Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft no longer signs Windows drivers for Process Hacker

borncity.com

Post reply on HN
Print view View original

251–260 of 543 posts

Re: Microsoft no longer signs Windows drivers for Process Hacker

#251

Post by zahllos »

my123 wrote: post #176
zahllos wrote: post #151

Earlier quoted context omitted.

There are two sides to this coin. Firstly there's the hardware vendors who make firmware, who decided to incorporate UEFI presumably because intel pushed it hard (original efi booted itanium and is also found in older Macs). But it was certainly possible for a Linux vendor to have got a key into the kek and dB lists: https://mjg59.dreamwidth.org/12368.html That's from Matthew Garrett, who along with Peter Jones, were…

> Microsoft's ARM hardware _is_ locked down with no such options That was for 32-bit Windows on Arm hardware. 64-bit Windows on Arm laptops/tablets have unlockable Secure Boot, with a regular SETUP interface and all.

That's really good news and I'm glad they decided to do that.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#252

Post by matheusmoreira »

Arisaka1 wrote: post #89
eps wrote: post #25

In related news - ever wondered why Windows 11 can't be installed on "older computers"? You know, the ones that don't have a TPM chip? Now you know. Windows 11 completes the lock-up of the OS. That's why Windows 11 exists in the first place. All other changes are secondary. Microsoft knows they would've not been able to pull shit like this as a Windows 10 update, so they were effectively forced to do a version increa…

I saw the writing on the wall the moment they could sloppily justify the TPM requirement. Then I got into arguments with people proclaiming that it's just Microsoft enforcing it for the casual user's safety, and that I'm a Microsoft hater. Who? Me, whose first programming language was C#, who worked as an Windows server administrator for years, and my operating systems have been nothing than Windows for 2 decades. An…

The issue isn't the TPM, it's who owns the keys to the machine. If the user configures their own keys, it becomes an empowering technology that allows them to verify their boot process hasn't been tampered with. If Microsoft owns the keys, they own the computer and the technology becomes their means of control over the user. They will use this technology to oppressively deny the user their software freedom while simultaneously extracting rent out of any developer who wants to reach that person.

Those who own the keys own the machine. We must ensure we are the ones holding the keys at all times or suffer the consequences.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#253

Post by 2OEH8eoCRo0 »

Are there TPMs where the user has more control and can configure w/ a root password to control keys? I like the idea of a secure tamper resistant security device but I don't like that the owner of the PC does not retain absolute control over this device.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#254

Post by DeathArrow »

ryanlol wrote: post #153
zigzag312 wrote: post #129

Earlier quoted context omitted.

I find it interesting that, one one hand they are implementing features "in the name of security" that limit the owner of a computer what he/she can do with it and on the other hand they are adding backdoors so that government agencies (or anyone with right information) can spy on citizen that use this "secure" OS.

I will personally pay you twenty thousand US dollars (in the cryptocurrency of your choice, bank transfer, western union, whatever) if you can prove beyond reasonable doubt that Microsoft has ever secretly shipped a backdoor in their OS so government agencies could spy on their users. Perhaps you will be the first person to actually prove the existence of the NSAKEY backdoor? (I doubt it.)

What about this old NSA backdoor? https://en.wikipedia.org/wiki/Dual_EC_DRBG

If MS or Apple or Google or some hardware makers or some communication equipment makers have some backdoors for NSA, why would you think they would do such a poor job that anyone can pay $20k to prove it?

Re: Microsoft no longer signs Windows drivers for Process Hacker

#255

Post by saganus »

matheusmoreira wrote: post #240
dTal wrote: post #53

Earlier quoted context omitted.

"Dan would eventually find out about the free kernels, even entire free operating systems, that had existed around the turn of the century. But not only were they illegal, like debuggers—you could not install one if you had one, without knowing your computer's root password. And neither the FBI nor Microsoft Support would tell you that." --Richard Stallman, "The Right To Read"

In a future where laws mandate signed software, the only way out is to somehow make our own hardware. We'll never be truly free unless we can manufacture free computers at home just like we can write free software at home. There is no software freedom if the processor refuses to run our code. Right now the chip fabs require billions of dollars in investments in order to make our processors. They are single points of…

But even if you can somehow make your own hardware, how long until governments start requiring interaction with certain services (health, banking, taxes, etc) be signed by an _approved_ OS/processor combo?

Imagine tax software (comercial or gov provided) refusing to work unless you use an OS with TPM support for "security reasons".

Or even worse, what would happen if gov regulations started requiring ISPs to stop working with non-compliant hardware? I.e. something like requiring network devices to attest they are "oficially" approved before allowing to connect?

I don't think this will happen any time soon (hopefully) but I can see how even making your own hardware might no be enough.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#256

Post by DeathArrow »

slaymaker1907 wrote: post #165
schmorptron wrote: post #114

Earlier quoted context omitted.

Does a TPM chip actually bring any relevant security advantages for end users, or is it just for DRM?

It brings enormous security benefits to end users. TPMs drastically reduce entropy/complexity requirements for things like passwords/pins since the TPM can rate limit guess attempts. Doing that without a TPM is impossible since an attacker can always read the encrypted password off of the drive/directly from memory and then brute force it.

HDD content can be encripted without storing the password anywhere, without a TPM. If the ecryption algorithm is decent, good luck waiting billions of years to bruteforce, even with the next gen hardware.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#257

Post by broodbucket »

blep-arsh wrote: post #211
broodbucket wrote: post #147

Earlier quoted context omitted.

I'm not saying those things aren't important, but they don't warrant the outright dismissal that I was replying to. Linux has an obvious lack of contribution from designers, designers are employed for products, noone is making money selling desktop Linux as a product. Also, most designers aren't tinkering with open source software alternatives in their free time like developers do. I also feel like I'm missing someth…

Honestly, I think the entire situation where we have multiple DEs/toolkits/video drivers/window managers/input methods is unmaintanable. It would be likely unmaintanable even for a well-funded corporation.

If there was a well-funded corporation, they would naturally focus on their stack of choice. I think that's what Red Hat does, focusing most of their desktop stuff on GNOME.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#258

Post by DeathArrow »

watermelon0 wrote: post #78
eps wrote: post #25

In related news - ever wondered why Windows 11 can't be installed on "older computers"? You know, the ones that don't have a TPM chip? Now you know. Windows 11 completes the lock-up of the OS. That's why Windows 11 exists in the first place. All other changes are secondary. Microsoft knows they would've not been able to pull shit like this as a Windows 10 update, so they were effectively forced to do a version increa…

Or maybe this is related to the security, and Windows is the only widely used platform that didn't enforce TPM until recently? macOS is even more locked down, but they don't impede or force users to use Mac App Store.

>macOS is even more locked down, but they don't impede or force users to use Mac App Store.

Until now. And because it faced competition from Windows. If they gain some market share, they will.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#259

Post by yjftsjthsd-h »

shawnz wrote: post #249
ChuckNorris89 wrote: post #234

Earlier quoted context omitted.

>And in fact Secure Boot does protect against Grandma being infected by boot-time malware. And how can grandma get boot time malware at Home? IIRC those were common back in the days when people were plugging in infected floppy disks or thumb drives everywhere and you'd try to boot off them. Can't remember last time I saw this type of malware in the wild as phishing and ransomware is a lot more profitable for maliciou…

> Can't remember last time I saw this type of malware in the wild. That's exactly because widespread secure boot has made it impractical! As for niche Linux distros, it's been mandated since the beginning that you can install your own Secure Boot keys on Microsoft certified desktop platforms.

That branch of malware was already rare when uefi secure boot was introduced.

> it's been mandated since the beginning that you can install your own Secure Boot keys on Microsoft certified desktop platforms.

...on x86; on ARM they mandated that the user couldn't install their own keys, which shows that they will lock users out as much as they think they can get away with.

Re: Microsoft no longer signs Windows drivers for Process Hacker

#260

Post by DeathArrow »

Jensson wrote: post #143
neilalexander wrote: post #97

Earlier quoted context omitted.

Apple could have done it with the Apple Silicon transition and yet didn’t. More inclined to believe actions over words at this point.

Not without massive loss of users. Both Microsoft and Apple would love to lock down their platforms, but they have to do it in tandem or users will flock to the other. So we will see a slow lock-in creep until they look like current day smartphones. Only way to stop this is to react strongly, so if most users are apathetic like you then it is inevitable. Of course I believe that you are right and most are this apathe…

>So we will see a slow lock-in creep until they look like current day smartphones.

So we will see the rise on Linux on the desktop.

Post reply on HN