Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Protected Print Mode

techcommunity.microsoft.com

Post reply on HN
Print view View original

71–80 of 96 posts

Re: Windows Protected Print Mode

#71

Post by whatever1 »

alt227 wrote: post #62
whatever1 wrote: post #56

Question, why the printers cannot act like web servers? Just receive a REST api request and then proceed to do their own thing (aka drive the printer to execute the request). Why my computer needs to know how to operate the printer?

Some problems arise when users print large high resolution images. Printers often dont have the buffer to store it all and so it needs to be sent in chunks/streams etc. There are other examples this is just one.

So basically the blocker is the cost of having a processor and sufficient memory in the printer? Judging from the smartphones the bom of that would be like less than $10?

I saw that a Motorola g play smartphone with MT6765 and 3gb of ram is <$70.

Re: Windows Protected Print Mode

#72

Post by AHTERIX5000 »

woleium wrote: post #20
PopAlongKid wrote: post #4

I read the article and am not sure if this will be implemented in Windows 10 or not. I still use a 20 year old HP laserjet via Vista drivers that install OK for now, will I be forced to get a new printer?

no, but you may need to put a $35 raspberry pi CUPS server on it to turn it into a network printer

And you can even get AirPrint compatibility. My Samsung laser printer driver wasn't working on Apple Silicon anymore (the printer is from 2007) but since CUPS supports it and AirPrint doesn't seem to require too much from a printer I was able to get it working fine with a Pi. And it's handier to use than ever before.

I guess Windows/Android have something similar.

Re: Windows Protected Print Mode

#73

Post by Someone »

phkamp wrote: post #49
janci wrote: post #36

What I do not understand is why the print spooler runs as the highest-privileged SYSTEM account. Any vulnerability in the print stack is basically game over. It seems to me that changing this long due and should be possible without dropping support to all old drivers (and printers).

It goes all the way back to Windows 3.11, where printer drivers often directly fiddled the Centronics parallel port themselves. The Centronics port is nominally one-way, but it didn't take long for people to realize you could use it for bidirectional communication, thanks to a self-test feature IBM built into the original PC's parallel port adapter, which everybody copied faithfully. The most famous use was probably…

> And the rest as they say, is a parade of horribles

The most ‘fun’ of these was when Microsoft marketing came up with the “Plug and Play” (https://en.wikipedia.org/wiki/Legacy_Plug_and_Play), and the engineers had to implement it for this port.

So, you have a port designed so that writing anything to it prints a character, but you somehow have to figure out what (if anything) is attached to it without making a printer attached to it print anything, a CD Writer to write, a hard disk to lock up, etc, with each device possibly having its own devious way of doing two-way communication over that port (by the time Windows 95 came out, how to do that was more or less settled, but users still had tons of old hardware and/or older parallel ports that behaved slightly differently)

If not for the time pressure to ship something, I think it must have been fun to work in the Microsoft department developing that feature with hundreds of obscure parallel port devices.

And of course, it never worked perfectly. How could it? I know people who had a device that erroneously got detected as a tape drive, making ¿Windows NT 4? pop up some dialog for attaching it.

Re: Windows Protected Print Mode

#74

Post by pxx »

tonyedgecombe wrote: post #68
lakpan wrote: post #55

Earlier quoted context omitted.

I wish I knew anything about printing, but why can’t my computer just send a PDF to the printer and have it deal with the details itself? I don’t quite understand the need for the computer to have to get into the nitty gritty other than just sending the source and a JSON. Printers nowadays can handle the printing autonomously (obviously, since they can print via WiFi/bluetooth/pendrive since 2005)

You need the user to select paper trays, simplex or duplex, etc. For bigger devices that might include document finishing options. Label printers might have a guillotine. Print/release where you need a pin at the printer to release the document are becoming more prevalent. All this requires some interaction with the user. IPP Everywhere covers a lot but I'm guessing there will be some niche requirements that it misse…

This happens at a different layer than the printer driver; you just need to modify the postscript.

Paper trays, duplex, duplex with tumble, and cutting are specifiable in postscript; this is `setpagedevice`. Even things like custom stapler options (staple first two pages, etc) can be specified. See something like https://support.hp.com/us-en/document/bpp01888 for docs

Re: Windows Protected Print Mode

#75

Post by Dalewyn »

phkamp wrote: post #49
janci wrote: post #36

What I do not understand is why the print spooler runs as the highest-privileged SYSTEM account. Any vulnerability in the print stack is basically game over. It seems to me that changing this long due and should be possible without dropping support to all old drivers (and printers).

It goes all the way back to Windows 3.11, where printer drivers often directly fiddled the Centronics parallel port themselves. The Centronics port is nominally one-way, but it didn't take long for people to realize you could use it for bidirectional communication, thanks to a self-test feature IBM built into the original PC's parallel port adapter, which everybody copied faithfully. The most famous use was probably…

Worth noting that in true Microsoft fashion, Windows Protected Print Mode will still co-exist with the printer driver subsystem it's supposedly replacing:

>Q: Will Windows prevent installation of new printer drivers?

>A: Windows will continue to allow vendor-supplied printer drivers to be installed via separate installation packages.

My sincere kudos to them, Apple/Google/FOSS would have thrown out the old with no regard.

Re: Windows Protected Print Mode

#76

Post by wslh »

amluto wrote: post #21

This is a step in the right direction, but IMO not far enough. Printers can (IIUC) cause the client machines to automatically install “printer support apps”, which are like somewhat limited drivers. They do this stuff: https://learn.microsoft.com/en-us/windows-hardware/drivers/d... This includes intercepting the raw XPS data being sent to the printer and modifying it. It looks like these things are lightly sandboxed,…

Yes, we played with printing hooking [1] with the XPS Print API. Capturing and modifying the original document.

Source code available.

[1] https://blog.nektra.com/2015/10/20/instrumenting-the-windows...

Re: Windows Protected Print Mode

#77

Post by vel0city »

godzillabrennus wrote: post #24
tonyedgecombe wrote: post #2

This is well overdue, the existing situation is dire not just in terms of security but the general quality of software from the printer manufacturers. However this is going to break a lot of existing applications. The printer manufacturers have been laggards when it comes to adopting v4 drivers which date back to Vista.

I know some folks out there bragging about saving on toner by still repairing an HP LaserJet 2… I can’t see this being an easy transition…

Those LaserJets often already do support LPR and IPP. Some of this is just further pushing tech that's been in Windows since Windows 2000 and deprecating the old stuff.

Re: Windows Protected Print Mode

#78

Post by vel0city »

smallstepforman wrote: post #39

I’ve been printing using IPP with Haiku for years (since no drivers), works well. Good to see Windows finally go down this route as well, since installing crappy printer drivers was always an issue (dealing with vendor crapware).

I've been printing using IPP with Windows for decades. Good to see Haiku finally go down this route as well.

Any printer you've used in Haiku with IPP has worked in Windows with IPP since Windows 2000.

Re: Windows Protected Print Mode

#79

Post by PopAlongKid »

PopAlongKid wrote: post #4

I read the article and am not sure if this will be implemented in Windows 10 or not. I still use a 20 year old HP laserjet via Vista drivers that install OK for now, will I be forced to get a new printer?

In response to these comments, I can only point to the instructions I followed, from this 2016 post[0].

"The HP forums say it’s not possible, but it’s actually pretty easy to do. [...] Windows will try to install it and it will look like it’s installed but it wont actually work. You’ll be able to see it in the device manager as an “unspecified device”, but you wont be able to print."

[0]https://www.davemroz.com/installing-hp-laserjet-1012-windows...

Re: Windows Protected Print Mode

#80

Post by dvdkon »

whatever1 wrote: post #56

Question, why the printers cannot act like web servers? Just receive a REST api request and then proceed to do their own thing (aka drive the printer to execute the request). Why my computer needs to know how to operate the printer?

That's what IPP and IPP Everywhere does, and as far as I know, most modern printers support it, even using it over USB. IIRC it only specifies a common set of print options, so you might need a driver for anything more, but basic printing should "just work".
Post reply on HN