5 ms·

Agreed. Windows Server 2000 through Windows 7 were peak Microsoft operating system. By Windows 2000 Server, they finally had the architecture right, and had fl

Agreed. Windows Server 2000 through Windows 7 were peak Microsoft operating system. By Windows 2000 Server, they finally had the architecture right, and had flushed out most of the 16 bit legacy. The big win with Windows 7 was that they finally figured out how to make it stop crashing. There were two big fixes. First, the Static Driver Verifier. This verified that kernel drivers couldn't crash the rest of the kernel. First large scale application of proof of correctness technology. Drivers could still fail, but not overwrite other parts of the kernel. This put a huge dent into driver-induced crashes. Second was a dump classifier. Early machine learning. When the system crashed, a dump was sent to Microsoft. The classifier tried to bring similar dumps together, so one developer got a big collection of similar crashes. When you have hundreds of dumps of the same bug, locating the bug gets much easier. Between both of those, the Blue Screen of Death mostly disappeared.

ryao 2y ago
Drivers can crash the rest of the kernel in Windows 7. People playing games during the Windows 7 days should remember plenty of blue screens citing either graphics drivers (mainly for ATI/AMD graphics) or their kernel anticheat software. Second, a “proof of correctness” has never been made for any kernel. Even the seL4 guys do not call their proof a proof of correctness.
- tyree731 2y ago
  Not the operating system: https://en.m.wikipedia.org/wiki/Driver_Verifier https://en.m.wikipedia.org/wiki/Driver_Verifier
  - ZeroWidthJoiner 2y ago
    Driver Verifier is a tool that developers can choose to use for testing and debugging purposes. It's not used on production machines and it does nothing to prevent a badly written driver from crashing the kernel.
    - Animats 2y ago
      Kernel drivers have to be verified by the driver verifier to pass Windows Hardware Qualification Labs certification and get signed with the Windows signing key that lets them load without warnings. There are fewer outside kernel drivers today, though, because plugging random peripheral cards into PC buses is no longer a big thing.
      - ZeroWidthJoiner 2y ago
        This is true for certification, which is mandatory for Server OS, distributing through Windows Update, or certain classes of drivers such as anti-malware or biometric authentication, but you can still submit drivers to Microsoft for "attestation signing" that will load without warnings on desktop OS without having to run them through the testing suite. In any case, running the certification tests does not provide runtime protection for drivers running in kernel mode, as demonstrated by CrowdStrike. Only Windows 10 started introducing hardware virtualization-based isolation of kernel components (to provide isolation of security subsystems, not runtime checks to prevent crashes): https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://learn.microsoft.com/en-us/windows-hardware/design/de...
      - ryao 2y ago
        Yet drivers that have passed Windows Hardware Qualification Labs certification have had blue screens. Also, Microsoft hands out Windows kernel driver signing keys to anyone who pays them. You don't need to have a driver go through the Windows Hardware Qualification Labs to be able to sign it with a key signed by Microsoft.
  - vbezhenar 2y ago
    My PC used to regularly crash Windows 10 because of buggy Nvidia driver. Eventually they fixed the bug, but until then, I had a crash every few days.
  - ryao 2y ago
    From your own link: "Driver Verifier is not normally used on machines used in productive work. It can cause ... blue screen fatal system errors."
  - deleted 2y ago
    [deleted]
- ycombinatrix 2y ago
  They didn't "prove the kernel is correct", they built a tool to prove that a single driver maintains an invariant throughout execution.
  - ryao 2y ago
    It does not prove that the driver will not crash the kernel. It should be fairly easy to find a driver that passed QA testing under that tool, yet still crashed the kernel. You just need one of the many driver developers for Microsoft Windows to admit to having used that tool and fixed a crash bug that it missed, and you have an example. Likely all developers who have used that tool can confirm that they have had bugs that the tool missed.
- willcipriano 2y ago
  I lost less time to bluescreens than I have to forced updates and sidestepping value add nonsense like one drive, edge.
breadwinner 2y ago
> First large scale application of proof of correctness technology. Curious about this. How does it work? Does it use any methods invented by Leslie Lamport?
mubou 2y ago
Another often-underappreciated advancement was the UAC added in Vista. People hated it, but viruses and rootkits were a major problem for XP.
- ycombinatrix 2y ago
  It is more of a warning than an actual security mechanism though. Similar to Mark of the Web.
  - mubou 2y ago
    No, in XP you were essentially logged in as root 24/7 (assuming it was your machine), and any program -- including your browser -- was running as root too. I remember watching a talk about how stupidly easy it was to write rootkits for XP. "Drive-by viruses" were a thing, where a website could literally install a rootkit on your machine just by visiting it (usually taking advantage of some exploit in flash, java, or adobe reader). Vista flipped it, by disabling the admin account, so that in order to do something as admin you needed to "sudo" first. That alone put a stop to tons of viruses.
    - bigfatkitten 2y ago
      I used to work in the security team at a financial institution that was still running XP until around 2017. We got to a point around 2015 where drive-by exploit kit developers just weren't targeting XP and IE8 anymore. Phishing landing pages would roll through all the payloads they had and silently exit.
  - wolrah 2y ago
    > It is more of a warning than an actual security mechanism though. Similar to Mark of the Web. It's both a warning and an actual security mechanism. Obviously its most visible form is triggered when an application tries to write to system-level settings or important parts of the filesystem, and also when various heuristics decide that the application is likely to want to do so (IIRC "setup.exe" and "install.exe" at the root of a removable disk are assumed to need elevation). Because Microsoft knew that a lot of older software wrote to system areas just because it predated Windows being a multi-user system UAC also provided a partial sandboxing mechanism where writes to these areas could be redirected to user-specific folders. The warning was also a tool in itself, because the fact that it annoyed users finally provided the right kick in the ass to lazy software developers who had no need to be writing to privileged areas of the system and could easily run under a limited user but hadn't bothered to because most non-corporate NT users were owners and thus admins and most corporate environments would just accept "make users local admin". A portion of the reason we saw UAC prompts a lot less in later versions of Windows is because Microsoft tweaked some things to make certain settings per-user and to reorganize certain dialogs so unprivileged settings could be accessed without escalation, but a lot of it is because applications that had been doing it wrong for as long as NT had existed finally got around to changing their default paths.
Izikiel43 2y ago
> This verified that kernel drivers couldn't crash the rest of the kernel. How did crowdstrike end up crashing windows though?
- josheva 2y ago
  > Static Driver Verifier Well, the Crowdstrike driver isn't (wasn't?) static. It loaded a file that Crowdstrike changed with an update. Most drivers pass through rigorous verification on every change. But Crowdstrike is (was?) allowed to change their driver whenever they want by designing it to load a file.
  - hedora 2y ago
    The EU forced MS to allow stuff like CrowdStrike as part of an anti-trust settlement. MS tried to use the incident to get the regulators to waive the requirement.
    - wpm 2y ago
      I'm all for anti-trust and anti-monopoly but christ alive an operating system vendor gatekeeping their kernel is literally the whole point of being an operating system vendor. Braindead regulation.
      - philistine 2y ago
        > Braindead regulation. Only because OP didn't give the full story. Microsoft wanted to close direct access to the kernel. AV companies complained to regulators in the EU. The EU asked Microsoft if they were willing to maintain access to replacement functionality and to stick to using that functionality for its own separately sold AV products. Microsoft said no, and instead of fighting, just let Windows wither on the vine with full kernel access for all the bozos. Crowdstrike was inevitable.
      - immibis 2y ago
        No, braindead take. The purpose of being an operating system vendor is to sell an operating system. If someone else modifies your operating system after they buy it, they get to keep both pieces. You don't get to stop them from modifying the thing they bought. Do you like nanny states? How about nanny corporations?
raggi 2y ago
I think it ended at the first "ribbon" UI, which was in the 2003 era, but not all products ate the dirt at once.
- SoftTalker 2y ago
  Yeah the ribbon drove me to LibreOffice and Google Docs and I haven’t been back. Windows 2000 Pro was the peak of the Windows UX. They could not leave well enough alone.
- asdajksah2123 2y ago
  The original ribbon sucked but with the improvements it's hard to say it's generally a bad choice. The ribbon is a great fit for Office style apps with their large number of buttons and options. Especially after they added the ability to minimize, expand on hover, or keep expanded (originally this was the only option), the ribbon has been a great addition. But then they also had to go ahead and dump it in places where it had no reason to be, such as Windows Explorer.
  - hulitu 2y ago
    > The original ribbon sucked but with the improvements it's hard to say it's generally a bad choice. It is a terrible choice. Always have to search for items.
  - trinix912 2y ago
    > The ribbon is a great fit for Office style apps with their large number of buttons and options. To me this is the exact use case where it fails. I find it way harder to parse as it's visually intense (tons of icons, buttons of various sizes, those little arrows that are sometimes in group corners...). Office 2003 had menus that were at most 20-25 entries long with icons that were just the right size to hint what the entries are about, yet not get in the way. The ribbon in Office 2007 (Word, for example) has several tabs full of icons stretching the entire window width or even more. Mnemonics were also made impractical as they dynamically bind to the buttons of the currently visible tab instead of the actions themselves.
  - 2y ago
pjmlp 2y ago
I agree with one big exception, the refocus on COM as the main Windows API delivery mechanism. It is great as idea, pity that Microsoft keeps failing to deliver in developer tooling that actually makes COM fun to use, instead of something we have to endure. From OLE 1.0 pages long infrastructure in Windows 16 bit, via ActiveX, OCX, MFC, ATL, WTL, .NET (RCW/CCW), WinRT with. NET Native and C++/CX, C++/WinRT, WIL, nano-COM, .NET 5+ COM,.... Not only do they keep rebooting how to approach COM development, in terms of Visual Studio tooling, one is worse than the other, not at the same feature parity, only to be dropped after the team's KPI change focus. When they made the Hilo demo for Windows Vista and later Windows 7 developers with such great focus on being back on COM, after how Longhorn went down, a better tooling would be expected. https://devblogs.microsoft.com/cppblog/announcing-hilo/ https://devblogs.microsoft.com/cppblog/announcing-hilo/
GeekyBear 2y ago
> The big win with Windows 7 was that they finally figured out how to make it stop crashing. Changing the default system setting so the system automatically rebooted itself (instead of displaying the BSOD until manually rebooted) was the reason users no longer saw the BSOD.

ryao 2y ago

Drivers can crash the rest of the kernel in Windows 7. People playing games during the Windows 7 days should remember plenty of blue screens citing either graphics drivers (mainly for ATI/AMD graphics) or their kernel anticheat software. Second, a “proof of correctness” has never been made for any kernel. Even the seL4 guys do not call their proof a proof of correctness.

tyree731 2y ago
Not the operating system: https://en.m.wikipedia.org/wiki/Driver_Verifier https://en.m.wikipedia.org/wiki/Driver_Verifier
- ZeroWidthJoiner 2y ago
  Driver Verifier is a tool that developers can choose to use for testing and debugging purposes. It's not used on production machines and it does nothing to prevent a badly written driver from crashing the kernel.
  - Animats 2y ago
    Kernel drivers have to be verified by the driver verifier to pass Windows Hardware Qualification Labs certification and get signed with the Windows signing key that lets them load without warnings. There are fewer outside kernel drivers today, though, because plugging random peripheral cards into PC buses is no longer a big thing.
    - ZeroWidthJoiner 2y ago
      This is true for certification, which is mandatory for Server OS, distributing through Windows Update, or certain classes of drivers such as anti-malware or biometric authentication, but you can still submit drivers to Microsoft for "attestation signing" that will load without warnings on desktop OS without having to run them through the testing suite. In any case, running the certification tests does not provide runtime protection for drivers running in kernel mode, as demonstrated by CrowdStrike. Only Windows 10 started introducing hardware virtualization-based isolation of kernel components (to provide isolation of security subsystems, not runtime checks to prevent crashes): https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://learn.microsoft.com/en-us/windows-hardware/design/de...
    - ryao 2y ago
      Yet drivers that have passed Windows Hardware Qualification Labs certification have had blue screens. Also, Microsoft hands out Windows kernel driver signing keys to anyone who pays them. You don't need to have a driver go through the Windows Hardware Qualification Labs to be able to sign it with a key signed by Microsoft.
- vbezhenar 2y ago
  My PC used to regularly crash Windows 10 because of buggy Nvidia driver. Eventually they fixed the bug, but until then, I had a crash every few days.
- ryao 2y ago
  From your own link: "Driver Verifier is not normally used on machines used in productive work. It can cause ... blue screen fatal system errors."
- deleted 2y ago
  [deleted]
ycombinatrix 2y ago
They didn't "prove the kernel is correct", they built a tool to prove that a single driver maintains an invariant throughout execution.
- ryao 2y ago
  It does not prove that the driver will not crash the kernel. It should be fairly easy to find a driver that passed QA testing under that tool, yet still crashed the kernel. You just need one of the many driver developers for Microsoft Windows to admit to having used that tool and fixed a crash bug that it missed, and you have an example. Likely all developers who have used that tool can confirm that they have had bugs that the tool missed.
willcipriano 2y ago
I lost less time to bluescreens than I have to forced updates and sidestepping value add nonsense like one drive, edge.

breadwinner 2y ago

> First large scale application of proof of correctness technology. Curious about this. How does it work? Does it use any methods invented by Leslie Lamport?

mubou 2y ago

Another often-underappreciated advancement was the UAC added in Vista. People hated it, but viruses and rootkits were a major problem for XP.

ycombinatrix 2y ago
It is more of a warning than an actual security mechanism though. Similar to Mark of the Web.
- mubou 2y ago
  No, in XP you were essentially logged in as root 24/7 (assuming it was your machine), and any program -- including your browser -- was running as root too. I remember watching a talk about how stupidly easy it was to write rootkits for XP. "Drive-by viruses" were a thing, where a website could literally install a rootkit on your machine just by visiting it (usually taking advantage of some exploit in flash, java, or adobe reader). Vista flipped it, by disabling the admin account, so that in order to do something as admin you needed to "sudo" first. That alone put a stop to tons of viruses.
  - bigfatkitten 2y ago
    I used to work in the security team at a financial institution that was still running XP until around 2017. We got to a point around 2015 where drive-by exploit kit developers just weren't targeting XP and IE8 anymore. Phishing landing pages would roll through all the payloads they had and silently exit.
- wolrah 2y ago
  > It is more of a warning than an actual security mechanism though. Similar to Mark of the Web. It's both a warning and an actual security mechanism. Obviously its most visible form is triggered when an application tries to write to system-level settings or important parts of the filesystem, and also when various heuristics decide that the application is likely to want to do so (IIRC "setup.exe" and "install.exe" at the root of a removable disk are assumed to need elevation). Because Microsoft knew that a lot of older software wrote to system areas just because it predated Windows being a multi-user system UAC also provided a partial sandboxing mechanism where writes to these areas could be redirected to user-specific folders. The warning was also a tool in itself, because the fact that it annoyed users finally provided the right kick in the ass to lazy software developers who had no need to be writing to privileged areas of the system and could easily run under a limited user but hadn't bothered to because most non-corporate NT users were owners and thus admins and most corporate environments would just accept "make users local admin". A portion of the reason we saw UAC prompts a lot less in later versions of Windows is because Microsoft tweaked some things to make certain settings per-user and to reorganize certain dialogs so unprivileged settings could be accessed without escalation, but a lot of it is because applications that had been doing it wrong for as long as NT had existed finally got around to changing their default paths.

Izikiel43 2y ago

> This verified that kernel drivers couldn't crash the rest of the kernel. How did crowdstrike end up crashing windows though?

josheva 2y ago
> Static Driver Verifier Well, the Crowdstrike driver isn't (wasn't?) static. It loaded a file that Crowdstrike changed with an update. Most drivers pass through rigorous verification on every change. But Crowdstrike is (was?) allowed to change their driver whenever they want by designing it to load a file.
- hedora 2y ago
  The EU forced MS to allow stuff like CrowdStrike as part of an anti-trust settlement. MS tried to use the incident to get the regulators to waive the requirement.
  - wpm 2y ago
    I'm all for anti-trust and anti-monopoly but christ alive an operating system vendor gatekeeping their kernel is literally the whole point of being an operating system vendor. Braindead regulation.
    - philistine 2y ago
      > Braindead regulation. Only because OP didn't give the full story. Microsoft wanted to close direct access to the kernel. AV companies complained to regulators in the EU. The EU asked Microsoft if they were willing to maintain access to replacement functionality and to stick to using that functionality for its own separately sold AV products. Microsoft said no, and instead of fighting, just let Windows wither on the vine with full kernel access for all the bozos. Crowdstrike was inevitable.
    - immibis 2y ago
      No, braindead take. The purpose of being an operating system vendor is to sell an operating system. If someone else modifies your operating system after they buy it, they get to keep both pieces. You don't get to stop them from modifying the thing they bought. Do you like nanny states? How about nanny corporations?

raggi 2y ago

I think it ended at the first "ribbon" UI, which was in the 2003 era, but not all products ate the dirt at once.

SoftTalker 2y ago
Yeah the ribbon drove me to LibreOffice and Google Docs and I haven’t been back. Windows 2000 Pro was the peak of the Windows UX. They could not leave well enough alone.
asdajksah2123 2y ago
The original ribbon sucked but with the improvements it's hard to say it's generally a bad choice. The ribbon is a great fit for Office style apps with their large number of buttons and options. Especially after they added the ability to minimize, expand on hover, or keep expanded (originally this was the only option), the ribbon has been a great addition. But then they also had to go ahead and dump it in places where it had no reason to be, such as Windows Explorer.
- hulitu 2y ago
  > The original ribbon sucked but with the improvements it's hard to say it's generally a bad choice. It is a terrible choice. Always have to search for items.
- trinix912 2y ago
  > The ribbon is a great fit for Office style apps with their large number of buttons and options. To me this is the exact use case where it fails. I find it way harder to parse as it's visually intense (tons of icons, buttons of various sizes, those little arrows that are sometimes in group corners...). Office 2003 had menus that were at most 20-25 entries long with icons that were just the right size to hint what the entries are about, yet not get in the way. The ribbon in Office 2007 (Word, for example) has several tabs full of icons stretching the entire window width or even more. Mnemonics were also made impractical as they dynamically bind to the buttons of the currently visible tab instead of the actions themselves.
- 2y ago

pjmlp 2y ago

I agree with one big exception, the refocus on COM as the main Windows API delivery mechanism. It is great as idea, pity that Microsoft keeps failing to deliver in developer tooling that actually makes COM fun to use, instead of something we have to endure. From OLE 1.0 pages long infrastructure in Windows 16 bit, via ActiveX, OCX, MFC, ATL, WTL, .NET (RCW/CCW), WinRT with. NET Native and C++/CX, C++/WinRT, WIL, nano-COM, .NET 5+ COM,.... Not only do they keep rebooting how to approach COM development, in terms of Visual Studio tooling, one is worse than the other, not at the same feature parity, only to be dropped after the team's KPI change focus. When they made the Hilo demo for Windows Vista and later Windows 7 developers with such great focus on being back on COM, after how Longhorn went down, a better tooling would be expected. https://devblogs.microsoft.com/cppblog/announcing-hilo/ https://devblogs.microsoft.com/cppblog/announcing-hilo/

GeekyBear 2y ago

> The big win with Windows 7 was that they finally figured out how to make it stop crashing. Changing the default system setting so the system automatically rebooted itself (instead of displaying the BSOD until manually rebooted) was the reason users no longer saw the BSOD.