3 ms·

It's getting to the point where a sane mitigation would be to spin up a Windows 10 instance in Hyper-V, running the print spooler and driver in that, and using

It's getting to the point where a sane mitigation would be to spin up a Windows 10 instance in Hyper-V, running the print spooler and driver in that, and using USB/ethernet passthrough!

zinekeller 5y ago
Some might react and say "just move to Linux (even only the servers!)" and while I'll say NeXT/Apple's design of CUPS is great, it's harder to get a good Linux printer driver that's designed for business use (HPLIP is... painful, and I'm pretty sure that's out of most support contracts).
- gerdesj 5y ago
  De-install HPLIP and use "IPP Everywhere" if you can. Since I've done that I've had reliable printing that doesn't break on package updates. Given that I use Arch, that was an occasional surprise finale to an update session. It usually started with my SO having an urgent print job to do. Also, put your preferred paper size in /etc/papersize if you are not letter size inclined.
  - merb 5y ago
    xerox color machines with fiery controllers aren't that well working with ipp, the last time I worked with them (3 years ago) it crashed pretty often, which meant a full reboot was needed which takes like 5+ minutes on these which was not possible. lpd is still super simple and works super well on these machines, even when using non standard ports
    - tonyedgecombe 5y ago
      The trouble with LPD is there is no support for authentication, authorisation or encryption.
    - gerdesj 5y ago
      We all have anecdotes with regards printers 8) I think that nmap still refuses to pound away at the JetDirect port ... ... OK I've just tested that against my home HP MFP and 9100/tcp shows in the results. If lpd does it for you on Xerox printers, then fine: use that. I was discussing HPLIP ie getting rid of a Hewlett Packard thing!
temac 5y ago
Why even running a Windows 10 instance in that case? Esp. if it's for backward compat with old crap; run a Win 2k, it will be lighter. And only marginally less maintained, which does not even matter if you isolate like that anyway.
- whereistimbo 5y ago
  But could you obtain it legally though?
  - gambiting 5y ago
    It wasn't hugely advertised, but Win 7 had something called "XP Mode" where it would literally start windows XP in a VM completely in the background, and any program you wanted to start would actually run inside that VM, with windows drawing the application window like a native Win 7 app. It was magical in how well that worked. And yeah, MS just provided a special XP image for this, you didn't need a separate licence for it.
- whereistimbo 5y ago
  You could request Windows 2000 if you are: Volume License consumer (through downgrade) or Visual Studio subscriber (not for commercial use)

It's getting to the point where a sane mitigation would be to spin up a Windows 10 instance in Hyper-V, running the print spooler and driver in that, and using USB/ethernet passthrough!

zinekeller 5y ago

Some might react and say "just move to Linux (even only the servers!)" and while I'll say NeXT/Apple's design of CUPS is great, it's harder to get a good Linux printer driver that's designed for business use (HPLIP is... painful, and I'm pretty sure that's out of most support contracts).

gerdesj 5y ago
De-install HPLIP and use "IPP Everywhere" if you can. Since I've done that I've had reliable printing that doesn't break on package updates. Given that I use Arch, that was an occasional surprise finale to an update session. It usually started with my SO having an urgent print job to do. Also, put your preferred paper size in /etc/papersize if you are not letter size inclined.
- merb 5y ago
  xerox color machines with fiery controllers aren't that well working with ipp, the last time I worked with them (3 years ago) it crashed pretty often, which meant a full reboot was needed which takes like 5+ minutes on these which was not possible. lpd is still super simple and works super well on these machines, even when using non standard ports
  - tonyedgecombe 5y ago
    The trouble with LPD is there is no support for authentication, authorisation or encryption.
  - gerdesj 5y ago
    We all have anecdotes with regards printers 8) I think that nmap still refuses to pound away at the JetDirect port ... ... OK I've just tested that against my home HP MFP and 9100/tcp shows in the results. If lpd does it for you on Xerox printers, then fine: use that. I was discussing HPLIP ie getting rid of a Hewlett Packard thing!

temac 5y ago

Why even running a Windows 10 instance in that case? Esp. if it's for backward compat with old crap; run a Win 2k, it will be lighter. And only marginally less maintained, which does not even matter if you isolate like that anyway.

whereistimbo 5y ago
But could you obtain it legally though?
- gambiting 5y ago
  It wasn't hugely advertised, but Win 7 had something called "XP Mode" where it would literally start windows XP in a VM completely in the background, and any program you wanted to start would actually run inside that VM, with windows drawing the application window like a native Win 7 app. It was magical in how well that worked. And yeah, MS just provided a special XP image for this, you didn't need a separate licence for it.
whereistimbo 5y ago
You could request Windows 2000 if you are: Volume License consumer (through downgrade) or Visual Studio subscriber (not for commercial use)