Windows 7 Users: You Need SHA-2 Support or No Windows Updates After July 2019 (zdnet.com)
Windows 7 and Windows Server 2008 users need to have SHA-2 code-signing installed by July 16, 2019, in order to continue to get Windows updates after that date. Microsoft issued that warning on February 15 via a Support article. From a report: Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to prove authenticity. But going forward, due to "weaknesses" in SHA-1, Microsoft officials have said previously that Windows updates will be using the more secure SHA-2 algorithm exclusively. Customers running Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2 must have SHA-2 code-signing support installed by July 2019, Microsoft officials have said.
Update coming to update you so you can get updates. Dawg.
We send our thoughts and prayers to help you through this difficult time.
Does no one even care to proofread anymore? Not expecting amazing journalism or anything bug this is ridiculous.
Why don't we read the next blurbs of the article that come immediately after the part cited in the summary:
"Microsoft has published a timeline for migrating these operating systems to SHA-2, with support for the algorithm coming in standalone updates. On March 12, Microsoft is planning a standalone update with SHA-2 code sign support for Windows 7 SP1 and Windows Server 2008 R2 SP1. It also will deliver to WSUS 3.0 SP2 the required support for delivering SHA-2 updates.
Microsoft will make available a standalone update with SHA-2 code sign support for Windows Server 2008 SP2 on April 9, 2019. "
tldr; nothing will change for these users
Yet again: So much for 'code signing' bs in THIS example today + this from the past (nothing's changed - signing = weak bs) https://apple.slashdot.org/sto... + THIS https://it.slashdot.org/story/... & this https://www.bleepingcomputer.c... + this https://www.bleepingcomputer.c... & THIS too https://www.helpnetsecurity.co... & why not - THIS TOO https://blog.minerva-labs.com/... + THIS from MS https://tech.slashdot.org/stor... (due to SHA1 'weakness')
* WANT MORE EXAMPLES OF THE PURE "FAIL" CODE SIGNING IS?
APK
P.S.=> Ask & "ye SHALL receive"... apk
Next you gonna tell me you gonna send all you nymph 18yo beauty-queen daughters to my party. BRING IT ON!
Translates to:
No updates for new Windows 7 installations
Microsoft is dead.
In totalitarian Microsoft, computer updates you.
I haven't used Windows Update since they started that rollup telemetry bs. I'd rather be owned by a hacker than MS sadly.
What a bunch of buffoons. I have a few Win7 still at work (will be moving to 10 (ughhh) I went download this update (hotfix) and mircosoft has this message when you try and download it: This hotfix is no longer available and says to upgrade to Windows 10
All the games? That's a bit of a stretch. If you want to play Fortnite or anything by Electronic Arts, then yeah.
But there are quite a few nice triple-A titles on Linux and new ones all the time. Feral Interactive in particular has been doing phenomenal work:
Alien: Isolation
Company of Heroes 2
Deus Ex: Mankind Divided
Empire: Total War Collection
Dirt Rally
F1 2015
F1 2017
GRID Autosport
Hitman
Life Is Strange
Life is Strange: Before the Storm
Mad Max
Medieval II: Total War
Middle-earth: Shadow of Mordor
Rise of the Tomb Raider
Shadow of the Tomb Raider
Saints Row 2
Tomb Raider
Total War Saga: Thrones of Britannia
Total War: SHOGUN 2 - Fall of the Samurai Collection
Total War: SHOGUN 2 Collection
Total War: Warhammer
Total War: WARHAMMER II
Warhammer 40,000: Dawn of War II
Warhammer 40,000: Dawn of War II – Chaos Rising
Warhammer 40,000: Dawn of War II – Retribution
Warhammer 40,000: Dawn of War III
XCOM: Enemy Unknown - The Complete Edition
XCOM 2
XCOM 2: War of the Chosen
Not to mention the Civilization games, loads of games that use the Unity engine, and lots of great indie titles (Factorio, Zachtronics games, Klei games).
The only reason I boot into Windows anymore is if I want to check out the latest Star Citizen update or play Deep Rock Galactic.
The updates from April 10 update last year bluescreened my 2008 R2 servers. AFAIK, Microsoft still doesn't have a fix. I am f*ed with no possible recovery. I can't say enough bad things about Microsoft's unprofessionalism, inadequate testing, contemptuous customer support, and ignorance of how their half-baked updates negatively impact real-world situations.
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
There is an old patch for windows7 that already added SHA2 code signing: KB3033929. It can still be downloaded directly from microsoft.com without having to enable updates.
The Win7 box at work still has broken networking. I have to uninstall the update from January every morning to fix the damn thing.
People at microsoft that release half baked broken updates and spyware will burn in special place in hell, reserved for child molesters.
And if you migrated, can you tell us what operating system or systems you chose to migrate to, and why? Genuine interest since lots of people talk crap about Microsoft then don't take any steps to excise them from their life.
I stopped automatic updates a couple of years ago. Microsofto was pushing Windows 10 hard. I realized that, once they stop pushing the Windows 10 installation, they will try to get Windows 7 user give up by pushing shit updates - stuff that will break Windows 7. Don't even try to tell me this is beyond Microsoft, we all know it is right up their alley.
So, after two years without automatic updates, all my computers (laptops and my desktop) are working without any security issues, including Meltdown that has been contained with patches that make sense vs. the crap that Microsoft pushed the first two times (surely by "mistake").
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
...and people that talk in theaters.
"Windows 7 Users: You Need SHA-2 Support or No Windows Updates After July 2019"
"You Need SHA-2 Support After July 2019"
OR
"You Need No Windows Updates After July 2019"
The latter is so true when you eventually switched to Linux.
You're putting a "tl;dr" on the bottom. If it's too long, I'm not going to get there, you doofus.
1: Remove the following registry subkeys from the key {SOFTWARE hive from target instance}\Microsoft\WindowsRuntime\ActivatableClassId: Windows.Internal.UI.Logon.Controller.LogonUX, Windows.Internal.UI.Logon.Controller.LockScreenHost, Windows.Internal.UI.Logon.Controller.FirstSignInAnimation and Windows.Internal.UI.Logon.Controller.BlockedShutdownResolverUX, since those depend on XAML-based UI library dependent on DWM.
2: From {SOFTWARE hive from target instance}\Microsoft\Windows NT\CurrentVersion\Winlogon: Set 'EnableSIHostIntegration' to 0, set 'Shell' to anything other than 'explorer.exe', e.g. 'cmd.exe'.
3: Remove dwminit.dll, since Winlogon is using that if exists as a library.
4: Disable or remove the following services that forcibly push DWM (as of build 16299): WpnService, TokenBroker, UserManager, TabletInputService, RetailDemo, CDPSvc and SharedRealitySvc. As a concept, Windows Server Core editions do not ship those services and svchost libraries affilated with them. (Note that this list may be partial)
If your target instance is HKEY_LOCAL_MACHINE (usually loaded from {System Root such as \Windows}\System32\config), you can test this PoC by restarting Windows NT instance as required for convience by step 4.
It is located on System32 directory of systemroot
I stopped automatic updates a couple of years ago. Microsofto was pushing Windows 10 hard. I realized that, once they stop pushing the Windows 10 installation, they will try to get Windows 7 user give up by pushing shit updates - stuff that will break Windows 7. Don't even try to tell me this is beyond Microsoft, we all know it is right up their alley.
I know this is anecdotal, but I'm a Windows 7 user as well and I've been updating my machine since... ever. I've removed a couple of updates related to telemetry, although I'm pretty sure that Microsoft enabled it in some way or another with yet another update at some point. In any case, my machine is working fine.
...and people that talk in theaters.
Precisely.
Will Microsoft be fixing the situation where their Windows Update servers are carrying fucked up Win7 Manifests?
The whole reason I got off Win7 was because Windows Updates would run for 12+ hours, then fail out. And you'd have to keep running it until you hit a server with an undamaged manifest.
Chas - The one, the only.
THANK GOD!!!
Install a good firewall instead and whitelist programs for outgoing connections. ZoneAlarm used to be the best. Is it still?
Did none of you notice this? Oh wait... you're Americans...
Same. When I wrote this here at the time, there were all these "You'll get pwned". Yeah, hasn't happened yet and everything's working fine.
We've got to plug this hole to stop all those evil doers from corrupting our patches and computing correctly signed patches with SHA-1!!!
Said no-one, ever.
While they are at it, are they planning to provide a utility to allow users to verify packages on the command line like we can in Linux?
Service Pack 2 please?
My Win7 box is only used for a select set of apps (well, games). Nothing else, not even web-browsing. No problems now for over 2 years.
Macs & Linux boxen, on the other hand, are used for EVERYTHING!
Even so, my Win7 box is backed up with ntfsclone, and has been restored twice. (Once after being used to read a visitor's memory card, just to be absolutely safe. And once due to Malware in Advertising in a now deleted game.)
It's about protecting the veracity of a program. What APK does can't be stolen there like signatures can be (math check in 100's of procs and functions down to byte level so no alteration can occur). If you're going to do layers, do layers that can't be stolen.
See subject: As you STALK me HIDING behind UNIDENTIFIABLE anon 1.) My program stops portfilter errs in hosts https://news.slashdot.org/comm...
2.) CHINA did hardcodes LONG AFTER I DID "Time is on MY SIDE" (Rolling Stones) https://theregister.co.uk/2017...
3.) /. users state the value of hosts for getting users more speed/security/reliability/anonymity listed here (enumerated as "Registered /.ers reviews") https://it.slashdot.org/commen...
4.) Security pros galore + /.ers praise the layered security efficacy of hosts quoted here https://it.slashdot.org/commen...
5.) I never had to sue Thor SCHMUCK - CA rescinded their FALSE POSITIVE error, sold off their shitty antivirus & I said I'd speak to an attorney & I did who advised I go thru their removal process & I won.
* YOU LOSE (lt's all you know HOW to do vs. me).
APK
P.S.=> You can't even STAND BEHIND YOUR WORDS (lies) you UNIDENTIFIABLE anonymous STALKER of me... apk
Get off my network with your infected computer
Going to make more sockpuppets to stalk & troll me with you LITERALLY ADMITTED loon https://slashdot.org/comments.pl?sid=5038387&cid=46782891 + sending me postcards w/ threats too https://slashdot.org/comments.pl?sid=4980459&cid=46704073 you little STALKING whacko??
Zontar, take your meds you ADMITTED mentalcase https://slashdot.org/comments.pl?sid=4985017&cid=46658165
&
You're also a druggie too https://slashdot.org/comments.pl?sid=4985017&cid=46663669
* You're a butthurt loon freak, plain & simple - you did it to yourself, loser... see below for proof.
APK
P.S.=> Still trying to live down how I shot you to pieces in the art & science of computing Mr. Butthurt https://slashdot.org/comments.pl?sid=5033597&cid=46760851 ?
How about proving hosts & my program that builds them are useless too https://slashdot.org/comments.pl?sid=5053067&cid=46794235 ? ... apk
See my subject: I'll kick YOUR FUCKING ASS for stalking & harassing me you unidentifiable little cowardly cunt - tell me your REAL name, address, & phone # so I can verify it's REALLY you & we can settle this once & for all, fucker...
APK
P.S.=> Everyone SEES you constantly stalking & harassing me bitch, so WHO ARE YOU FOOLING but yourself - & IF I ever get to you? You'll WISH you were dead cocksucker... I shit you not! apk
If you haven't already, be sure to back up your Windows 7 computers with Clonezilla
this will allow you to:
- get past hardware failures
- restore to a scratch dish and virus scan the scratch disk
- move to SSD or back to non-SSD as needed
You ADMIT you have a registered 'luser' acct & yet STALK me by UNIDENTIFIABLE anonymous too https://hardware.slashdot.org/... - YOU have ISSUES, lunatic...
* What's the MATTER? "Cat got your tongue" vs. my method that CAN'T BE STOLEN in a mathematical function in 100's of functions & procedures in my work (where code signing can be & abused) https://it.slashdot.org/commen... UPMODDED in "CODING FOR DEFON" no less for me (not you).
APK
P.S.=> Glad you posted Zontar the Mindless - he's a crackpot FAKE NAME loser who really DOES have MENTAL ISSUES having to see shrinks (that F you up more than you already are, lol) & yes, he also does drugs, admittedly... apk
Hypocrite pot calling a kettle black: @ least I "ID" myself, you don't & HIDE behind UNIDENTIFIABLE anon posts STALKING me like the scared little weezil you are - doubtless due to my BLOWING YOU AWAY many times under your doubtless MANY alter-ego FAKENAMES you have here too, lol!
* Am I right? Oh, I know DAMN WELL I am... lol, & you're still BUTTHURT over your SELF-DEFEATS vs. me, no questions asked!
APK
P.S.=> Code signing can be stolen & ABUSED - my method of programmatic protection CANNOT be & was UPMODDED in CODING FOR DEFCON no less almost a decade & a 1/2 ago https://it.slashdot.org/commen... has yours? NO, lol!
All YOU are is a "ne'er-do-well" DO-NOTHING nobody (perhaps that's WHY you STALK me by UNIDENTIFIABLE anonymous & IMPERSONATE me too clipping old posts of mine & reposting them - you're only being "true to yourself" - a WASTED life self, lmao)... apk
You ADMIT you have a registered 'luser' account & STALK me by UNIDENTIFIABLE anonymous too https://hardware.slashdot.org/... - YOU have ISSUES, lunatic!
* I know WHY you do it though (out of "butthurt angst", lol): I've BLOWN YOU AWAY so many times under your MANY alter-ego SOCKPUPPET /. accounts FAKENAMES you're out for "revenge" only to have EGG ON YOUR FACE yet again, lol!
APK
P.S.=> See subject & that's the "best ya got"? It proves You WISH you were ME (as your POOR imitation = the sincerest form of flattery)... apk
SHA-1 is weak because it is now (i.e. today) possible to produce hash collisions in our lifetime. Last I checked it was down to 140 GPU years to calculate a collision. So 50K GPUs would allow someone to calculate a hash collision for a binary in about 24 hours. Governments have that kind of buying power and probably already have it. They could digitally sign rogue patch binaries that look legit to the OS and deploy them. It's worth it to those governments if they can infiltrate multiple networks undetected.
Real SHA-1 collisions with consequences are in the realm of possibility today whereas a few years ago they weren't. Still not sure why someone put "weaknesses" in quotes. Microsoft is getting rid of SHA-1 support in the OS because it's the best thing to do and it's also possible that they've already seen examples of rogue binaries in the wild.
the scrofulous updates from MS will be reliably stopped?
Blessed day!
LOL! I never whine/complain, I just lmao @ U: Especially when I get you to RUN DRY of your ABUSED downmodpoints, lol... everytime!
WHY WOULD I COMPLAIN ABOUT THAT? Heck, you MAY be IMPERSONATING me (I could care less, I'm always there disproving it when you do) doing it but as you see NOW? Yes, I am GLOATING & Lording it OVER you!
* You & "your kind" (WEEZILS & WHIMPS, lol) ONLY reply to me once I've run you DRY of those abused modpoints - just like you're doing now, hahaha!
APK
P.S.=> Proof enough that I know YOU better than YOU KNOW YOURSELVES & I've always DESPISED do-nothing BLOWHARD WORMS like you & I always, Always, ALWAYS do GET THE BETTER of you, by outthinking your DULL BRAIN easily, lol! apk
I read those comments. Might have gotten one myself. Along the lines "as soon as you boot your box will be owned."
Well, I rather not be owned by Microsoft.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
Fortunately, 1 Factorial is also 1 (recursively).
See subject & WHY should I do ANYTHING you UNIDENTIFIABLE anonymous trolls that STALK me (& yes IMPERSONATE me too) say?
* I don't take advisement from those trying to cause me grief - fools do that, so SAVE YOUR "ADVICE" & TAKE YOUR OWN hypocrite!
APK
P.S.=> I won't provide YOU or ANYONE ELSE (that means /. itself) a means to TRACK ME & do what I do to you fools via your post histories (let's me "HANG" a LOT of you via what I call "the Cardinal Richelieu Technique" QUITE often)... apk
See subject & Re-READ this again + as the saying goes "tell us another one" https://tech.slashdot.org/comm...
* THAT CRAP IS TOO EASY TO STEAL - a method I use & designed myself CAN'T BE STOLEN THAT WAY https://it.slashdot.org/commen...
(Period).
APK
P.S.=> I don't understand what "code signing" is for? Ok "sure" (not), but I do SEE tons of examples of where it got BURNED & ABUSED (see 1st link) - so what GOOD is it?? Not much (especially vs. what I do, self-checking code - you can't STEAL or ABUSE it anywhere NEARLY as easily & good luck doing it in code that has 100's of procs/functions that inline that check - nigh IMPOSSIBLE to 'hack' into & undo (why I do DO what I do - it actually WORKS unlike "code signing" bs I provided TONS of examples of it BEING ABUSED & BROKEN))... apk
There is nothing new here. It is commonplace to require a particular patch installation sequence. It is also commonplace to increase security implementations and expectations over time.
Frankly, this is clickbait for the Microsoft-hating crowd. And the MS haters are out in force here.
Pavlov, anyone?