Hacker News Reader

Comment by ajross | Hacker News Reader

Well, no. It's a Razer bug. Razer wrote the software. They wrote it to run as admin when you plug a new device in. They wrote it to launch a browser (!!!) under user control. Those are all Razer mistakes, Microsoft didn't do that.

Now, it's true that MS has a flawed architecture here. But it's not inherently so as I see it. Third party devices do need automatic driver install of some form. Drivers do need elevated privileges. Microsoft's model was that they'd audit and authenticate the software through the WHQL process. And it turns out that let a really glaring hole through.

But the problem is just really, really hard. If you want third party driver software to run on your system (and not all vendors want that: iOS has nothing of the sort, obviously, and Linux vendors ship all the drivers themselves) then you need to be prepared to do a ton work ensuring it's safe.

View on HN

>Microsoft's model was that they'd audit and authenticate the software through the WHQL process. And it turns out that let a really glaring hole through.

Not to let Razer off the hook here, because they're responsible as well, but in doing as you've described here, Microsoft are have willingly placed the onus for security on themselves.

>Linux vendors ship all the drivers themselves

Not all of them. Nvidia is a famous exception to this. If you want to install their drivers, I don't know of a Linux distro that will allow you to without root privilege.

To be clear: there are obviously lots of third party Linux drivers out there. But they're delivered, installed and supported by that third party. Security of the NVIDIA driver is NVIDIA's job, and no one is surprised. And as a result, you need to run a tool as the root user and elevate the privilege level yourself to get it installed.

Now, that user experience broadly sucks vs. plugging the same PCIe card into a Windows box and booting it up to get an automatically installed driver. But it's not subject to the same security problems either, which was my point.

There's a difference, though. Microsoft's Windows Update driver installer does not require launching executables, it never has in the past, it simply got the inf and supporting files and put them in the system's driver location. Now they're automatically running executable code that microsoft isn't verifying as an Administrator. Yes a malicious driver could be bad, but since drivers have a more finite api surface they should call, they can be audited / restricted with static analysis checks. launching a userspace app with admin privileges automatically is a bad idea.

Would you be ok with the AMD kernel driver launching a web browser as root on first boot? Or every boot?

WHQL means almost nothing, except that you have an expensive EV code signing certificate to verify your identity to Microsoft. At best it means that your drivers don't completely break the system.

> I don't know of a Linux distro that will allow you to without root privilege.

Sure, but a tonne of them come with them by default these days

I don't have much experience under Windows so I may be a bit off here, but this article mentioned the driver was installed by Windows Update from a non-administrative account, made no mention of UAC popping up to get administrative credentials, and allowed the installer to present a user interface. The installation wizard allowed for interactions that are intended for people who manually download and execute the driver package, which is fine in that context since the end user has already provided or has to provide administrative credentials at a UAC prompt. It is not fine in this case since a standard Windows component with elevated privileges is allowing the end user to circumvent restrictions on their account.

Clearly Razer played a role here since they were doing something that is (from my experience) unusual by presenting a wizard during a Windows Update installation. On the other hand, this is a fault that Microsoft has to fix.

It's a new 'feature' of Windows update. In the past, driver vendors that were supplying to the Windows Update driver DB only had the option of providing infs and firmware, basically. I think they could provide apps too, but they had to be 'move it into place and it works' sort of apps. The mistake is that now Microsoft allows installers to run, Logitech does the same thing, plug in any logitech device and Logitech Options pops up a custom notification prompting you to 'continue' installation.

I can understand why the vendor would want this features, and perhaps even most users. On the other hand, the one thing I liked about the limited approach was the ease of installing basic drivers. (Linux is my primary OS, so I'm accustomed to basic drivers and find the additional software that accompanies many Windows drivers repulsive. Knowing that the installer for these enhanced drivers can also present a security risk simply makes it worse.)

Completely agree, I've been an on-again-off-again linux user for the last 15-ish years... but these days it's more and more on, the only reason I haven't virtualized my gaming rig yet is the DRM some games I play use using those fucking kernel drivers. So that install hangs out and has steam, chrome, and other various games / game launchers and that's it. I disable as much of the OS as I can and only boot into it for games that don't work on linux (usually ones with the aforementioned DRM). Gaming on linux is getting better every day!

When this "feature" released? It should be reviewed not to this happen.

Even more than a bug, it's a flaw in industry _culture_.

It's a flaw in Windows culture, where application publishers and device manufacturers are allowed and perhaps even encouraged to run amok, especially at install time, and run all manner of bespoke procedures with elevated privileges.

And it's a flaw in device manufacturer culture, where first-party device ‘drivers’ are expected to be bundled (sometimes optionally, sometimes by mandate) with entire applications for managing them, usually with flashy wizards and always-on GUIs that live in the system tray. More and more, it seems like manufacturers push that shit so they can track users usage of their devices, as well.

This is as much a result of device manufacturers' marketing teams' ruinous desires for customized, unique user interfaces and branding as it is a result of anything else. This kind of shit is really alien on platforms where universal management interfaces are the norm, package installation is expected to be well-behaved and non-interactive, etc. It's par for the course on Windows (and significantly so, but to a lesser extent, on macOS).

> Third party devices do need automatic driver install of some form.

This is a mouse. It works perfectly fine as a USB HID device. The software install is to unlock optional features on the device, and that can be done after the user has authenticated to the host and gone through a security elevation prompt.

In fact there are precious few third party devices without a usable built-in driver that absolutely need to be available before the user had logged in. I can't think of any.

> The software install is to unlock optional features on the device, and that can be done after the user has authenticated to the host and gone through a security elevation prompt.

That's not true. It may help you to watch the video.

The user was authenticated as a regular logged-in user. It was the driver installation that had elevated rights as SYSTEM, and there was no security elevation prompt.

I'm reading the "can" here as normative, i.e. because the optional stuff CAN be done after auth, it SHOULD be restricted to being done only after auth.

Yeah, that's my point. There should be no automatic rights elevation. Adding a driver should require a prompt, period.

I assume the mouse driver only bypasses it because it wants to have the driver installed before the user has logged in.

It is perfectly acceptable for a device to come with either a printed url where you can get the driver or software.

Also it should be if possible minimally fit for use without extra software even if all features aren't available.

There is no way any of this should ever happen automatically. People installed custom hardware for windows in the year 2000 and it worked fine then.

A third party driver shouldnt be installable without local admin (or a UAC prompt). This is the problem.

yeah it's shared, MS was rumored to have a very strong and deep (haskell based long ago IIRC) driver testing system .. it's odd something that big escaped the net.

> Third party devices do need automatic driver install of some form.

I don't see why. Particularly not if the user wouldn't have permissions to do it themselves. If the user doesn't have permission to install a driver, there is probably a good reason for it and the system shouldn't be automatically installing drivers on their behalf either.

You or I don't. But in the market, if you can't make your product work with no fuss, your customers will buy someone else's (or flee to another platform entirely).

If you accept the paradigm of third party hardware sales at all, then you need to have some kind of automatic secure install.

> if you can't make your product work with no fuss, your customers will buy someone else's

If Razor can't make their gamer mouse autoinstall drivers, then neither can Logitech. This would be an equal playing field.

> (or flee to another platform entirely).

If somebody can't type in their own password when prompted to install a driver, it probably isn't their computer in the first place. The computer almost certainly belongs to their school or employer, or at least another family member, and I think any of those would rarely be receptive to "Please replace your dell with a macbook because the turbo button on my gamer mouse doesn't work."

Furthermore, the gamer mouse will have basic functionality without the razor driver anyway, and from my experience I doubt most clueless computer users would notice the difference. If they can "click the internet button and the google shows up", then the mouse is working as far as most users of this sort are concerned.

On Windows you don't even need to type in the password to install something. UAC just gives you a yes/no dialog. Most home users have the permissions for that.

Only if your user doesn't have admin permissions you need to type in a password to run something elevated.

Perhaps you long for the good old days where we carried around piles of floppies for our hardware, but I suspect you are in a small minority.

I'm not saying we should go back to floppies. A prompt for the administrator password followed by an otherwise automatic driver installation should be fine.

Reply on news.ycombinator.com