Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Protected Print Mode

techcommunity.microsoft.com

Post reply on HN
Print view View original

51–60 of 96 posts

Re: Windows Protected Print Mode

#51

Post by isilofi »

bayindirh wrote: post #46
ComodoHacker wrote: post #29

Earlier quoted context omitted.

No doubt manufacturers will us this as an excuse to force users into buying a new model, blaming Microsoft in the process.

I use two printers with “Driverless CUPS” currently. One is 10+ years old HP, and the other is 20+ Xerox. When done right, you don’t need new printers.

You just need to buy network-ready printers with native PostScript or PDF support. Then it has always worked.

But most "cheap" (if not accounting for consumables) inkjet crap isn't like that.

Re: Windows Protected Print Mode

#52

Post by isilofi »

godzillabrennus wrote: post #24
tonyedgecombe wrote: post #2

This is well overdue, the existing situation is dire not just in terms of security but the general quality of software from the printer manufacturers. However this is going to break a lot of existing applications. The printer manufacturers have been laggards when it comes to adopting v4 drivers which date back to Vista.

I know some folks out there bragging about saving on toner by still repairing an HP LaserJet 2… I can’t see this being an easy transition…

As long as you can send PS, PCL or PDF to the printer via some "standard" network protocol (IPP, LPD, LPR, JetDirect), the "driver" will just be a PDL file and won't need any special privileges.

Re: Windows Protected Print Mode

#53

Post by rigid »

isilofi wrote: post #50
amluto wrote: post #21

This is a step in the right direction, but IMO not far enough. Printers can (IIUC) cause the client machines to automatically install “printer support apps”, which are like somewhat limited drivers. They do this stuff: https://learn.microsoft.com/en-us/windows-hardware/drivers/d... This includes intercepting the raw XPS data being sent to the printer and modifying it. It looks like these things are lightly sandboxed,…

You very often also need some backchannel from the printer, e.g. for toner levels, available paper sizes, installed options. But there is a more important point: Printer manufacturers also don't think like this. They desperately want to know what you are printing, order overpriced ink for you, sell additional services like print-by-mail, etc. All that won't work without lots of permissions for the printer support app…

> Printer manufacturers also don't thing like this

at this point, what are they gonna do? Not provide windows drivers?

Re: Windows Protected Print Mode

#54

Post by isilofi »

rigid wrote: post #53
isilofi wrote: post #50

Earlier quoted context omitted.

You very often also need some backchannel from the printer, e.g. for toner levels, available paper sizes, installed options. But there is a more important point: Printer manufacturers also don't think like this. They desperately want to know what you are printing, order overpriced ink for you, sell additional services like print-by-mail, etc. All that won't work without lots of permissions for the printer support app…

> Printer manufacturers also don't thing like this at this point, what are they gonna do? Not provide windows drivers?

Provide drivers using the old model and a set of instructions to enable that.

Edit: I guess instructions won't even be necessary, as far as I've understood, there will just be a warning. And users are already trained to just ignore those.

Re: Windows Protected Print Mode

#55

Post by lakpan »

davidjade wrote: post #35

I wonder if this will impact specialized photo and other graphic art printers? Things like the large format Epson and other Pro printers. What about plotters and vinyl cutout printers? They usually have a ton of driver specific settings, etc. for tuning the output. How will these settings be managed without drivers specific to them?

I wish I knew anything about printing, but why can’t my computer just send a PDF to the printer and have it deal with the details itself? I don’t quite understand the need for the computer to have to get into the nitty gritty other than just sending the source and a JSON. Printers nowadays can handle the printing autonomously (obviously, since they can print via WiFi/bluetooth/pendrive since 2005)

Re: Windows Protected Print Mode

#56

Post by whatever1 »

Question, why the printers cannot act like web servers? Just receive a REST api request and then proceed to do their own thing (aka drive the printer to execute the request). Why my computer needs to know how to operate the printer?

Re: Windows Protected Print Mode

#57

Post by FirmwareBurner »

phkamp wrote: post #49
janci wrote: post #36

What I do not understand is why the print spooler runs as the highest-privileged SYSTEM account. Any vulnerability in the print stack is basically game over. It seems to me that changing this long due and should be possible without dropping support to all old drivers (and printers).

It goes all the way back to Windows 3.11, where printer drivers often directly fiddled the Centronics parallel port themselves. The Centronics port is nominally one-way, but it didn't take long for people to realize you could use it for bidirectional communication, thanks to a self-test feature IBM built into the original PC's parallel port adapter, which everybody copied faithfully. The most famous use was probably…

>It goes all the way back to Windows 3.11, where printer drivers often directly fiddled the Centronics parallel port themselves.

I know a large bank who had a well paid dev on the payroll who's job was exclusively reverse engineering, patching and writing windows printer drivers so their old specialized institutional printers could keep working on modern Windows because the printer manufacturer would not publish newer drivers.

Printing is still a very important part of many wealthy legacy industries which explains why there's so much fuss around it.

Re: Windows Protected Print Mode

#58

Post by pjmlp »

whatever1 wrote: post #56

Question, why the printers cannot act like web servers? Just receive a REST api request and then proceed to do their own thing (aka drive the printer to execute the request). Why my computer needs to know how to operate the printer?

This is basically how Laserprints with Postcript work, UNIX classical printing was nothing more than sending a Postscript file over the network to the printer, turns out not everyone wants to pay the prices they usually have.

Re: Windows Protected Print Mode

#59

Post by pjmlp »

lakpan wrote: post #55
davidjade wrote: post #35

I wonder if this will impact specialized photo and other graphic art printers? Things like the large format Epson and other Pro printers. What about plotters and vinyl cutout printers? They usually have a ton of driver specific settings, etc. for tuning the output. How will these settings be managed without drivers specific to them?

I wish I knew anything about printing, but why can’t my computer just send a PDF to the printer and have it deal with the details itself? I don’t quite understand the need for the computer to have to get into the nitty gritty other than just sending the source and a JSON. Printers nowadays can handle the printing autonomously (obviously, since they can print via WiFi/bluetooth/pendrive since 2005)

Business laserprinters were always like that in regards to Postscript, followed by PDF, assuming your wallet is confortable with it.

Re: Windows Protected Print Mode

#60

Post by rini17 »

davidjade wrote: post #35

I wonder if this will impact specialized photo and other graphic art printers? Things like the large format Epson and other Pro printers. What about plotters and vinyl cutout printers? They usually have a ton of driver specific settings, etc. for tuning the output. How will these settings be managed without drivers specific to them?

Their manufacturers have better incentive to provide quality drivers. For models after EoL there's always the "an old machine, dedicated, not connected to network" solution.
Post reply on HN