Windows XP To Block Use Of "Troublesome" Drivers

Johnno74 writes "According to this story on The Register, Windows XP rc2 now includes the ability for Microsoft to prevent users from installing certain device drivers. Sounds like a good idea? Well, apparently among the casualties are ZoneAlarm and BlackIce... Two popular free personal firewall products for windows. Guess What? XP includes its own firewall ... So you don't really need then anyway, right? The full details on how this works are in this 1mb word document on Microsoft's site.

The document details how XP will automatically download the latest drivers for your hardware from the windows update site, and more worringly, XP will reguarly update the list of blocked drivers from the site. Quote from the document:

&nbsp&nbsp&nbsp"On a related note, Windows XP provides the ability for Microsoft to receive crash dump data on specific drivers (i.e. when a user receives a blue screen, we upload that information for further analysis). When Microsoft reporting systems indicate crashes have exceeded a certain threshold, Microsoft will notify the Vendor that the device is being considered for the blocked driver list. If reports pass an even greater threshold, we will then flag that specific version of the driver as needing to be blocked."

Boy, The site that uploads that crash dump data (and whatever else it snags...) better have a lot of bandwidth... ;-) As The Register points out, this brings back memories of how Microsoft killed Caldera DR-DOS by deliberately crashing Windows 3.1 if you were running on DR-DOS -- for no reason other than forcing you to use MS-DOS."

Note: according to this article, the change does not prevent Black Ice or other programs from running per se -- but it does require them to use updated versions tailored for XP.

Comments

Handling the truth (about driver failures)

[warpeightbot]

You can't handle a driver failure.

Exqueeze me??

Hey, I used to write Linux kernel code for a living. I've seen a driver crash all over the place. Multiple times. And you know what? Linux kept on ticking. It's easy to handle a driver crash. Just write the oops to the log device and return from the driver as if nothing happened. Of course, you can't do that when your memory protection has failed (or is non-existient) and the bad driver just scribbled all over your stack...

A driver under Linux is a module. If the module fails, it fails; the scheduler continues to run, and therefore so does the rest of the system. It's not a very pretty way to handle a screwup, but a system complex enough to handle it prettily is gonna be such a resource hog I wouldn't want it. But it does get handled.

As for the wags that say Linux is not a desktop operating system, tell that to my wife, who's been running Red Hat and Mandrake for the last four years. Or better yet, tell it to the Germans, who just threw out Microsoft in favor of SuSE. (And then there's all the folks running OS X, which we all know is just BSD with a nice GUI... and looks a helluvalot like Solaris and CDE...)

You're missing the point

[tulare]

Microsoft is simply doing what it has done for years: describe anybody who has a chance of competing with them, ususally due to a better product, as "troublesome" or "incompatable" or "unstable" and then rewriting critical parts of the operating system to, er... prove their point. I liked DR DOS, and still haven't forgiven M$ for their treatment of it back in the day.

Re:You're missing the point

[Mike Schiraldi]

1. Tech support isn't Microsoft's problem, it's the OEM's problem. When was the last time you even heard of anyone calling Microsoft Tech Support? When my mom is having trouble connecting to MSNBC over MSN using Microsoft Internet Explorer running on Microsoft Windows, she calls Dell Tech Support and they have to deal with it.

2. Why would people think that everything on their computer was approved by Microsoft? Why shouldn't they think that everything was approved by the OEM? When you buy a car with an AIWA music system, you don't say, "Oh, gee, these must be AIWA tires, too."

The first step is to allow OEMs to replace the bootup screen, so that it conveys the impression of, "This is a Gateway computer running Windows" rather than "This is a Windows computer shipped by Gateway."

o my god

[martijn-s]

How can you publish such a biased comment? The article from TheReg clearly states that Microsoft is working with exactly those vendors to solve compatibility problems. And that is probably just because the programs previously used hacks to accomplish their tasks.

"We've been working closely with Microsoft - BlackIce is widely used inside Microsoft - in order to make sure it works well," Rob Graham, founder of NetworkIce told us.

Re:Improve "reliability"

[Anonymous Coward]

Yeah, We had the same thing. They took us for $13,000 because we did not have the reciepts. We had EULAs but their lawyers said that wasn't proof enough. We could have fought it in court, but the time and cost would have been more. We swapped out all of the Microsoft Server stuff and replaced it with FreeBSD. It was a steep learning curve for me, but once I got it, it was way more stable. The box was up for 9 months on FreeBSD. Under NT 4.0, it could last a maximum of a month before it died.

Re:The real reason for this:

[JoeShmoe]

Yes...and Win2K shares its roots with WinNT but is not WinNT. Windows NT 3.x laid the groundwork, registry, ntfs, accounts, services, events, hal...etc. NT 4.x added the familiar interface and rudimentary multimedia functions, increased drivers...etc. 2K added plug and play, USB firewire, file encryption...etc. And now XP adds the Luna interface, registration locking, driver blocking...etc.

It all depends on what you define as code base. To me, Win2K and XP are no more different from NT4 as Windows 98SE and ME are different than 98. Basic updates and add ons that could have easily been added as an incremental release.

I'm still pissed as hell I had to upgrade stable bloat-free NT4 servers just because I needed to access a USB accessory...there's is absolutely no reason why MS couldn't have done USB support in NT except for the fact they would sell less 2K!

- JoeShmoe

Guess what - more FUD

[Drestin]

Zone Alarm has ALREADY been updated to be XP compatible. BlackICE will be updated before the end of next week to be compatible.

This is a Good Thing(tm) for MS to do. If they KNOW that a certain driver is bad then why shouldn't they prevent you from making an obvious mistake. Why would you WANT to be able to add in a known bad driver? You actually fault MS for this? I applaud them - I say: FINALLY!!

Re:Guess what - more FUD

[Anonymous Coward]

The way crash info reporting is that after your computer hangs, on reboot it brings up a little dialog box saying "Your system has just recovered from a serious error. Would you like to send information about this crash to Microsoft?" They explain exactly what will be sent, and let you look at the data, and ultimately you choose whether to send the data. However, the "send" button is the default, so if you just blindly hit enter when message boxes pop up, I suppose that would make the system "opt-out".

Drivers have their own little section on Windows Update. When you connect to the MS Windows Update site, MS lists all of the updated drivers available for your system. In my experience they are not selected for installation by default, you have to choose them manually. Also, in my experience, drivers do not get updated automatically, you have to actually run Windows Update first.

Re:Oh, god, no!

[gamorck]

The app doesnt have to be certified to run genius. Im running Opera, IE 6, Mozille 9.2, MirC, WinAMP, and realplayer ALL RIGHT NOW on RC2 and ALL OF THEM WORK FINE.

Fud fud fud all day long. Fud fud fud is so fucking wrong.

Gam
"Flame at Will"

The real reason for this:

[JoeShmoe]

Is to do away with those pesky non-standard codecs like SMR, DivX ;-), 3ivx, M$MPEG-4 and so forth. Right now you get just a warning when you try to install those ACX/DLL files but come XP then that "Unable to find codec" message is all you are going to see.

Also you can say goodbye to those wonderful drivers that let you load a "sound card" to output the contents of the wave device to the hard drive of those "video cards" that let you screen capture ASF/RM player windows in an unencrypted format.

As soon as the encrypted video standards are rolled out you can bet that any kind of video output driver will be limited to VHS quality or the driver just simply won't be allowed.

Microsoft is smoking some serious crack if they think they can become the sole authoritative source for drivers on the Internet. Their WindowsUpdate driver server (if you go though the process of registering your hardware config with Microsoft) is worthless and do you think that companies are going to want to have to go through the hassle of signing very beta or unsupported driver they release?

Lesson from history folks...when the Amiga 4000 came out and told their customers that everything they had bought up to this point was no longer compatible Amiga went down the toilet. When Mom and Pop find their CD burner no longer works because their manufacturer hasn't gotten around to becoming "XP Ready" (even though the code base is no different than NT/2K) then I seriously doubt they'll be keeping it. Even though they can't return it. Shafted.

- JoeShmoe

Re:The real reason for this:

[TummyX]

Funny. DivX works fine on XP RC2 here.

You only get warnings. It doesn't prevent you from installing any unsupported driver. I've install the beta nVdia 14.2 drivers as well.

If Microsoft prevented you from installing ANY unsupported driver in XP it would mean 3rd parties can't write custom drivers without going through microsoft. I see nothing that mentions this will ever happen in the DDK docs.

Re:The real reason for this:

[NutscrapeSucks]

A couple datapoints about the way Win2000 handles this:

1) Policy towards signed drivers can be controlled by the group policy manager

2) There are 'undocumented' ways to install drivers that bypass the cert check. These have been published on bugtraq, etc.

3) Windows Media Player is aware of the 'certified' status of your soundcard driver and can disable loopback or analog output using features that the certification requires.

Re:Oh, god, no!

[Ronin Developer]

The issue is not that MS is preventing software (like ZoneAlarm) from running. There's no conspiracy here (arrogance maybe...but not a conspiracy). Bottom line is that they are saying that vendors will need to upgrade their wares to be compliant with the new platform. The aim here is to make a more stable platform.

In many ways, they are doing their customers a favor. I discovered two days ago that some networking software I recently wrote for 95/98/98se,NT4/2000 blows up on ME. Bottom line...I either need to find out why it fails (its probably a threading problem) or not certify my software for ME. If you run it on ME, you're on your own.

Naturally, I'd prefer better compliance between OS's but accept the fact that backwards compatibility is not always possible.

Now, I have other issues with XP...like the fact that it supposedly requires connectivity to the internet. I have customers that, for security reasons, can not connect to the internet.

As our customers are normally 3-4 years behind the bleeding edge, we're hoping that this marketing screwup at MS will lead more people to *nix platforms as the availabity of earlier generation MS products becomes more scare. Now, if only more Delphi compoent developers would release CLX compliant components rather than VCL I'd be a far happier customer.

While I may be digressing a bit, BORLAND has done us all a great favor by releasing Kylix Open Edition. Since Kylix relies on CLX rather than the VCL, CLX components developed for Delphi 6 will run under Kylix as well. This can not be said of the VCL (hence the need for CLX).

But, until companies like DevExpress and Woll2Woll realize that CLX is the way to go, the migration of decent software from Windows to Linux will be halted. Companies like DevExpress and Woll2Woll realize that there is a signifant effort and cost in moving from VCL to CLX. It's no wonder they are waiting to see how Kylix is acepted.

If we want to provide a suitable alternative to XP (and Microsoft), then one place the revolution can start is in the Kylix/CLX developer community. Grab a copy today and start developing some kick ass components. Then, Windows developers (and users) really will have a perceptual reason to migrate to a *nix and contain the prolific virus called Windows.

Re:black ice

[D Anderson n'Swaart]

BlackICE is generally regarded by internet security experts, to the best of my knowledge, as a very poor firewall solution. Many intruder reports are not genuine, and many genuine intrusions are not reported. In addition to this, it does not use any kind of encryption to ascertain whether an application authorised to access certain ports is really what it pretends to be. For example, a Trojan named IExplore.exe will slip right by BlackICE because the firewall doesn't check it for authenticity. On the other hand, programs like ZoneAlarm, and Tiny Personal Firewall do perform these authentications, and are excellent at blocking intrusions as well. ZoneAlarm tends to be a little unstable and I have personally had some trouble with it, but I still highly recommend it for average Windows users. I find Tiny stable, secure, and it tells you exactly what is happening. I have tested it on Win2k and WinME and it runs perfectly on both.

In addition, you might be interested to know that BlackICE completely blocks all network traffic when lanning, and is very troublesome, while Tiny is not. BlackICE, in my experience, also does not actually uninstall properly and continues to run after you have theoretically removed it. This struck me as very strange, and could be a random incident. However, I have had my computer frozen solid with BlackICE running, on Windows 2000, and my opinion of it, like that of Steve Gibson is somewhat low. And yeah, some of you might laugh at Steve Gibson, but I'm not just going by what he says, bear that in mind.

To be honest, when I read that BlackICE was used widely inside Microsoft, I laughed my arse off.

O my god right back at you!

[Tony Shepps]

I guess it was the need to inject your own leveling to Slashdot, but the article does NOT state that Microsoft is working with "exactly those vendors". It says nothing of the sort. Your pull quote was the only evidence that there is cooperation going on, and if you read that quote carefully and critically, you might spot the touch of bias in it that indicates we can draw very little information from it.

I would not say that adding a major feature that breaks competitors' software in the SECOND RELEASE CANDIDATE is kosher in ANY sense of the word. I mean, think of the implications JUST from the software development life cycle aspect. This addition will certainly have system-wide implications, and it's going into RC2? TWO??? Wouldn't that effectively nullify most of the beta testing that applied to RC1 and ALL previous builds? Isn't this just plain common sense?

And if you were a prosecutor, you'd look at the defendant's past history of proven, similar actions and call it damning. Just the things that we know for sure, coming largely from internal memos and emails that came out of the discovery process during the various legal actions, indicate that there is a predatory culture in Microsoft. Not that there isn't a similar culture in a lot of companies, but this one goes beyond the bounds of the law, common sense, and is certainly NOT in the interests of the comsumer. (And when I say comsumer, that's you 'n' me, chief!)

Furthermore, you saw fit to add your own conjecture. Frankly, if ZoneAlarm uses hacks to accomplish what it needs to do, I for one am entirely happy; and so are the millions of other people using it, who find that it causes no crashes whatsoever. I am hard-pressed, in fact, to think of a system utility that does its job so well, sitting in the background as unobtrusive as it can be. Especially something that has to intercept and examine every packet coming into a machine.

If you're going to accuse Slashdot submitters of faulty journalism, you can't interject your own bias as well and hope it all balances out...

Re:Free? (how about tiny personal firewall?)

[Anonymous Coward]

Hi I've been using "Tiny Personal Firewall" from "http://www.tinysoftware.com/" and I'd like to say that I'm pretty much happy with it - it lets you set rules and doesn't nag you whenever somebody pings you. I don't know about black-ice or other perasonal firewalls, however, I find Tiny personal firewall by far more intelligent (& free for non-commercial use). I highly recommend it, even though that company has some shareware products (winroute etc.) because it seems much simpler and compatible with my taste in software. I would like to simply use IP-tables under and OSS OS but simply don't have the knowledge to install one.

Re:utter hypocrisy

[jejones]

Bogus analogy. mozilla talkback doesn't make mozilla refuse to run certain plugins, or prevent you from running anything else. What Win XP evidently will have in it is not only a bug reporting facility, but something that will refuse to run software deemed "unsafe" or "incompatible." How long before MS uses that to cut off someone's air supply?

Here's one MS Geek still living in the real world

[Robber Baron]

Yes, I have an MCSE certification.
Yes, I know it isn't worth very much around here.
No, I don't live in a world depicted by Microsoft marketing.
You see, I don't work for Microsoft, I work for my clients, and the technical advice I give them will be what is in their best interests, not Microsoft's! And that advice doesn't include XP in future deployments. Expect to see more Linux, BSD, BeOS etc...
(gee, I feel like I'm at an A.A meeting! ...Hi, my name is_________and I use Microsoft products...)