4 ms·

Yet another reason why centralized code signing is anti-user and a net negative. You should be able to easily install anything you want on your computer.

jeffhou 6y ago
Allowing unsigned drivers to be installed by the general user base seems more anti-user, no? My naive understanding is that drivers are low-level and thus malicious drivers would have more net negative impact on an unsuspecting non-technical user (relative to a piece of malicious non-driver code).
- pak9rabid 6y ago
  Not to mention that if a user really wants to, they can install unsigned drivers.
acdha 6y ago
> You should be able to easily install anything you want on your computer. This is the same as stating that you prefer many orders of magnitude more users to have unstable or insecure systems because they use products by a negligent vendor or are conned. That's hardly “anti-user” by any metric which covers mainstream users. To me, this is an argument that code signing systems need to be tightly regulated to prevent abusing the system for reasons other than quality testing and accurate labeling.
dcuthbertson 6y ago
Well, Msft attempts to use HCK/HLK to help ensure that the drivers out there are more stable. Once upon a time, there was no signing and some drivers caused the very unfriendly BSOD and Msft got the blame. There are a lot fewer of those today than there were before Msft insisted upon testing/signing things.
- intsunny 6y ago
  Nvidia drivers were once responsible for 30% of all Windows Vista crashes. https://www.engadget.com/2008-03-27-nvidia-drivers-responsible-for-nearly-30-of-vista-crashes-in-20.html https://www.engadget.com/2008-03-27-nvidia-drivers-responsib...
- darkcha0s 6y ago
  Back in the day my Windows system would BSOD every other week for no apparent reason. I cant remember the last time I had that on my Win10 machine; I guess this was an overall improvement to consumers. I sympathise with the driver creators here, but I wouldn't want to go back to those BSOD times, just so that some niche drivers can be signed on Win7 systems.
denkmoon 6y ago
Can drivers be signed by any CA trusted by the system or does it have to be the Microsoft CA? Shitty solution but if you're installing someone's (otherwise unsigned) driver, you're already placing a lot of trust in them.
naikrovek 6y ago
I see it as a reason to applaud centralized code signing. You can install anything you want, anyway, and I want filters so that the drivers I do install aren't shovelware. This certification process is one of those filters.

jeffhou 6y ago

Allowing unsigned drivers to be installed by the general user base seems more anti-user, no? My naive understanding is that drivers are low-level and thus malicious drivers would have more net negative impact on an unsuspecting non-technical user (relative to a piece of malicious non-driver code).

pak9rabid 6y ago
Not to mention that if a user really wants to, they can install unsigned drivers.

acdha 6y ago

> You should be able to easily install anything you want on your computer. This is the same as stating that you prefer many orders of magnitude more users to have unstable or insecure systems because they use products by a negligent vendor or are conned. That's hardly “anti-user” by any metric which covers mainstream users. To me, this is an argument that code signing systems need to be tightly regulated to prevent abusing the system for reasons other than quality testing and accurate labeling.

dcuthbertson 6y ago

Well, Msft attempts to use HCK/HLK to help ensure that the drivers out there are more stable. Once upon a time, there was no signing and some drivers caused the very unfriendly BSOD and Msft got the blame. There are a lot fewer of those today than there were before Msft insisted upon testing/signing things.

intsunny 6y ago
Nvidia drivers were once responsible for 30% of all Windows Vista crashes. https://www.engadget.com/2008-03-27-nvidia-drivers-responsible-for-nearly-30-of-vista-crashes-in-20.html https://www.engadget.com/2008-03-27-nvidia-drivers-responsib...
darkcha0s 6y ago
Back in the day my Windows system would BSOD every other week for no apparent reason. I cant remember the last time I had that on my Win10 machine; I guess this was an overall improvement to consumers. I sympathise with the driver creators here, but I wouldn't want to go back to those BSOD times, just so that some niche drivers can be signed on Win7 systems.

denkmoon 6y ago

Can drivers be signed by any CA trusted by the system or does it have to be the Microsoft CA? Shitty solution but if you're installing someone's (otherwise unsigned) driver, you're already placing a lot of trust in them.

naikrovek 6y ago

I see it as a reason to applaud centralized code signing. You can install anything you want, anyway, and I want filters so that the drivers I do install aren't shovelware. This certification process is one of those filters.