3 ms·

I mean, they seriously done many things in Windows 10 (and analogous servers) to improve security without too much breakage, like moving font processing from ke

I mean, they seriously done many things in Windows 10 (and analogous servers) to improve security without too much breakage, like moving font processing from kernel-level to user-level (n.b. in the process, they have thrown Adobe code). Print spooler is tricky though: even if the official design of the API theoretically allows it to run user-level, ask users of HP products (including business ones) how many times their computer crash due to weirdness in HP drivers. (Why does the HP printing drivers run in kernel-level mode? I don't know!) I'm pretty sure that nothing will happen when the spooler is moved to user-side processing, right? (In all seriousness, the drivers will break and probably crash the system. These products are officially out-of-support, so short of Microsoft paying HP to revamp the drivers nothing will happen.) In all probability, probably even Microsoft is contemplating such move but breaking a lot of stuff is reputationally damaging to them, even if it's not really their fault in this case. Removing SafeROM is easier because it's just grumbling gamers who can probably patch up Windows 7, but imagine the support calls when the print spooler, a critical component, is moved. Even when a rational mind would put the blame on HP (et al., it's not just HP designing "weird" drivers), the problem will appear due to a Microsoft change and therefore Microsoft gets the blame.

freeone3000 5y ago
It's getting to the point where a sane mitigation would be to spin up a Windows 10 instance in Hyper-V, running the print spooler and driver in that, and using USB/ethernet passthrough!
- zinekeller 5y ago
  Some might react and say "just move to Linux (even only the servers!)" and while I'll say NeXT/Apple's design of CUPS is great, it's harder to get a good Linux printer driver that's designed for business use (HPLIP is... painful, and I'm pretty sure that's out of most support contracts).
  - gerdesj 5y ago
    De-install HPLIP and use "IPP Everywhere" if you can. Since I've done that I've had reliable printing that doesn't break on package updates. Given that I use Arch, that was an occasional surprise finale to an update session. It usually started with my SO having an urgent print job to do. Also, put your preferred paper size in /etc/papersize if you are not letter size inclined.
    - merb 5y ago
      xerox color machines with fiery controllers aren't that well working with ipp, the last time I worked with them (3 years ago) it crashed pretty often, which meant a full reboot was needed which takes like 5+ minutes on these which was not possible. lpd is still super simple and works super well on these machines, even when using non standard ports
      - tonyedgecombe 5y ago
        The trouble with LPD is there is no support for authentication, authorisation or encryption.
      - gerdesj 5y ago
        We all have anecdotes with regards printers 8) I think that nmap still refuses to pound away at the JetDirect port ... ... OK I've just tested that against my home HP MFP and 9100/tcp shows in the results. If lpd does it for you on Xerox printers, then fine: use that. I was discussing HPLIP ie getting rid of a Hewlett Packard thing!
- temac 5y ago
  Why even running a Windows 10 instance in that case? Esp. if it's for backward compat with old crap; run a Win 2k, it will be lighter. And only marginally less maintained, which does not even matter if you isolate like that anyway.
  - whereistimbo 5y ago
    But could you obtain it legally though?
    - gambiting 5y ago
      It wasn't hugely advertised, but Win 7 had something called "XP Mode" where it would literally start windows XP in a VM completely in the background, and any program you wanted to start would actually run inside that VM, with windows drawing the application window like a native Win 7 app. It was magical in how well that worked. And yeah, MS just provided a special XP image for this, you didn't need a separate licence for it.
  - whereistimbo 5y ago
    You could request Windows 2000 if you are: Volume License consumer (through downgrade) or Visual Studio subscriber (not for commercial use)
tonyedgecombe 5y ago
>Why does the HP printing drivers run in kernel-mode? I don't know! Printer drivers haven't run in the kernel since NT 4.0.
- zinekeller 5y ago
  > Printer drivers haven't run in the kernel since NT 4.0. I wish that's true, and the APIs are there (and should be used!), but except for incompetence I don't know how some drivers still have that kernel-side code (unless DRM? And if it is, why?) I even thought that the 64-bit and Vista driver reset have banished kernel-level drivers, but in the past 6 months I still see printer drivers with kernel-level components. I just scratch my head why? (Some of them are for PCI (yes, not a typo) connector, which is reasonable but weird for a printer. Others are running to printer port and USB but the kernel-level components are still there, active according to Device Manager).
  - cogman10 5y ago
    Oh I can tell you exactly why, particularly because I've worked with a bunch of ex HP printer devs. "Hey we should upgrade to the latest standards!" "Why?" "Because they are safer!" "Yeah, but it might break things" "But it's safer!" "Yeah, but the current shit is working. Don't mess with a working thing". It's practically a religion there. I interned there years ago, it was a momentous task getting internal people to move from IE 7 to firefox, chrome, or IE8. What I'd done was improve one of their internal tools with an updated javascript library. However, it ran like ass on IE 7 and perfectly fine on pretty much everything else.
tinus_hn 5y ago
Interesting how crashes caused by printer drivers in the kernel are an argument against moving them to user space where they can’t cause crashes

freeone3000 5y ago

It's getting to the point where a sane mitigation would be to spin up a Windows 10 instance in Hyper-V, running the print spooler and driver in that, and using USB/ethernet passthrough!

zinekeller 5y ago
Some might react and say "just move to Linux (even only the servers!)" and while I'll say NeXT/Apple's design of CUPS is great, it's harder to get a good Linux printer driver that's designed for business use (HPLIP is... painful, and I'm pretty sure that's out of most support contracts).
- gerdesj 5y ago
  De-install HPLIP and use "IPP Everywhere" if you can. Since I've done that I've had reliable printing that doesn't break on package updates. Given that I use Arch, that was an occasional surprise finale to an update session. It usually started with my SO having an urgent print job to do. Also, put your preferred paper size in /etc/papersize if you are not letter size inclined.
  - merb 5y ago
    xerox color machines with fiery controllers aren't that well working with ipp, the last time I worked with them (3 years ago) it crashed pretty often, which meant a full reboot was needed which takes like 5+ minutes on these which was not possible. lpd is still super simple and works super well on these machines, even when using non standard ports
    - tonyedgecombe 5y ago
      The trouble with LPD is there is no support for authentication, authorisation or encryption.
    - gerdesj 5y ago
      We all have anecdotes with regards printers 8) I think that nmap still refuses to pound away at the JetDirect port ... ... OK I've just tested that against my home HP MFP and 9100/tcp shows in the results. If lpd does it for you on Xerox printers, then fine: use that. I was discussing HPLIP ie getting rid of a Hewlett Packard thing!
temac 5y ago
Why even running a Windows 10 instance in that case? Esp. if it's for backward compat with old crap; run a Win 2k, it will be lighter. And only marginally less maintained, which does not even matter if you isolate like that anyway.
- whereistimbo 5y ago
  But could you obtain it legally though?
  - gambiting 5y ago
    It wasn't hugely advertised, but Win 7 had something called "XP Mode" where it would literally start windows XP in a VM completely in the background, and any program you wanted to start would actually run inside that VM, with windows drawing the application window like a native Win 7 app. It was magical in how well that worked. And yeah, MS just provided a special XP image for this, you didn't need a separate licence for it.
- whereistimbo 5y ago
  You could request Windows 2000 if you are: Volume License consumer (through downgrade) or Visual Studio subscriber (not for commercial use)

tonyedgecombe 5y ago

>Why does the HP printing drivers run in kernel-mode? I don't know! Printer drivers haven't run in the kernel since NT 4.0.

zinekeller 5y ago
> Printer drivers haven't run in the kernel since NT 4.0. I wish that's true, and the APIs are there (and should be used!), but except for incompetence I don't know how some drivers still have that kernel-side code (unless DRM? And if it is, why?) I even thought that the 64-bit and Vista driver reset have banished kernel-level drivers, but in the past 6 months I still see printer drivers with kernel-level components. I just scratch my head why? (Some of them are for PCI (yes, not a typo) connector, which is reasonable but weird for a printer. Others are running to printer port and USB but the kernel-level components are still there, active according to Device Manager).
- cogman10 5y ago
  Oh I can tell you exactly why, particularly because I've worked with a bunch of ex HP printer devs. "Hey we should upgrade to the latest standards!" "Why?" "Because they are safer!" "Yeah, but it might break things" "But it's safer!" "Yeah, but the current shit is working. Don't mess with a working thing". It's practically a religion there. I interned there years ago, it was a momentous task getting internal people to move from IE 7 to firefox, chrome, or IE8. What I'd done was improve one of their internal tools with an updated javascript library. However, it ran like ass on IE 7 and perfectly fine on pretty much everything else.

tinus_hn 5y ago

Interesting how crashes caused by printer drivers in the kernel are an argument against moving them to user space where they can’t cause crashes