If IPP is HTTP-based would it be possible to print directly from the brower to the printer, regardless of OS?
That would be kinda cool or am I misunderstanding something?
Windows Protected Print Mode
41–50 of 96 posts
Re: Windows Protected Print Mode
#42What I do not understand is why the print spooler runs as the highest-privileged SYSTEM account. Any vulnerability in the print stack is basically game over. It seems to me that changing this long due and should be possible without dropping support to all old drivers (and printers).
It's hard to underestimate how poor the software coming out of printer manufacturers is.
Re: Windows Protected Print Mode
#43I wonder if this will impact specialized photo and other graphic art printers? Things like the large format Epson and other Pro printers. What about plotters and vinyl cutout printers? They usually have a ton of driver specific settings, etc. for tuning the output. How will these settings be managed without drivers specific to them?
Those kinds of printers aren't used to print things directly from within WinWord.exe though.
Re: Windows Protected Print Mode
#44I read the article and am not sure if this will be implemented in Windows 10 or not. I still use a 20 year old HP laserjet via Vista drivers that install OK for now, will I be forced to get a new printer?
Windows 10 will meet EOL in 2025, which coincides with the ceasing of publishing printer drivers to Windows Update. Anything beyond that likely won't apply since Windows 10 past 2025 will either be out of support or only getting security updates. The key point here is that Microsoft will refuse to WHQL-sign or publish third-party printer drivers from 2027 onwards. Third-party drivers, without WHQL-signing, will conti…
Presumably there exists (or will exist?) a WHQL-signed minidriver that passes any processing step to a userland process?
It is only for resource-constrained machines of the early-1990s that printer-drivers needed any kind of kernel-level access to a system; with IPP and modern USB stacks no-longer needing any kind of kernel module, I'm not seeing how this should be a problem for anyone except domestic spy agencies losing the ability to suppeptiously intercept every printed document.
Re: Windows Protected Print Mode
#45If IPP is HTTP-based would it be possible to print directly from the brower to the printer, regardless of OS? That would be kinda cool or am I misunderstanding something?
[deleted]
Re: Windows Protected Print Mode
#46This is well overdue, the existing situation is dire not just in terms of security but the general quality of software from the printer manufacturers. However this is going to break a lot of existing applications. The printer manufacturers have been laggards when it comes to adopting v4 drivers which date back to Vista.
No doubt manufacturers will us this as an excuse to force users into buying a new model, blaming Microsoft in the process.
I use two printers with “Driverless CUPS” currently. One is 10+ years old HP, and the other is 20+ Xerox.
When done right, you don’t need new printers.
Re: Windows Protected Print Mode
#47If IPP is HTTP-based would it be possible to print directly from the brower to the printer, regardless of OS? That would be kinda cool or am I misunderstanding something?
If your printer for example supports IPP and Postscript or PDF then that would be possible. Higher end (commercial) HP printers usually offer this functionality. Take a look at CUPS [1] if you want to know more about IPP.
Re: Windows Protected Print Mode
#48I wonder if this will impact specialized photo and other graphic art printers? Things like the large format Epson and other Pro printers. What about plotters and vinyl cutout printers? They usually have a ton of driver specific settings, etc. for tuning the output. How will these settings be managed without drivers specific to them?
It's written in the linked article actually, there will be new lower privileged apps that can do this
Re: Windows Protected Print Mode
#49What I do not understand is why the print spooler runs as the highest-privileged SYSTEM account. Any vulnerability in the print stack is basically game over. It seems to me that changing this long due and should be possible without dropping support to all old drivers (and printers).
It goes all the way back to Windows 3.11, where printer drivers often directly fiddled the Centronics parallel port themselves.
The Centronics port is nominally one-way, but it didn't take long for people to realize you could use it for bidirectional communication, thanks to a self-test feature IBM built into the original PC's parallel port adapter, which everybody copied faithfully.
The most famous use was probably "LapLink" which enabled fast file transfer via a special cable.
Printers and their matching drivers used the bidirectional communication to provide mode detailed status information than the single "Paper Out" signal.
And the rest as they say, is a parade of horribles
Re: Windows Protected Print Mode
#50This is a step in the right direction, but IMO not far enough. Printers can (IIUC) cause the client machines to automatically install “printer support apps”, which are like somewhat limited drivers. They do this stuff: https://learn.microsoft.com/en-us/windows-hardware/drivers/d... This includes intercepting the raw XPS data being sent to the printer and modifying it. It looks like these things are lightly sandboxed,…
You very often also need some backchannel from the printer, e.g. for toner levels, available paper sizes, installed options. But there is a more important point:
Printer manufacturers also don't think like this. They desperately want to know what you are printing, order overpriced ink for you, sell additional services like print-by-mail, etc. All that won't work without lots of permissions for the printer support apps.
If it just were about the conversion path (print job, settings) -> (printer data stream), a PDL, filter program and a sandbox would be totally sufficient and nobody would ever need a "printer support app". If a printer needs such an app, it is already using too many privileges anyways, printer support apps should never be needed actually.
Edit: typo.