3 ms·

Good, they are security risks. They should also prevent them from being installed.

by downrightmike 1y ago

sandworm101 1y ago
Ya, bricking old hardware just because MS cannot be bothered.
- nodja 1y ago
  The title is just fearmongering, it's removing the driver from being automatically installed from windows update, not preventing it from being installed altogether. They're also not revoking the signatures either so downloading and installing directly from the vendor site still works (and is still the recommended way to do it). The equivalent in the linux world would be removing a driver from the main repo, requiring the user to either install the rpm/deb manually or use a third party repo.
  - stevepotter 1y ago
    This comment should be at the top
  - sandworm101 1y ago
    Hence the "not bothered". These are a tiny little part of their delivery. They are not doing this to save a few megs in their next multi-gig update cycle. They are doing this to, again, make running older hardware more difficult.
michaelmrose 1y ago
So if you have a printer with a diver that works on windows 11 in an in use configuration window should basically tell you to spend potentially hundreds of dollars replacing working hardware that may have years of use it in for your own good. Refusing to do work to say make a xp era printer work in Windows 11 is perfectly comprehensible you aren't owed that labor and even support from a vendor is finite in duration but actively disabling working hardware when the vendor has already done the work feels more like vandalism.
zsoltkacsandi 1y ago
While I agree at some degree, when end users bought their instance of Windows, the promise was that it will work on that particular machine. A much more user friendly way would be to show a huge red windows at every login that you computer has outdated drivers that pose a security risk, use at your own risk and what are your options.
- eddythompson80 1y ago
  I'm confused as to where exactly people are getting "Windows is breaking old machines" from this. The blog post says "they are removing old drivers that *are not being offered* to anyone. They are starting with the subset that also *has newer replacements*, and they will publish the name of drivers removed, and wait for 6 months to hear from any hardware vendors about any concerns. The entire post is target at their driver vendors to maintain their listing in their driver repository better. I'm guessing Microsoft ignored that for decades, and hardware vendors have submitted tons of drivers over the last 25 years and they have a clean up initiative. How is that like crazy?
  - zsoltkacsandi 1y ago
    I am not sure if we read the same article: > Once that happens, only the hardware partner who published it can bring it back. But there’s a catch. Microsoft may demand a business justification before allowing a republish. And if the partner doesn’t respond within six months, the driver is deleted permanently. > And while the company claims this is about improving security and reducing compatibility issues, the reality is that it’s cutting support for a lot of older devices in the name of modernization. > In other words, things that used to work might just stop working. > Microsoft’s cleanup may sound responsible on the surface, but for anyone still clinging to older hardware or niche accessories, it might feel more like abandonment. Once a driver disappears, finding it again could become a scavenger hunt.
    - eddythompson80 1y ago
      https://techcommunity.microsoft.com/blog/hardwaredevcenter/removal-of-unwanted-drivers-from-windows-update/4425647 https://techcommunity.microsoft.com/blog/hardwaredevcenter/r... One can spin anything. > But there’s a catch. Microsoft may demand a business justification before allowing a republish. And if the partner doesn’t respond within six months, the driver is deleted permanently. Ok.. and? You're complaining that 6 months isn't enough for a hardware vendor who published a driver that has a replacement and they believe there is a newer replacement for (but they could be wrong)? You're complaining that they might ask "why?" Say Debian maintainers want to get in touch with a package maintainer. They are thinking of removing it from their repository because no one is using it and there are tings about it they are not sure. They ping the package maintainer. Is it unreasonable to expect a reply in 6 months? should it be 12? 24? Is is also unreasonable for Debian maintainers to ask "Why?" if the package owner's answer (oh no, please keep it)? > And while the company claims this is about improving security and reducing compatibility issues, the reality is that it’s cutting support for a lot of older devices in the name of modernization. Ok, editorializing is fine, but literally nothing in the Microsoft post says they are removing drivers from devices and leaving them without drivers. They are removing older expired versions of drivers. Is it possible that a particular old version of a driver is very important for a particular scenario that newer version of the same driver don't cover? Of course. How in the hell would Microsoft know that? They presumably have telemetry on downloads, loaded drivers, etc. But they still can't cover everything. > In other words, things that used to work might just stop working. In other words, never make any changes. Things that used to work might just stop working. ok.. > Microsoft’s cleanup may sound responsible on the surface, but for anyone still clinging to older hardware or niche accessories, it might feel more like abandonment. Once a driver disappears, finding it again could become a scavenger hunt. oh a scavenger hunt, sounds fun.
mulmen 1y ago
What’s the actual risk in a security risk? What’s the bad thing that happens to the user? How is it better or worse than their device failing to function without warning?
- criddell 1y ago
  Arbitrary code execution. Here's one recent(ish) example: https://support.hp.com/ro-en/document/ish_11892982-11893015-16/hpsbpi03995 https://support.hp.com/ro-en/document/ish_11892982-11893015-...
foresto 1y ago
> Good, they are security risks. Maybe. Maybe not. It's impossible to know without understanding how the PC is used.
- downrightmike 1y ago
  Doesn't matter how it is used, old drivers that are known vulnerable are a part of the attack because they are signed valid from microsoft from back before that was a concern.
  - frollogaston 1y ago
    I was wondering, when vendors submit drivers to Microsoft, does Microsoft audit the code from a security standpoint? Cause these are often not open source, but maybe they're just letting a few people see it. All I could find is the WHQL thing.
selfhoster11 1y ago
I don't think so, unless you're sponsoring new hardware for those affected.

Good, they are security risks. They should also prevent them from being installed.

sandworm101 1y ago

Ya, bricking old hardware just because MS cannot be bothered.

nodja 1y ago
The title is just fearmongering, it's removing the driver from being automatically installed from windows update, not preventing it from being installed altogether. They're also not revoking the signatures either so downloading and installing directly from the vendor site still works (and is still the recommended way to do it). The equivalent in the linux world would be removing a driver from the main repo, requiring the user to either install the rpm/deb manually or use a third party repo.
- stevepotter 1y ago
  This comment should be at the top
- sandworm101 1y ago
  Hence the "not bothered". These are a tiny little part of their delivery. They are not doing this to save a few megs in their next multi-gig update cycle. They are doing this to, again, make running older hardware more difficult.

michaelmrose 1y ago

So if you have a printer with a diver that works on windows 11 in an in use configuration window should basically tell you to spend potentially hundreds of dollars replacing working hardware that may have years of use it in for your own good. Refusing to do work to say make a xp era printer work in Windows 11 is perfectly comprehensible you aren't owed that labor and even support from a vendor is finite in duration but actively disabling working hardware when the vendor has already done the work feels more like vandalism.

zsoltkacsandi 1y ago

While I agree at some degree, when end users bought their instance of Windows, the promise was that it will work on that particular machine. A much more user friendly way would be to show a huge red windows at every login that you computer has outdated drivers that pose a security risk, use at your own risk and what are your options.

eddythompson80 1y ago
I'm confused as to where exactly people are getting "Windows is breaking old machines" from this. The blog post says "they are removing old drivers that *are not being offered* to anyone. They are starting with the subset that also *has newer replacements*, and they will publish the name of drivers removed, and wait for 6 months to hear from any hardware vendors about any concerns. The entire post is target at their driver vendors to maintain their listing in their driver repository better. I'm guessing Microsoft ignored that for decades, and hardware vendors have submitted tons of drivers over the last 25 years and they have a clean up initiative. How is that like crazy?
- zsoltkacsandi 1y ago
  I am not sure if we read the same article: > Once that happens, only the hardware partner who published it can bring it back. But there’s a catch. Microsoft may demand a business justification before allowing a republish. And if the partner doesn’t respond within six months, the driver is deleted permanently. > And while the company claims this is about improving security and reducing compatibility issues, the reality is that it’s cutting support for a lot of older devices in the name of modernization. > In other words, things that used to work might just stop working. > Microsoft’s cleanup may sound responsible on the surface, but for anyone still clinging to older hardware or niche accessories, it might feel more like abandonment. Once a driver disappears, finding it again could become a scavenger hunt.
  - eddythompson80 1y ago
    https://techcommunity.microsoft.com/blog/hardwaredevcenter/removal-of-unwanted-drivers-from-windows-update/4425647 https://techcommunity.microsoft.com/blog/hardwaredevcenter/r... One can spin anything. > But there’s a catch. Microsoft may demand a business justification before allowing a republish. And if the partner doesn’t respond within six months, the driver is deleted permanently. Ok.. and? You're complaining that 6 months isn't enough for a hardware vendor who published a driver that has a replacement and they believe there is a newer replacement for (but they could be wrong)? You're complaining that they might ask "why?" Say Debian maintainers want to get in touch with a package maintainer. They are thinking of removing it from their repository because no one is using it and there are tings about it they are not sure. They ping the package maintainer. Is it unreasonable to expect a reply in 6 months? should it be 12? 24? Is is also unreasonable for Debian maintainers to ask "Why?" if the package owner's answer (oh no, please keep it)? > And while the company claims this is about improving security and reducing compatibility issues, the reality is that it’s cutting support for a lot of older devices in the name of modernization. Ok, editorializing is fine, but literally nothing in the Microsoft post says they are removing drivers from devices and leaving them without drivers. They are removing older expired versions of drivers. Is it possible that a particular old version of a driver is very important for a particular scenario that newer version of the same driver don't cover? Of course. How in the hell would Microsoft know that? They presumably have telemetry on downloads, loaded drivers, etc. But they still can't cover everything. > In other words, things that used to work might just stop working. In other words, never make any changes. Things that used to work might just stop working. ok.. > Microsoft’s cleanup may sound responsible on the surface, but for anyone still clinging to older hardware or niche accessories, it might feel more like abandonment. Once a driver disappears, finding it again could become a scavenger hunt. oh a scavenger hunt, sounds fun.

mulmen 1y ago

What’s the actual risk in a security risk? What’s the bad thing that happens to the user? How is it better or worse than their device failing to function without warning?

criddell 1y ago
Arbitrary code execution. Here's one recent(ish) example: https://support.hp.com/ro-en/document/ish_11892982-11893015-16/hpsbpi03995 https://support.hp.com/ro-en/document/ish_11892982-11893015-...

foresto 1y ago

> Good, they are security risks. Maybe. Maybe not. It's impossible to know without understanding how the PC is used.

downrightmike 1y ago
Doesn't matter how it is used, old drivers that are known vulnerable are a part of the attack because they are signed valid from microsoft from back before that was a concern.
- frollogaston 1y ago
  I was wondering, when vendors submit drivers to Microsoft, does Microsoft audit the code from a security standpoint? Cause these are often not open source, but maybe they're just letting a few people see it. All I could find is the WHQL thing.

selfhoster11 1y ago

I don't think so, unless you're sponsoring new hardware for those affected.