Hacker News Reader

Comment by downrightmike | Hacker News Reader

Good, they are security risks. They should also prevent them from being installed.

While I agree at some degree, when end users bought their instance of Windows, the promise was that it will work on that particular machine. A much more user friendly way would be to show a huge red windows at every login that you computer has outdated drivers that pose a security risk, use at your own risk and what are your options.

I'm confused as to where exactly people are getting "Windows is breaking old machines" from this.

The blog post says "they are removing old drivers that *are not being offered* to anyone. They are starting with the subset that also *has newer replacements*, and they will publish the name of drivers removed, and wait for 6 months to hear from any hardware vendors about any concerns. The entire post is target at their driver vendors to maintain their listing in their driver repository better. I'm guessing Microsoft ignored that for decades, and hardware vendors have submitted tons of drivers over the last 25 years and they have a clean up initiative. How is that like crazy?

I am not sure if we read the same article:

> Once that happens, only the hardware partner who published it can bring it back. But there’s a catch. Microsoft may demand a business justification before allowing a republish. And if the partner doesn’t respond within six months, the driver is deleted permanently.

> And while the company claims this is about improving security and reducing compatibility issues, the reality is that it’s cutting support for a lot of older devices in the name of modernization.

> In other words, things that used to work might just stop working.

> Microsoft’s cleanup may sound responsible on the surface, but for anyone still clinging to older hardware or niche accessories, it might feel more like abandonment. Once a driver disappears, finding it again could become a scavenger hunt.

https://techcommunity.microsoft.com/blog/hardwaredevcenter/r...

One can spin anything.

> But there’s a catch. Microsoft may demand a business justification before allowing a republish. And if the partner doesn’t respond within six months, the driver is deleted permanently.

Ok.. and? You're complaining that 6 months isn't enough for a hardware vendor who published a driver that has a replacement and they believe there is a newer replacement for (but they could be wrong)? You're complaining that they might ask "why?"

Say Debian maintainers want to get in touch with a package maintainer. They are thinking of removing it from their repository because no one is using it and there are tings about it they are not sure. They ping the package maintainer. Is it unreasonable to expect a reply in 6 months? should it be 12? 24? Is is also unreasonable for Debian maintainers to ask "Why?" if the package owner's answer (oh no, please keep it)?

> And while the company claims this is about improving security and reducing compatibility issues, the reality is that it’s cutting support for a lot of older devices in the name of modernization.

Ok, editorializing is fine, but literally nothing in the Microsoft post says they are removing drivers from devices and leaving them without drivers. They are removing older expired versions of drivers. Is it possible that a particular old version of a driver is very important for a particular scenario that newer version of the same driver don't cover? Of course. How in the hell would Microsoft know that? They presumably have telemetry on downloads, loaded drivers, etc. But they still can't cover everything.

> In other words, things that used to work might just stop working.

In other words, never make any changes. Things that used to work might just stop working. ok..

oh a scavenger hunt, sounds fun.

What about hardware from vendors that are no longer in business or don’t care to take on support?

One would think they must have a process to deal with partners going our of business https://partner.microsoft.com/en-us/partnership

I don't know what their process is.

What’s the actual risk in a security risk? What’s the bad thing that happens to the user? How is it better or worse than their device failing to function without warning?

Arbitrary code execution.

Here's one recent(ish) example:

https://support.hp.com/ro-en/document/ish_11892982-11893015-...

So if you have a printer with a diver that works on windows 11 in an in use configuration window should basically tell you to spend potentially hundreds of dollars replacing working hardware that may have years of use it in for your own good.

Refusing to do work to say make a xp era printer work in Windows 11 is perfectly comprehensible you aren't owed that labor and even support from a vendor is finite in duration but actively disabling working hardware when the vendor has already done the work feels more like vandalism.

> Good, they are security risks.

Maybe. Maybe not. It's impossible to know without understanding how the PC is used.

Doesn't matter how it is used, old drivers that are known vulnerable are a part of the attack because they are signed valid from microsoft from back before that was a concern.

I was wondering, when vendors submit drivers to Microsoft, does Microsoft audit the code from a security standpoint? Cause these are often not open source, but maybe they're just letting a few people see it. All I could find is the WHQL thing.

I don't think so, unless you're sponsoring new hardware for those affected.

Ya, bricking old hardware just because MS cannot be bothered.

The title is just fearmongering, it's removing the driver from being automatically installed from windows update, not preventing it from being installed altogether. They're also not revoking the signatures either so downloading and installing directly from the vendor site still works (and is still the recommended way to do it).

The equivalent in the linux world would be removing a driver from the main repo, requiring the user to either install the rpm/deb manually or use a third party repo.

This comment should be at the top

Hence the "not bothered". These are a tiny little part of their delivery. They are not doing this to save a few megs in their next multi-gig update cycle. They are doing this to, again, make running older hardware more difficult.

Reply on news.ycombinator.com