly pulled Epic's desktop signing keys, which they promised were for security only, over an unrelated iOS business dispute.

This is a terribly dishonest take. There was no “unrelated iOS business dispute”, Epic was simply using their keys to sign software that they had agreed not to sign. Epic made it clear that they can not be trusted with signing keys, you can’t claim that this is unrelated. Epic could have sued Apple and proceeded with their business dispute without abusing their signing keys, but instead they made a calculated decisio…

> Epic was simply using their keys to sign software that they had agreed not to sign.

Epic never abused their desktop signing keys, which are stated to be for security only, what are you talking about?

Apple did more than that too, they also briefly pulled their Apple logins, which they had surprise mandated on everyone who allowed third party logins. They went full mask off.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#470

Post by dane-pgp »

Wowfunhappy wrote: post #123
watermelon0 wrote: post #78

Earlier quoted context omitted.

Or maybe this is related to the security, and Windows is the only widely used platform that didn't enforce TPM until recently? macOS is even more locked down, but they don't impede or force users to use Mac App Store.

macOS still runs on Intel Macs without a T2 chip, if that’s the TPM-equivalent you’re thinking of.

The first Mac with a T2 chip was the iMac Pro 2017, and that product line was discontinued as of March 5, 2021. Does Apple still sell machines without an equivalent level of TPM?

For what it's worth, it looks like macOS tends to support hardware that's up to 7 years old[0] and macOS versions tend to stay supported for about 3 years[1].

My guess is that by 2027, all Windows and macOS releases for non-enterprise users will either require a TPM or be out of security support, and governments will start banning the latter versions from accessing the internet.

[0] https://www.macworld.co.uk/feature/what-version-macos-compat...

[1] https://en.wikipedia.org/wiki/MacOS_Mojave

Post reply on HN