Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Protected Print Mode

techcommunity.microsoft.com

Post reply on HN
Print view View original

21–30 of 96 posts

Re: Windows Protected Print Mode

#21

Post by amluto »

This is a step in the right direction, but IMO not far enough. Printers can (IIUC) cause the client machines to automatically install “printer support apps”, which are like somewhat limited drivers. They do this stuff:

https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

This includes intercepting the raw XPS data being sent to the printer and modifying it.

It looks like these things are lightly sandboxed, but that’s not enough. These apps get access to extremely sensitive data, and they should be very sandboxed. IMO it should have input access to the document and printer settings, output access to what gets printed, and that’s it. No network, no storage, no Windows API, etc. Think wasm-style sandboxing.

But I don’t think MS thinks like this.

Re: Windows Protected Print Mode

#22

Post by charcircuit »

binkHN wrote: post #14

Looks like all printers will need to be Mopria certified, which is the first time I've heard of this certification: https://mopria.org/certified-products

From the comment section it appears that it just needs to support the mopria standard. There is no requirement that it is actually certified.

Re: Windows Protected Print Mode

#23

Post by kmeisthax »

binkHN wrote: post #14

Looks like all printers will need to be Mopria certified, which is the first time I've heard of this certification: https://mopria.org/certified-products

Mopria is a certification program for / dialect of IPP[0]. Same thing with AirPrint, which is the iOS equivalent. Pretty much every printer made in the last decade speaks enough IPP to network print on at least iOS and Android; Microsoft is just leveraging that to seal HP's garbage code out of the spooler process.

[0] https://en.wikipedia.org/wiki/Internet_Printing_Protocol

Re: Windows Protected Print Mode

#24

Post by godzillabrennus »

tonyedgecombe wrote: post #2

This is well overdue, the existing situation is dire not just in terms of security but the general quality of software from the printer manufacturers. However this is going to break a lot of existing applications. The printer manufacturers have been laggards when it comes to adopting v4 drivers which date back to Vista.

I know some folks out there bragging about saving on toner by still repairing an HP LaserJet 2… I can’t see this being an easy transition…

Re: Windows Protected Print Mode

#25

Post by Dalewyn »

londons_explore wrote: post #3

Can we just remove all printing functionality from the OS? Printers are mostly networked in today's world. And the OS usually isn't involved when an application wants to talk to another device on the network beyond TCP connections etc. Just get the application to (using a library), connect directly to the printer, submit its job, show status, and disconnect when done.

>Printers are mostly networked in today's world.

I never connect printers directly to the network because their firmware/OS are all flaming pieces of garbage with terrible UIs and conventions. In my house, all network printers are connected to the home server (running Windows Server) and it's the home server that actually deals with presenting the printers to the network.

The time and nerves I've saved by having an actual, proper operating system handle the networking is immeasurable.

Re: Windows Protected Print Mode

#28

Post by Dalewyn »

PopAlongKid wrote: post #4

I read the article and am not sure if this will be implemented in Windows 10 or not. I still use a 20 year old HP laserjet via Vista drivers that install OK for now, will I be forced to get a new printer?

Windows 10 will meet EOL in 2025, which coincides with the ceasing of publishing printer drivers to Windows Update. Anything beyond that likely won't apply since Windows 10 past 2025 will either be out of support or only getting security updates.

The key point here is that Microsoft will refuse to WHQL-sign or publish third-party printer drivers from 2027 onwards.

Third-party drivers, without WHQL-signing, will continue to be installable past 2027 on the provided timeline if the manufacturer provides them.

Re: Windows Protected Print Mode

#29

Post by ComodoHacker »

tonyedgecombe wrote: post #2

This is well overdue, the existing situation is dire not just in terms of security but the general quality of software from the printer manufacturers. However this is going to break a lot of existing applications. The printer manufacturers have been laggards when it comes to adopting v4 drivers which date back to Vista.

No doubt manufacturers will us this as an excuse to force users into buying a new model, blaming Microsoft in the process.
Post reply on HN