35 ms·

Microsoft no longer signs Windows drivers for Process Hacker

650 points by XzetaU8 5y ago

beebmam 5y ago
Didn't Process Explorer start as a third party tool which Microsoft acquired?
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- TonyTrapp 5y ago
  If you follow the ProcessExplorer link it becomes clear that there's a typo, they are talking about TaskExplorer, an open-source clone of ProcessExplorer.
mastazi 5y ago
One of the comments from the comment thread below the linked post, it's a rant and I don't like the tone but it sums up well some of the reasons why me and a few colleagues recently decided to switch to Linux: > Dave-o says: > 2021-10-24 at 23:45 > Notice how it's now virtually impossible to disable Windows Defender nowadays? Libvirt is also having trouble getting Microsoft to cert their drivers. Etc, etc etc. Who gave them the right to limit our freedom to run what we want on our computers? > Reviews about Windows 11 at formerly-credible websites like http://www.arstechnica.com http://www.arstechnica.com & http://www.thevirge.com http://www.thevirge.com, etc are so pathetic, "oh the new toolbar! But mah techichial anayasis is that there are some old dialogs still in control panel! I wants mah new eye-candys!". And their sycophantic commenters are vastly worse. > Truth is, Microsoft's strategy may have been FUD in the past but now it's evolved to 'slowly tighten the noose'. The reason I liked Windows was my ability to audit it. At least someone should be able to. Now with hardware-enabled DRM secure envelopes & encrypted memory regions, that is becoming impossible. Which is exactly their plan. > Because, you see, Microsoft wants to become like Apple: "We respect your privacy; your secrets are between just you and us." Do you trust there's no and will be no future Microsoft-only back-doors in the Windows Firewall? Really? > Who actually owns your machine? Can you actually stop your iPhone from updating? Nope. In the past I tried and their upgrade permanently broke some CAD apps I heavily relied on. And there's no way back, baby. The content I created? poof > It used to be more a Facebook / Google thing. Post on social, they have a permanent free license to use your content and treat it however they like. All corporations are liable to their shareholders if they don't maximize profits. Why are these guys so insanely profitable? What do they actually create? They're all just leaches on our data. > SO, either get used to the 'brave' new world: mega-corporation$ & the government own your most intimate personal information and control the devices you rely on. Or switch to linux and at least have a prayer of someone keeping the software you rely on honest by auditing it. Just someone having the ability to see what's going on inside that secure-enclave hiding in your computer is enough of a threat to keep them honest. > These days, most folks live in their browser. Maybe play some games. Install Kubuntu and run firefox and most Windows users will barely be able to tell the difference. Getting Windows running inside a QEMU virtual machine isn't really that difficult. At least that way you have a way of firewalling Windows that's outside of Microsoft's control. It's a bit more tricky for mom but is becoming more turn-key & productized all the time. > Linux Wine is coming along nicely. The day is fast approaching when Windows games will run great directly on Linux. Steam Deck will push this over the curve and it's all down-hill from there. Why prioritize targeting Windows when Linux becomes a large market? Multi-platform is kinda ugly but it's a thing. All other things being equal (usability, compatibility, etc) consumers will always opt for more privacy and control. And this is the way out of this privacy & control mess. > With IPFS and distributed platform tech so close, the new future will be the public ridding themselves of these menaces both for social and their personal devices. At least I hope so. > /rant
dschuetz 5y ago
But they sign malware? Strange.
- pedro2 5y ago
  +1 Funny
- CodeArtisan 5y ago
  I don't know about malwares but online gaming cheat developers have been using a signed driver from Intel that has a vulnerability allowing to load any unsigned driver. Despite the exploit being discovered back in 2016, the driver certificate is still valid as of today and works with Windows 11. https://nvd.nist.gov/vuln/detail/CVE-2015-2291 https://nvd.nist.gov/vuln/detail/CVE-2015-2291 https://github.com/TheCruZ/kdmapper https://github.com/TheCruZ/kdmapper
throwuxiytayq 5y ago
An immensly powerful and useful tool. Can't live without it. Hopefully the situation resolves soon. What is it with MS these past few months? It's like they're trying to throw away the little community goodwill they managed to build up over the years.
- beermonster 5y ago
  > What is it with MS these past few months? I was thinking the same. It's not been a good few weeks for them. They're quickly losing trust which was hard to acquire in the first place given their history. Maybe a timely reminder to mention Halloween [1] ? [1] https://en.wikipedia.org/wiki/Halloween_documents https://en.wikipedia.org/wiki/Halloween_documents
  - southerntofu 5y ago
    They've always been acting as a strong monopolistic corporation with a "fuck you" attitude. Here's a summary of Microsoft attitude these part 5 years: - rebrand as open-source friendly, only open-source whatever narrow side-projects they barely care about but could be run on other systems (VSCode, Powershell); distribute official packages with spyware - monopolize the education system by offering bribes including gratis hardware devices to whoever in State education will work with them to pretend Microsoft loves kids and kids need computers (with Microsoft software, obviously) to learn anything in the 21st century - force manufacturers to deploy "TPM v2.0" on their new machines so they can run Windows 11, continuing the push so that people have 0 understanding and control over the machines they own (instead are controlled by the machines), and don't have a choice of system because "SecureBoot" [0] - love Linux! let them integrate all your POSIX/Linux APIs in a VM on their system, so that you never have to use anything else than Windows ever again (embrace...) ; it's just like reverse-Wine (execute Windows program on free systems) except they have an army of developers with $$$$ and don't have to waste time reverse-engineering anything because they have the source code to both systems... how convenient! - viruses are such a huge problem, if only we had some sort of digital signatures for software, and trustworthy places to get it from?! sure let's have a Microsoft market where you can buy adware/spyware signed by Microsoft, with two key advantages: 1) it's super faster because signed software is not inspected real-time by Windows defender 2) noone else can make their own "appstore" repository with their own signature keys (like we do with Flatpak/APT/nix/guix) ; very soon they can start to hide how to run programs unapproved by Microsoft like Android or MacOS [1] have been doing... and it's all for security, right? because app-store monopoly has definitely stopped malware (oooh that's a nice flashlight app you got there Google Play) without harming FLOSS/hobbyist devs (yeah sure) It's just *washing (openwashing here) straight out of marketing textbooks. If you know/learn anything about capitalism and public relations, you won't be tricked next time! [0] Briefly touched upon in this bigger article about how Microsoft is still evil, why Secure Boot has nothing to do with security, and why hardware manufacturers happily play along: https://www.haiku-os.org/blog/mmu_man/2021-10-04_ok_lenovo_we_need_to_talk/ https://www.haiku-os.org/blog/mmu_man/2021-10-04_ok_lenovo_w... [1] There was even this worrying story at some point that MacOS would refuse to open applications (whether signed or not) because their centralized server could not be reached: https://news.ycombinator.com/item?id=25074959 https://news.ycombinator.com/item?id=25074959 <-- Soon coming to your Windows setup
amyjess 5y ago
Because of things like this, I'm at the point where I consider the invention of public-key encryption to be the worst thing that's ever happened to the world. If governments had _immediately_ preemptively classified anything related to assymetric encryption—and actively enforced the classified status—as soon as the first research into it started appearing, the world would be a much better place than it is now.
- garganzol 5y ago
  This is a slippery slope way of thinking. One would argue that appearance of computers is similarly evil, but many of us can confirm that this is not true. It all depends on who uses the tool and their motives, not on the tool itself. The tool is powerful but it's totally neutral. And can be used for both bad (dominance, ransom) and good things (security).
  - maccolgan 5y ago
    >who uses the tool and their motives, not on the tool itself. The tool is powerful but it's totally neutral. What if we had computer control like gun control?
    - deleted 5y ago
      [deleted]
- vbezhenar 5y ago
  Asymmetric cryptography is too simple to contain it. RSA is unbreakable and it's very simple to understand. It would be reinvented over and over by multiple people in multiple countries, you can't contain it.
- Synaesthesia 5y ago
  If you look at the history of encryption, thats preceisely what happened, and right up to the 90s they did contain it.
- xondono 5y ago
2OEH8eoCRo0 5y ago
Are there TPMs where the user has more control and can configure w/ a root password to control keys? I like the idea of a secure tamper resistant security device but I don't like that the owner of the PC does not retain absolute control over this device.
- ZekeSulastin 5y ago
  Yes - the TPM isn’t a Windows-only thing. For example: https://wiki.archlinux.org/title/Trusted_Platform_Module https://wiki.archlinux.org/title/Trusted_Platform_Module
- will4274 5y ago
  > the owner of the PC does not retain absolute control over this device. This is a bit FUD-y. TPMs are key stores, the same as what Apple calls a "secure enclave." When you activate a device with a service like Netflix or a software like Windows, they stick their key in the TPM. As a user you can clear of disconnect the TPM any time you like - you're in control of your device. What you're not in control of is Netflix and Windows - Netflix and Windows are only going to authorize 5 TPMs. If you reset your TPM, you're going to need to re-enter your license information.
  - josephcsible 5y ago
    The fact that, by design, you (the owner) can't make the TPM give you all of its secret keys, means that you don't have control over your device.
    - will4274 5y ago
      Does it? I can't make my microwave work with the door open either. The whole "point" of a TPM is that the user can create, use, and delete keys inside of it, with the promise that the keys won't come out. TPMs are just smart cards. Would you say that you don't have control over a smart card because you can't get the keys out of it? I'd say I DO have control over the smartcard, because I authorize and de-authorize the keys held within, and the whole point of a smartcard is to permit authorization of a physical entity, which requires the physical entity to resist leaking its keys. To me, operating with a well designed model, when and if I choose, with the ability for me to shut it down at any time - that's control.
sli 5y ago
I hope the folks who claimed up and down that Microsoft was different and better these days, and ridiculed people who didn't believe it, are paying close attention to this. Reminder that they own Github as well as what is likely the single most widely used code editor.
stavros 5y ago
Is there no way to run unsigned software on windows?
- the_only_law 5y ago
  For drivers, I don’t think so. You can enable some boot settings that allow you to run unsigned drivers, for development purposes, but it will revert upon reboot, without anyway to enable it permanently.
  - ebanana 5y ago
    you would have to automate that somehow if it becomes an issue
    - heavyset_go 5y ago
      All Microsoft has to do to stop that from being a problem is to tell Defender to block that automation from running on Windows, for example, by refusing to run anything signed with the automation developer's certificates.
      - ebanana 5y ago
        yeah thats true, you can get around some stuff with modified keyboards, accessiblity access, automated mouse but then you are just hacking things together at that point
  - stavros 5y ago
    Oh wow, the refusal is devastating then...
  - dataflow 5y ago
    There is: test signing. Painful for non-savvy users, but not impossible.
  - XenophileJKO 5y ago
    Actually you can turn off enforcement if you want to. Requires a reboot and going into safe mode if I remember correctly. I have done it before when loading hacked drivers for old hardware, etc.
heavyset_go 5y ago
> Microsoft Process Explorer has the same functionality so they don't have standing to block competitors then go and include the exact same features in their own software. > Microsoft has been secretly adding more powerful features than Process Hacker via their SAC product – SAC has no security whatsoever by design – they're clearly targeting the project not because of any actual technical issues but rather because we're more popular than their products, so they're using the same (illegal and anti-competitive) tactics they used against Netscape Navigator to eliminate competition but also labeling the project malicious in an attempt to mislead the competition regulators. Yet another example of a trillion dollar tech company stifling competition and innovation with anti-competitive tactics. Both Microsoft and Apple require developers to sign software in order for their apps to run on Windows or macOS. Developers must pay to buy and renew their certificates regularly and must remain in good standing with either company if they want their apps to run on either OS. At any time, and for any reason, Microsoft or Apple can revoke your certificates and prevent Windows or macOS from running your apps at all. The control over what apps can run on Windows or macOS is all about securing profits for either company, first and foremost. Actual security is just an afterthought. Both companies take it one step further and are locking developers out of kernel space. Apple stills signs a few third-party .kexts, like macFUSE, but everyone else is out of luck. Microsoft needs to sign kernel-mode drivers or situations like the one in the OP will occur. This is certainly different than, but reminiscent of, the situation with AppGet and Microsoft's clone, Winget[1]. [1] https://keivan.io/the-day-appget-died/ https://keivan.io/the-day-appget-died/
- yread 5y ago
  > SAC do you mean Special administration console? or Semi-annual channel?
  - heavyset_go 5y ago
    Not sure, I'm quoting directly from the article.
    - y4mi 5y ago
      The same question has been answered in the linked GitHub issue, though the comment was marked as off topic. It's special administrative console, more in depth info what that actually is in the comment. https://github.com/processhacker/processhacker/discussions/773#discussioncomment-1186451 https://github.com/processhacker/processhacker/discussions/7...
spacemanmatt 5y ago
I know people who pretend that Nadella has made the company so different. Microsoft will never change.
- krylon 5y ago
  It looked kind of promising for a while. With the pivot to cloud services, there was reason to hope they just would not care any more about pulling that kind of move for desktop Windows. I guess after a decade of watching Apple and Google getting away with stuff that Microsoft would have been drawn and quartered for twenty years ago, they decided it was safe for them get back to their old ways. sigh Would have been nice, though.
mavhc 5y ago
What's SAC?
- tyingq 5y ago
  The "Special Administration Console". Oddly, I can't find normal docs for it on microsoft.com, so here's the Azure docs for it: https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-machines/serial-console-windows https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-...
zahllos 5y ago
The article mentions Process Explorer. Since Sysinternals were bought by Microsoft many years ago and the tools are distributed directly via Microsoft, such tools are unlikely to have an issue being signed. A brief history of the process for those not following it. Originally for kernel-mode drivers, you needed a code signing certificate cross signed by Microsoft's root. This means that the certificate follows a chain up to a standard CA _and also_ one Microsoft use to approve that CA to issue kernel-mode certificates. It was not sufficient to have a certificate capable of signing code, even with MS' OIDs for that. Then, around Windows 10 I think, Microsoft announced that one would need to acquire an EV certificate. You would then be required to submit the driver package via sysdev.microsoft.com and after spending time in Ballmer's Brewery, it would come out signed by Microsoft. It was technically possible to use the old mechanism at this stage too, provided the end user did not have UEFI secure boot enabled. IF secure boot were enabled, the kernel would: a) if the driver was signed pre-Win10, accept it, b) if it was signed post win-10 RTM date and by Microsoft, accept otherwise reject. Thus the only mechanism to realistically get your driver working on all Windows out of the box is to submit via sysdev. You can't realistically ask users to disable secure boot, even if this is entirely possible on all x86 motherboards. Finally, the cross signed roots expire soon and I think some already have. Microsoft have decided that this mechanism will now be retired, and all drivers must be signed via sysdev from now on. You still require an EV certificate as well, to sign the package. This is a bit of a mixed bag. On the one hand, Microsoft have repeatedly signed the shim maintained by redhat in order to allow Linux distributions to boot directly on secure boot-enabled hardware (UEFI binaries also go through this process and always have). Microsoft have their keys in the default keychain because they bothered to be involved in the process, unlike linux companies like Redhat. So on the one hand, they're being quite friendly to open source. On the other hand, the push to EV certs rules out individual developers like myself[1]. I could register a company but... that entails effort and expense for a hobby project. And now hobbyist projects like this run the risk of being rejected by MS. I mostly believe this is an attempt to reduce the number of code signing cert leaks that result in people writing malware, and lock down the Windows kernel a bit more, but still. It is a shame. [1] This is because most CAs won't issue EV certificates to individuals, even if those individuals happen to have detailed knowledge of cryptography and all the pkcs.
- 5y ago
guilhas 5y ago
Seriously, I don't understand Firefox, Microsoft, Google... always alienating community to reimplement something that already exists, works well, and they rarely do better....
- happynacho 5y ago
  It's simple. Money.
  - 2OEH8eoCRo0 5y ago
    I had a highschool history teacher who said that money/power is the answer to everything. If you don't know the answer, just say money; it's usually right.
    - hoseja 5y ago
      What a great teacher. Surprised they let them teach history (national indoctrination) of all things.
eps 5y ago
In related news - ever wondered why Windows 11 can't be installed on "older computers"? You know, the ones that don't have a TPM chip? Now you know. Windows 11 completes the lock-up of the OS. That's why Windows 11 exists in the first place. All other changes are secondary. Microsoft knows they would've not been able to pull shit like this as a Windows 10 update, so they were effectively forced to do a version increase. Against older promises of W10 being the last Windows version ever. Welcome to the future that Microsoft always wanted, but couldn't have - a platform with airtight control. Just like what Apple has with its AppStore and its wonderful, wonderful 30% commission. Almost there and the lemmings didn't even notice it, distracted by the new and friendly Microsoft front, free upgrades to Windows 10 and centered Start menu in Windows 11. Mark my words - Windows 12 will severely impede direct installation even of an user-space software, funnelling everyone to go through the store. That's the end goal and we will all be there in a couple of years, whether we want it or not.
- pabs3 5y ago
  Someone recently got Windows 11 installed and working on a Pentium 4, so it doesn't seem that the restrictions are hard to bypass.
- pjmlp 5y ago
  But it will be built on top of WSL3 and all hackers will jump of joy with Windows/Linux.
  - intricatedetail 5y ago
    Many people only use Windows because the software they have don't have a Linux build. Maybe people should start pressuring vendors to make Linux builds and that could end Windows.
    - gavinray 5y ago
      Bingo. Switched from 10 years of Debian-based linux (mostly Ubuntu, recently Pop_OS) to Windows because of some MIDI driver thing I could not get to install in WINE. I have had a significantly less pleasant time on both Win10 and Win11, and it's slow as hell. Ubuntu/Ubuntu-derivatives with Regolith as a DE + Tiling WM is the best computing experience I've ever had (Disclaimer: Have never used a Mac. Have been told OSx is better than Linux by people who have used both for long time.) https://regolith-linux.org/ https://regolith-linux.org/ The ironic thing is that, I later had a passing convo with a developer of a DAW, who told me that MIDI driver stuff is usually for running specific software from the vendor and that MIDI is universal over USB. So I never even needed to switch in the first place! I was just too hardware-stupid to know this! Oh man it hurts my soul. I could switch back but it takes a whole weekend to properly backup + wipe and setup a machine. I think I am going to go back to Pop_OS or Ubuntu though.
elmo2you 5y ago
Monopoly abuse by any other name is still just that. Microsoft never did change, nor will it, no mater how many they manage to fool, manipulate or bribe. It remains a criminal enterprise that should be cut down. But that will never happen, as long as the government(s) controlling this company are made of the same DNA. Good luck to those who have the luxury of a choice to avoid this company (and similar ones). Even more if they still choose not to. Most of all, good luck for those who don't even have a choice, for they most likely will need luck more than anyone else.
- nix23 5y ago
  Yeah funny times we life in, from Oracle you get a free enterprise linux, from Microsoft a opensoured MSDOS 1.0 ;) Edit: Correction, MSDOS 1.25 and 2.0 was released too
  - orionblastar 5y ago
    Microsoft released their own Linux: https://www.tomshardware.com/news/microsoft-released-cbl-mariner-linux-distro https://www.tomshardware.com/news/microsoft-released-cbl-mar... As far as opensource DOS, nothing beats FreeDOS: https://www.freedos.org/ https://www.freedos.org/
    - nix23 5y ago
      >>CBL-Mariner is an internal Linux distribution for Microsoft’s cloud infrastructure and edge products and services. Oh yes please...i want that universal Linux Distribution ;) >nothing beats FreeDOS Dosbox and dosbox-x beat FreeDOS anyday.
      - anthk 5y ago
        Call me when you can run real drivers in DOSBox-X. And, still, XDOSemu+FreeDOS runs circles over DOSBox and DOSBox-x.
        5y ago
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
ogurechny 5y ago
Keep in mind this has happened because people agreed that they can't (normally) run code not singed by someone else (Microsoft) on their own system for “security” reasons. Well, it was not security, it actually was a way to keep keys to themselves, and hold the user system as a hostage. And it has been explained many times by many people. If you care about software freedoms, even just a tiny bit, you wouldn't touch “Microsoft open source”, and you wouldn't be happy about your friends using any of it, like you wouldn't be happy about seeing them with a heroin syringe. That is going to explode spectacularly one day.
- 29athrowaway 5y ago
  The user wants convenience, and then, under the premise of convenience, corporations create systems that give them the convenience they want in exchange for their privacy and freedom. Being spied on, having forced updates, a remote kill switch on your computer, "telemetry", advertisement, and the best of all: your government being bullied and lobbied on with the money you paid... it is all worth it because you can run a stupid DirectX game at 60 fps instead of 58 fps. Until the forced update interrupts your game, that is.
  - _8j50 5y ago
    Usability triumphs everything. Even privacy. Either pass pro-consumer laws or compete with them using free alternatives. Why do you expect a corporation to care about your privacy or well being? They would be using small children, paying them a loaf of bread a week making it illegal to not do business with them if they could. People have rights and equality before the law , corporations not so much.
  - hoseja 5y ago
    You can run the game at 60fps instead of 600spf though.
- _8j50 5y ago
  That is blatant false-dichotomy. You don't need to undermine the immense level of security improvement introduced by driver signing. Kernel mode rootkits are very hard to detect and eradicate. Right now, windows kernel mode rootkits rely on exploiting vulnerable drivers (very easy to detect when vulnerable drivers are loaded). It's not just signing but MS requiring valudation. If only Linux distros required this by default (with a boot option to turn off validation). If you wouldn't touch Microsoft open source but you would touch Google open source (say Chrome or their contributions to the Linux kernel), I would love to hear how that is different. Personally, the software I use is not a matter of ideology but a matter if the best tool for the task at hand. But your observation on how MS is using adversarial compatibility against Linux (flipping the table) is correct. I just don't see how post-systemd gnu/linux is all that different, perhaps because it is many megacorps contributing and controlling Linux? It's not exactly driven by software freedom anymore.
deleted 5y ago
[deleted]
chris_wot 5y ago
ReactOS is looking better and better.
MrStonedOne 5y ago
From: https://github.com/processhacker/processhacker/discussions/773#discussioncomment-1124432 https://github.com/processhacker/processhacker/discussions/7... >The existing drivers are compatible with Win11 and haven't been blocked by Microsoft yet... The large majority of changes by Microsoft are limited to restricting the Windows API with signature checks that block competitors software (e.g. CreateWindowInBand, NtQuerySystemInformation, NtQueryInformationProcess to name a few) rather than directly targeting the drivers themselves. >The signature checks added to those functions and classes only block third-parties and this includes signed binaries. We won't be able to implement the same functionality as Task Manager and Process Explorer because of those Microsoft-only signature checks even after we sort out the submission issue. >Always-on-top, Auto-elevation, DPS statistics, Default taskmgr application preferences (Microsoft hardcoded taskmgr.exe blocking competitors), GPU statistics (deliberately broken on Win10 and Win11 recently) and the DirectUI framework are some examples of features that I want to implement and are currently implemented by Task Manager but are Microsoft-only signature restricted while newer more advanced security like PPL that we desperately need are also Microsoft-only signature restricted. >The only certificate allowed to use these and other functionality is now limited to Microsoft Windows certificates - the same certificates used with Task Manager and Process Explorer - while SAC has even more powerful functionality than anything else (including Process Hacker) with absolutely no security whatsoever. So, basically, for some reason, Microsoft wants to make it very hard for you to see whats running on your computer...
- jenscow 5y ago
  > So, basically, for some reason, Microsoft wants to make it very hard for you to see whats running on your computer... That's my take on it, too. I doubt they care about a "competing" task-manager tool.
- api 5y ago
  > So, basically, for some reason, Microsoft wants to make it very hard for you to see whats running on your computer... So they can run spyware. Nearly every user hostile policy or behavior can be explained by the insatiable lust for data.
2OEH8eoCRo0 5y ago
Smells like a lawsuit.
- jmclnx 5y ago
  Yes, and seems they are based in Germany, so I would think with the EU laws, they have a very good chance of winning. If based in the US, they would be SOL.
wiz21c 5y ago
Time to add the right to use a computer as you see fit in the human rights, before it's too late...
- FateOfNations 5y ago
  Use a computer, versus use specific commercial software (Windows)?
rkagerer 5y ago
Microsoft is locking certain API's: Always-on-top, Auto-elevation, DPS statistics, Default taskmgr application preferences (Microsoft hardcoded taskmgr.exe blocking competitors), GPU statistics (deliberately broken on Win10 and Win11 recently) and the DirectUI framework are some examples of features that I want to implement and are currently implemented by Task Manager but are Microsoft-only signature restricted while newer more advanced security like PPL that we desperately need are also Microsoft-only signature restricted.
- no_time 5y ago
  I'm not familiar with the rest but how is Always-on-top locked away? Its such a basic thing and a lot of programs are using it.
  - therein 5y ago
    SetWindowPos with HWND_TOPMOST fails with Access Denied. CreateWindowInBand also fails with Access Denied.
    - no_time 5y ago
      That's so weird. No idea why they restricted that but not the other ways of setting a window to always stay on top. Like whatever Firefox's picture-in-picutre uses. EDIT: I guess they want to prevent you from doing interesting things like staying on top of the lockscreen. This article sheds some light on the Z ordering changes since win8 https://blog.adeltax.com/window-z-order-in-windows-10/ https://blog.adeltax.com/window-z-order-in-windows-10/
      - rkagerer 5y ago
        16 new Window bands (layers) is excessive. "Activate Windows" and Cortana each get their very own. Locking other vendors out of that functionality (eg. can't create a Notifications panel alternative) is anti-competitive and degrades one of the best features of Windows (the ability for others to improve it as they see fit).
account-5 5y ago
I built a computer in 2012 approx. Its still going strong running MX Linux. I'm running Win 10 in vbox. I'm sure it would run Win 10 but I'm not in the habit of running something that find of phoning home. As long as I can run Windows for the few things I need if for in vbox I don't care. It would amuse me that I would be running an os in software that wouldn't run on my hardware!
Shorel 5y ago
I've had to authorize lots of Steam games this month in 'Windows Security' protected folders just so be able to save replays, or basic controls configuration. I think MS is going for the kill against Steam this time. And this is with Windows 10. Windows 11 will require MS permission, and some Steam games will simply never work there. But you will be able to purchase them again in the MS Store.
- kevingadd 5y ago
  Arguably this is Valve's fault because they insist on putting a ton of stuff in secure folders (under Program Files) instead of where they belong (in the user's home/data directories) They've had a LONG time to fix this.
  - garaetjjte 5y ago
    That's just game fault that it saves data in game files instead of user directory.
    - kevingadd 5y ago
      No, Steam puts stuff like steam cloud in the programfiles dir as well. It's totally under their control where it goes.
      - garaetjjte 5y ago
        Steam Cloud files location is also specified by game developer: https://partner.steamgames.com/doc/features/cloud https://partner.steamgames.com/doc/features/cloud
  - RealStickman_ 5y ago
    Isn't that just because the default library is in the steam install folder? (On windows)
    - ryanlol 5y ago
EVa5I7bHFq9mnYK 5y ago
I honestly googled what the "SAC" stands for, but couldn't find anything. Please, please people, don't assume everybody knows your acronyms.
- layer8 5y ago
  Special Administration Console
excalibur 5y ago
> Windows owns the market for the simple reason it's not some locked down garbage controlled system How did you come to THAT conclusion?
- userbinator 5y ago
  That used to be true. But clearly Windows is going in the same direction as Android and macOS.
sbisson 5y ago
It’s not quite as bad as presented here; yes Microsoft is in the process of deprecating kernel mode drivers as part of its current security push, however it’s following Linux and implementing eBPF as a more secure alternative that runs mostly in user land and in a sandbox in kernel space. For the type of thing that this app does, it’s a logical change of direction that does not require the same level of EV code signing.
- roblabla 5y ago
  Microsoft's eBPF is a very different beast from Linux's eBPF. It is contained to very few subsystems (Currently network, filesystem to come) and doesn't have the same facilities Linux has with dynamic probes to hook arbitrary kernel functions. Windows also has DTrace, which does support arbitrary kernel hooks, but it requires booting in a special mode with bcdedit /set dtrace ON, which makes it unusable for machines not under your direct control. None of those give enough visibility in the kernel structures to fully subsume kernel mode drivers. And further, they don't allow some of the advanced capabilities that are provided by things like ProcessHacker, such as killing PPL, forcefully closing remote handles, and a bunch of other stuff that is only possible via a kernel driver.

650 points by XzetaU8 5y ago

beebmam 5y ago

Didn't Process Explorer start as a third party tool which Microsoft acquired?

deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
TonyTrapp 5y ago
If you follow the ProcessExplorer link it becomes clear that there's a typo, they are talking about TaskExplorer, an open-source clone of ProcessExplorer.

mastazi 5y ago

One of the comments from the comment thread below the linked post, it's a rant and I don't like the tone but it sums up well some of the reasons why me and a few colleagues recently decided to switch to Linux: > Dave-o says: > 2021-10-24 at 23:45 > Notice how it's now virtually impossible to disable Windows Defender nowadays? Libvirt is also having trouble getting Microsoft to cert their drivers. Etc, etc etc. Who gave them the right to limit our freedom to run what we want on our computers? > Reviews about Windows 11 at formerly-credible websites like http://www.arstechnica.com http://www.arstechnica.com & http://www.thevirge.com http://www.thevirge.com, etc are so pathetic, "oh the new toolbar! But mah techichial anayasis is that there are some old dialogs still in control panel! I wants mah new eye-candys!". And their sycophantic commenters are vastly worse. > Truth is, Microsoft's strategy may have been FUD in the past but now it's evolved to 'slowly tighten the noose'. The reason I liked Windows was my ability to audit it. At least someone should be able to. Now with hardware-enabled DRM secure envelopes & encrypted memory regions, that is becoming impossible. Which is exactly their plan. > Because, you see, Microsoft wants to become like Apple: "We respect your privacy; your secrets are between just you and us." Do you trust there's no and will be no future Microsoft-only back-doors in the Windows Firewall? Really? > Who actually owns your machine? Can you actually stop your iPhone from updating? Nope. In the past I tried and their upgrade permanently broke some CAD apps I heavily relied on. And there's no way back, baby. The content I created? poof > It used to be more a Facebook / Google thing. Post on social, they have a permanent free license to use your content and treat it however they like. All corporations are liable to their shareholders if they don't maximize profits. Why are these guys so insanely profitable? What do they actually create? They're all just leaches on our data. > SO, either get used to the 'brave' new world: mega-corporation$ & the government own your most intimate personal information and control the devices you rely on. Or switch to linux and at least have a prayer of someone keeping the software you rely on honest by auditing it. Just someone having the ability to see what's going on inside that secure-enclave hiding in your computer is enough of a threat to keep them honest. > These days, most folks live in their browser. Maybe play some games. Install Kubuntu and run firefox and most Windows users will barely be able to tell the difference. Getting Windows running inside a QEMU virtual machine isn't really that difficult. At least that way you have a way of firewalling Windows that's outside of Microsoft's control. It's a bit more tricky for mom but is becoming more turn-key & productized all the time. > Linux Wine is coming along nicely. The day is fast approaching when Windows games will run great directly on Linux. Steam Deck will push this over the curve and it's all down-hill from there. Why prioritize targeting Windows when Linux becomes a large market? Multi-platform is kinda ugly but it's a thing. All other things being equal (usability, compatibility, etc) consumers will always opt for more privacy and control. And this is the way out of this privacy & control mess. > With IPFS and distributed platform tech so close, the new future will be the public ridding themselves of these menaces both for social and their personal devices. At least I hope so. > /rant

dschuetz 5y ago

But they sign malware? Strange.

pedro2 5y ago
+1 Funny
CodeArtisan 5y ago
I don't know about malwares but online gaming cheat developers have been using a signed driver from Intel that has a vulnerability allowing to load any unsigned driver. Despite the exploit being discovered back in 2016, the driver certificate is still valid as of today and works with Windows 11. https://nvd.nist.gov/vuln/detail/CVE-2015-2291 https://nvd.nist.gov/vuln/detail/CVE-2015-2291 https://github.com/TheCruZ/kdmapper https://github.com/TheCruZ/kdmapper

throwuxiytayq 5y ago

An immensly powerful and useful tool. Can't live without it. Hopefully the situation resolves soon. What is it with MS these past few months? It's like they're trying to throw away the little community goodwill they managed to build up over the years.

beermonster 5y ago
> What is it with MS these past few months? I was thinking the same. It's not been a good few weeks for them. They're quickly losing trust which was hard to acquire in the first place given their history. Maybe a timely reminder to mention Halloween [1] ? [1] https://en.wikipedia.org/wiki/Halloween_documents https://en.wikipedia.org/wiki/Halloween_documents
- southerntofu 5y ago
  They've always been acting as a strong monopolistic corporation with a "fuck you" attitude. Here's a summary of Microsoft attitude these part 5 years: - rebrand as open-source friendly, only open-source whatever narrow side-projects they barely care about but could be run on other systems (VSCode, Powershell); distribute official packages with spyware - monopolize the education system by offering bribes including gratis hardware devices to whoever in State education will work with them to pretend Microsoft loves kids and kids need computers (with Microsoft software, obviously) to learn anything in the 21st century - force manufacturers to deploy "TPM v2.0" on their new machines so they can run Windows 11, continuing the push so that people have 0 understanding and control over the machines they own (instead are controlled by the machines), and don't have a choice of system because "SecureBoot" [0] - love Linux! let them integrate all your POSIX/Linux APIs in a VM on their system, so that you never have to use anything else than Windows ever again (embrace...) ; it's just like reverse-Wine (execute Windows program on free systems) except they have an army of developers with $$$$ and don't have to waste time reverse-engineering anything because they have the source code to both systems... how convenient! - viruses are such a huge problem, if only we had some sort of digital signatures for software, and trustworthy places to get it from?! sure let's have a Microsoft market where you can buy adware/spyware signed by Microsoft, with two key advantages: 1) it's super faster because signed software is not inspected real-time by Windows defender 2) noone else can make their own "appstore" repository with their own signature keys (like we do with Flatpak/APT/nix/guix) ; very soon they can start to hide how to run programs unapproved by Microsoft like Android or MacOS [1] have been doing... and it's all for security, right? because app-store monopoly has definitely stopped malware (oooh that's a nice flashlight app you got there Google Play) without harming FLOSS/hobbyist devs (yeah sure) It's just *washing (openwashing here) straight out of marketing textbooks. If you know/learn anything about capitalism and public relations, you won't be tricked next time! [0] Briefly touched upon in this bigger article about how Microsoft is still evil, why Secure Boot has nothing to do with security, and why hardware manufacturers happily play along: https://www.haiku-os.org/blog/mmu_man/2021-10-04_ok_lenovo_we_need_to_talk/ https://www.haiku-os.org/blog/mmu_man/2021-10-04_ok_lenovo_w... [1] There was even this worrying story at some point that MacOS would refuse to open applications (whether signed or not) because their centralized server could not be reached: https://news.ycombinator.com/item?id=25074959 https://news.ycombinator.com/item?id=25074959 <-- Soon coming to your Windows setup

amyjess 5y ago

Because of things like this, I'm at the point where I consider the invention of public-key encryption to be the worst thing that's ever happened to the world. If governments had _immediately_ preemptively classified anything related to assymetric encryption—and actively enforced the classified status—as soon as the first research into it started appearing, the world would be a much better place than it is now.

garganzol 5y ago
This is a slippery slope way of thinking. One would argue that appearance of computers is similarly evil, but many of us can confirm that this is not true. It all depends on who uses the tool and their motives, not on the tool itself. The tool is powerful but it's totally neutral. And can be used for both bad (dominance, ransom) and good things (security).
- maccolgan 5y ago
  >who uses the tool and their motives, not on the tool itself. The tool is powerful but it's totally neutral. What if we had computer control like gun control?
  - deleted 5y ago
    [deleted]
vbezhenar 5y ago
Asymmetric cryptography is too simple to contain it. RSA is unbreakable and it's very simple to understand. It would be reinvented over and over by multiple people in multiple countries, you can't contain it.
Synaesthesia 5y ago
If you look at the history of encryption, thats preceisely what happened, and right up to the 90s they did contain it.
xondono 5y ago

2OEH8eoCRo0 5y ago

Are there TPMs where the user has more control and can configure w/ a root password to control keys? I like the idea of a secure tamper resistant security device but I don't like that the owner of the PC does not retain absolute control over this device.

ZekeSulastin 5y ago
Yes - the TPM isn’t a Windows-only thing. For example: https://wiki.archlinux.org/title/Trusted_Platform_Module https://wiki.archlinux.org/title/Trusted_Platform_Module
will4274 5y ago
> the owner of the PC does not retain absolute control over this device. This is a bit FUD-y. TPMs are key stores, the same as what Apple calls a "secure enclave." When you activate a device with a service like Netflix or a software like Windows, they stick their key in the TPM. As a user you can clear of disconnect the TPM any time you like - you're in control of your device. What you're not in control of is Netflix and Windows - Netflix and Windows are only going to authorize 5 TPMs. If you reset your TPM, you're going to need to re-enter your license information.
- josephcsible 5y ago
  The fact that, by design, you (the owner) can't make the TPM give you all of its secret keys, means that you don't have control over your device.
  - will4274 5y ago
    Does it? I can't make my microwave work with the door open either. The whole "point" of a TPM is that the user can create, use, and delete keys inside of it, with the promise that the keys won't come out. TPMs are just smart cards. Would you say that you don't have control over a smart card because you can't get the keys out of it? I'd say I DO have control over the smartcard, because I authorize and de-authorize the keys held within, and the whole point of a smartcard is to permit authorization of a physical entity, which requires the physical entity to resist leaking its keys. To me, operating with a well designed model, when and if I choose, with the ability for me to shut it down at any time - that's control.

sli 5y ago

I hope the folks who claimed up and down that Microsoft was different and better these days, and ridiculed people who didn't believe it, are paying close attention to this. Reminder that they own Github as well as what is likely the single most widely used code editor.

stavros 5y ago

Is there no way to run unsigned software on windows?

the_only_law 5y ago
For drivers, I don’t think so. You can enable some boot settings that allow you to run unsigned drivers, for development purposes, but it will revert upon reboot, without anyway to enable it permanently.
- ebanana 5y ago
  you would have to automate that somehow if it becomes an issue
  - heavyset_go 5y ago
    All Microsoft has to do to stop that from being a problem is to tell Defender to block that automation from running on Windows, for example, by refusing to run anything signed with the automation developer's certificates.
    - ebanana 5y ago
      yeah thats true, you can get around some stuff with modified keyboards, accessiblity access, automated mouse but then you are just hacking things together at that point
- stavros 5y ago
  Oh wow, the refusal is devastating then...
- dataflow 5y ago
  There is: test signing. Painful for non-savvy users, but not impossible.
- XenophileJKO 5y ago
  Actually you can turn off enforcement if you want to. Requires a reboot and going into safe mode if I remember correctly. I have done it before when loading hacked drivers for old hardware, etc.

heavyset_go 5y ago

> Microsoft Process Explorer has the same functionality so they don't have standing to block competitors then go and include the exact same features in their own software. > Microsoft has been secretly adding more powerful features than Process Hacker via their SAC product – SAC has no security whatsoever by design – they're clearly targeting the project not because of any actual technical issues but rather because we're more popular than their products, so they're using the same (illegal and anti-competitive) tactics they used against Netscape Navigator to eliminate competition but also labeling the project malicious in an attempt to mislead the competition regulators. Yet another example of a trillion dollar tech company stifling competition and innovation with anti-competitive tactics. Both Microsoft and Apple require developers to sign software in order for their apps to run on Windows or macOS. Developers must pay to buy and renew their certificates regularly and must remain in good standing with either company if they want their apps to run on either OS. At any time, and for any reason, Microsoft or Apple can revoke your certificates and prevent Windows or macOS from running your apps at all. The control over what apps can run on Windows or macOS is all about securing profits for either company, first and foremost. Actual security is just an afterthought. Both companies take it one step further and are locking developers out of kernel space. Apple stills signs a few third-party .kexts, like macFUSE, but everyone else is out of luck. Microsoft needs to sign kernel-mode drivers or situations like the one in the OP will occur. This is certainly different than, but reminiscent of, the situation with AppGet and Microsoft's clone, Winget[1]. [1] https://keivan.io/the-day-appget-died/ https://keivan.io/the-day-appget-died/

yread 5y ago
> SAC do you mean Special administration console? or Semi-annual channel?
- heavyset_go 5y ago
  Not sure, I'm quoting directly from the article.
  - y4mi 5y ago
    The same question has been answered in the linked GitHub issue, though the comment was marked as off topic. It's special administrative console, more in depth info what that actually is in the comment. https://github.com/processhacker/processhacker/discussions/773#discussioncomment-1186451 https://github.com/processhacker/processhacker/discussions/7...

spacemanmatt 5y ago

I know people who pretend that Nadella has made the company so different. Microsoft will never change.

krylon 5y ago
It looked kind of promising for a while. With the pivot to cloud services, there was reason to hope they just would not care any more about pulling that kind of move for desktop Windows. I guess after a decade of watching Apple and Google getting away with stuff that Microsoft would have been drawn and quartered for twenty years ago, they decided it was safe for them get back to their old ways. sigh Would have been nice, though.

mavhc 5y ago

What's SAC?

tyingq 5y ago
The "Special Administration Console". Oddly, I can't find normal docs for it on microsoft.com, so here's the Azure docs for it: https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-machines/serial-console-windows https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-...

zahllos 5y ago

The article mentions Process Explorer. Since Sysinternals were bought by Microsoft many years ago and the tools are distributed directly via Microsoft, such tools are unlikely to have an issue being signed. A brief history of the process for those not following it. Originally for kernel-mode drivers, you needed a code signing certificate cross signed by Microsoft's root. This means that the certificate follows a chain up to a standard CA _and also_ one Microsoft use to approve that CA to issue kernel-mode certificates. It was not sufficient to have a certificate capable of signing code, even with MS' OIDs for that. Then, around Windows 10 I think, Microsoft announced that one would need to acquire an EV certificate. You would then be required to submit the driver package via sysdev.microsoft.com and after spending time in Ballmer's Brewery, it would come out signed by Microsoft. It was technically possible to use the old mechanism at this stage too, provided the end user did not have UEFI secure boot enabled. IF secure boot were enabled, the kernel would: a) if the driver was signed pre-Win10, accept it, b) if it was signed post win-10 RTM date and by Microsoft, accept otherwise reject. Thus the only mechanism to realistically get your driver working on all Windows out of the box is to submit via sysdev. You can't realistically ask users to disable secure boot, even if this is entirely possible on all x86 motherboards. Finally, the cross signed roots expire soon and I think some already have. Microsoft have decided that this mechanism will now be retired, and all drivers must be signed via sysdev from now on. You still require an EV certificate as well, to sign the package. This is a bit of a mixed bag. On the one hand, Microsoft have repeatedly signed the shim maintained by redhat in order to allow Linux distributions to boot directly on secure boot-enabled hardware (UEFI binaries also go through this process and always have). Microsoft have their keys in the default keychain because they bothered to be involved in the process, unlike linux companies like Redhat. So on the one hand, they're being quite friendly to open source. On the other hand, the push to EV certs rules out individual developers like myself[1]. I could register a company but... that entails effort and expense for a hobby project. And now hobbyist projects like this run the risk of being rejected by MS. I mostly believe this is an attempt to reduce the number of code signing cert leaks that result in people writing malware, and lock down the Windows kernel a bit more, but still. It is a shame. [1] This is because most CAs won't issue EV certificates to individuals, even if those individuals happen to have detailed knowledge of cryptography and all the pkcs.

5y ago

guilhas 5y ago

Seriously, I don't understand Firefox, Microsoft, Google... always alienating community to reimplement something that already exists, works well, and they rarely do better....

happynacho 5y ago
It's simple. Money.
- 2OEH8eoCRo0 5y ago
  I had a highschool history teacher who said that money/power is the answer to everything. If you don't know the answer, just say money; it's usually right.
  - hoseja 5y ago
    What a great teacher. Surprised they let them teach history (national indoctrination) of all things.

eps 5y ago

In related news - ever wondered why Windows 11 can't be installed on "older computers"? You know, the ones that don't have a TPM chip? Now you know. Windows 11 completes the lock-up of the OS. That's why Windows 11 exists in the first place. All other changes are secondary. Microsoft knows they would've not been able to pull shit like this as a Windows 10 update, so they were effectively forced to do a version increase. Against older promises of W10 being the last Windows version ever. Welcome to the future that Microsoft always wanted, but couldn't have - a platform with airtight control. Just like what Apple has with its AppStore and its wonderful, wonderful 30% commission. Almost there and the lemmings didn't even notice it, distracted by the new and friendly Microsoft front, free upgrades to Windows 10 and centered Start menu in Windows 11. Mark my words - Windows 12 will severely impede direct installation even of an user-space software, funnelling everyone to go through the store. That's the end goal and we will all be there in a couple of years, whether we want it or not.

pabs3 5y ago
Someone recently got Windows 11 installed and working on a Pentium 4, so it doesn't seem that the restrictions are hard to bypass.
pjmlp 5y ago
But it will be built on top of WSL3 and all hackers will jump of joy with Windows/Linux.
- intricatedetail 5y ago
  Many people only use Windows because the software they have don't have a Linux build. Maybe people should start pressuring vendors to make Linux builds and that could end Windows.
  - gavinray 5y ago
    Bingo. Switched from 10 years of Debian-based linux (mostly Ubuntu, recently Pop_OS) to Windows because of some MIDI driver thing I could not get to install in WINE. I have had a significantly less pleasant time on both Win10 and Win11, and it's slow as hell. Ubuntu/Ubuntu-derivatives with Regolith as a DE + Tiling WM is the best computing experience I've ever had (Disclaimer: Have never used a Mac. Have been told OSx is better than Linux by people who have used both for long time.) https://regolith-linux.org/ https://regolith-linux.org/ The ironic thing is that, I later had a passing convo with a developer of a DAW, who told me that MIDI driver stuff is usually for running specific software from the vendor and that MIDI is universal over USB. So I never even needed to switch in the first place! I was just too hardware-stupid to know this! Oh man it hurts my soul. I could switch back but it takes a whole weekend to properly backup + wipe and setup a machine. I think I am going to go back to Pop_OS or Ubuntu though.

elmo2you 5y ago

Monopoly abuse by any other name is still just that. Microsoft never did change, nor will it, no mater how many they manage to fool, manipulate or bribe. It remains a criminal enterprise that should be cut down. But that will never happen, as long as the government(s) controlling this company are made of the same DNA. Good luck to those who have the luxury of a choice to avoid this company (and similar ones). Even more if they still choose not to. Most of all, good luck for those who don't even have a choice, for they most likely will need luck more than anyone else.

nix23 5y ago
Yeah funny times we life in, from Oracle you get a free enterprise linux, from Microsoft a opensoured MSDOS 1.0 ;) Edit: Correction, MSDOS 1.25 and 2.0 was released too
- orionblastar 5y ago
  Microsoft released their own Linux: https://www.tomshardware.com/news/microsoft-released-cbl-mariner-linux-distro https://www.tomshardware.com/news/microsoft-released-cbl-mar... As far as opensource DOS, nothing beats FreeDOS: https://www.freedos.org/ https://www.freedos.org/
  - nix23 5y ago
    >>CBL-Mariner is an internal Linux distribution for Microsoft’s cloud infrastructure and edge products and services. Oh yes please...i want that universal Linux Distribution ;) >nothing beats FreeDOS Dosbox and dosbox-x beat FreeDOS anyday.
    - anthk 5y ago
      Call me when you can run real drivers in DOSBox-X. And, still, XDOSemu+FreeDOS runs circles over DOSBox and DOSBox-x.
      - 5y ago

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

ogurechny 5y ago

Keep in mind this has happened because people agreed that they can't (normally) run code not singed by someone else (Microsoft) on their own system for “security” reasons. Well, it was not security, it actually was a way to keep keys to themselves, and hold the user system as a hostage. And it has been explained many times by many people. If you care about software freedoms, even just a tiny bit, you wouldn't touch “Microsoft open source”, and you wouldn't be happy about your friends using any of it, like you wouldn't be happy about seeing them with a heroin syringe. That is going to explode spectacularly one day.

29athrowaway 5y ago
The user wants convenience, and then, under the premise of convenience, corporations create systems that give them the convenience they want in exchange for their privacy and freedom. Being spied on, having forced updates, a remote kill switch on your computer, "telemetry", advertisement, and the best of all: your government being bullied and lobbied on with the money you paid... it is all worth it because you can run a stupid DirectX game at 60 fps instead of 58 fps. Until the forced update interrupts your game, that is.
- _8j50 5y ago
  Usability triumphs everything. Even privacy. Either pass pro-consumer laws or compete with them using free alternatives. Why do you expect a corporation to care about your privacy or well being? They would be using small children, paying them a loaf of bread a week making it illegal to not do business with them if they could. People have rights and equality before the law , corporations not so much.
- hoseja 5y ago
  You can run the game at 60fps instead of 600spf though.
_8j50 5y ago
That is blatant false-dichotomy. You don't need to undermine the immense level of security improvement introduced by driver signing. Kernel mode rootkits are very hard to detect and eradicate. Right now, windows kernel mode rootkits rely on exploiting vulnerable drivers (very easy to detect when vulnerable drivers are loaded). It's not just signing but MS requiring valudation. If only Linux distros required this by default (with a boot option to turn off validation). If you wouldn't touch Microsoft open source but you would touch Google open source (say Chrome or their contributions to the Linux kernel), I would love to hear how that is different. Personally, the software I use is not a matter of ideology but a matter if the best tool for the task at hand. But your observation on how MS is using adversarial compatibility against Linux (flipping the table) is correct. I just don't see how post-systemd gnu/linux is all that different, perhaps because it is many megacorps contributing and controlling Linux? It's not exactly driven by software freedom anymore.

deleted 5y ago

[deleted]

chris_wot 5y ago

ReactOS is looking better and better.

MrStonedOne 5y ago

From: https://github.com/processhacker/processhacker/discussions/773#discussioncomment-1124432 https://github.com/processhacker/processhacker/discussions/7... >The existing drivers are compatible with Win11 and haven't been blocked by Microsoft yet... The large majority of changes by Microsoft are limited to restricting the Windows API with signature checks that block competitors software (e.g. CreateWindowInBand, NtQuerySystemInformation, NtQueryInformationProcess to name a few) rather than directly targeting the drivers themselves. >The signature checks added to those functions and classes only block third-parties and this includes signed binaries. We won't be able to implement the same functionality as Task Manager and Process Explorer because of those Microsoft-only signature checks even after we sort out the submission issue. >Always-on-top, Auto-elevation, DPS statistics, Default taskmgr application preferences (Microsoft hardcoded taskmgr.exe blocking competitors), GPU statistics (deliberately broken on Win10 and Win11 recently) and the DirectUI framework are some examples of features that I want to implement and are currently implemented by Task Manager but are Microsoft-only signature restricted while newer more advanced security like PPL that we desperately need are also Microsoft-only signature restricted. >The only certificate allowed to use these and other functionality is now limited to Microsoft Windows certificates - the same certificates used with Task Manager and Process Explorer - while SAC has even more powerful functionality than anything else (including Process Hacker) with absolutely no security whatsoever. So, basically, for some reason, Microsoft wants to make it very hard for you to see whats running on your computer...

jenscow 5y ago
> So, basically, for some reason, Microsoft wants to make it very hard for you to see whats running on your computer... That's my take on it, too. I doubt they care about a "competing" task-manager tool.
api 5y ago
> So, basically, for some reason, Microsoft wants to make it very hard for you to see whats running on your computer... So they can run spyware. Nearly every user hostile policy or behavior can be explained by the insatiable lust for data.

2OEH8eoCRo0 5y ago

Smells like a lawsuit.

jmclnx 5y ago
Yes, and seems they are based in Germany, so I would think with the EU laws, they have a very good chance of winning. If based in the US, they would be SOL.

wiz21c 5y ago

Time to add the right to use a computer as you see fit in the human rights, before it's too late...

FateOfNations 5y ago
Use a computer, versus use specific commercial software (Windows)?

rkagerer 5y ago

Microsoft is locking certain API's: Always-on-top, Auto-elevation, DPS statistics, Default taskmgr application preferences (Microsoft hardcoded taskmgr.exe blocking competitors), GPU statistics (deliberately broken on Win10 and Win11 recently) and the DirectUI framework are some examples of features that I want to implement and are currently implemented by Task Manager but are Microsoft-only signature restricted while newer more advanced security like PPL that we desperately need are also Microsoft-only signature restricted.

no_time 5y ago
I'm not familiar with the rest but how is Always-on-top locked away? Its such a basic thing and a lot of programs are using it.
- therein 5y ago
  SetWindowPos with HWND_TOPMOST fails with Access Denied. CreateWindowInBand also fails with Access Denied.
  - no_time 5y ago
    That's so weird. No idea why they restricted that but not the other ways of setting a window to always stay on top. Like whatever Firefox's picture-in-picutre uses. EDIT: I guess they want to prevent you from doing interesting things like staying on top of the lockscreen. This article sheds some light on the Z ordering changes since win8 https://blog.adeltax.com/window-z-order-in-windows-10/ https://blog.adeltax.com/window-z-order-in-windows-10/
    - rkagerer 5y ago
      16 new Window bands (layers) is excessive. "Activate Windows" and Cortana each get their very own. Locking other vendors out of that functionality (eg. can't create a Notifications panel alternative) is anti-competitive and degrades one of the best features of Windows (the ability for others to improve it as they see fit).

account-5 5y ago

I built a computer in 2012 approx. Its still going strong running MX Linux. I'm running Win 10 in vbox. I'm sure it would run Win 10 but I'm not in the habit of running something that find of phoning home. As long as I can run Windows for the few things I need if for in vbox I don't care. It would amuse me that I would be running an os in software that wouldn't run on my hardware!

Shorel 5y ago

I've had to authorize lots of Steam games this month in 'Windows Security' protected folders just so be able to save replays, or basic controls configuration. I think MS is going for the kill against Steam this time. And this is with Windows 10. Windows 11 will require MS permission, and some Steam games will simply never work there. But you will be able to purchase them again in the MS Store.

kevingadd 5y ago
Arguably this is Valve's fault because they insist on putting a ton of stuff in secure folders (under Program Files) instead of where they belong (in the user's home/data directories) They've had a LONG time to fix this.
- garaetjjte 5y ago
  That's just game fault that it saves data in game files instead of user directory.
  - kevingadd 5y ago
    No, Steam puts stuff like steam cloud in the programfiles dir as well. It's totally under their control where it goes.
    - garaetjjte 5y ago
      Steam Cloud files location is also specified by game developer: https://partner.steamgames.com/doc/features/cloud https://partner.steamgames.com/doc/features/cloud
- RealStickman_ 5y ago
  Isn't that just because the default library is in the steam install folder? (On windows)
  - ryanlol 5y ago

EVa5I7bHFq9mnYK 5y ago

I honestly googled what the "SAC" stands for, but couldn't find anything. Please, please people, don't assume everybody knows your acronyms.

layer8 5y ago
Special Administration Console

excalibur 5y ago

> Windows owns the market for the simple reason it's not some locked down garbage controlled system How did you come to THAT conclusion?

userbinator 5y ago
That used to be true. But clearly Windows is going in the same direction as Android and macOS.

sbisson 5y ago

It’s not quite as bad as presented here; yes Microsoft is in the process of deprecating kernel mode drivers as part of its current security push, however it’s following Linux and implementing eBPF as a more secure alternative that runs mostly in user land and in a sandbox in kernel space. For the type of thing that this app does, it’s a logical change of direction that does not require the same level of EV code signing.

roblabla 5y ago
Microsoft's eBPF is a very different beast from Linux's eBPF. It is contained to very few subsystems (Currently network, filesystem to come) and doesn't have the same facilities Linux has with dynamic probes to hook arbitrary kernel functions. Windows also has DTrace, which does support arbitrary kernel hooks, but it requires booting in a special mode with bcdedit /set dtrace ON, which makes it unusable for machines not under your direct control. None of those give enough visibility in the kernel structures to fully subsume kernel mode drivers. And further, they don't allow some of the advanced capabilities that are provided by things like ProcessHacker, such as killing PPL, forcefully closing remote handles, and a bunch of other stuff that is only possible via a kernel driver.