Removal of unwanted drivers from Windows Update | Hacker News Reader

Removal of unwanted drivers from Windows Update

techcommunity.microsoft.com

51 pointszdw52 comments

Great. So if I interpret this correctly, when companies go out of business (or drop support for product lines), your perfectly functional hardware will now inevitably stop working (or not be installable after you reformat your OS). Welcome another step down the path toward a world where you don't really own your hardware and your vendor dictates how, when and what you can use ("we control the horizontal, we control the vertical").

There are already some great comments in that thread, like this thoughtful one:

While having a well organized and updated driver catalog is undoubtedly a good thing, please spare a thought for curators of vintage PC collections. The Windows Update Driver catalog is a near unrivaled resource on the internet for known good drivers, and is a great source for drivers where the original manufactures have either removed the drivers from their own websites, or they no longer exist.

Personally I always hated the idea of using Windows Update as your warehouse for drivers in the first place. Much better to keep your own collection. (Yes, it takes some work to curate and periodically update).

Here's a PC driver bundle that runs great, without artificially forced obsolescence: https://cdimage.debian.org/debian-cd/current/amd64/iso-dvd/

Just curious if Linux includes drivers for 20 year old hardware and if there is some guarantee somewhere that old drivers will be available forever.

Yes, but there are no guarantees. In fact, they do quite routinely remove drivers for old hardware, if there is no one willing to maintain them. They removed support for several pieces of hardware in the last release, in fact, including some particular drivers for an IBM Cell system, and for IBM CAPI flash drives (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...) and so on

Yes and no. There is plenty of 20 year old HW that has drivers in Linux but their continued existence in the tree is predicated on them being maintained.

Just recently, bugs in drivers for 30 year old Soundblaster ISA cards received fixes:

https://www.phoronix.com/news/Linux-6.16-SoundBlaster-AWE32

There is no strict guarantee of indefinite support, but that is often what happens.

Debian is very good about preserving old distributions and packages.

But realistically, unless you're doing serious retrocomputing, it might never come up. I think most 20yo laptops, for example, will simply work with the latest Debian.

(I'm typing this on a 13yo laptop, because real keyboard, and everything works perfectly.)

Unfortunately, there is no guarantee. If the maintainer for a driver stops maintaining it and no one else steps in to pick up the work then eventually it'll get removed if it isn't widely used.

The source will always be available, though, so a motivated person could bring it back to life. Not so in the Windows world. Or the Mac[1] world either, to be fair.

1: https://news.ycombinator.com/item?id=44353595

Oh sure - you could also just run an older kernel that still supports it and take precautions.

Linux being open source completely enables that possibility where otherwise you'd be screwed.

What exactly prevents someone from installing an old version of Windows and then the necessary legacy drivers, taking those same precautions?

Nothing. Nothing does.

Installing old versions of Windows doesn't mean you can still access the drivers that were available when the OS was still supported.

If you still have the drivers handy - sure. I personally would trust older versions of Linux more than older versions of Windows though. And I say that as someone that is also typing this comment from a Windows desktop.

Really old versions, sure.

Newer old versions rely on Microsoft to activate them. Given the trajectory the indistry is moving toward, I don't have a lot of confidence that will last indefinitely.

More and more features these days are getting inextricably tied to the cloud, and it's becoming trickier to create offline installation media even for the ones that aren't.

>so a motivated person could bring it back to life.

The word "could" is doing a lot of heavy lifting here. If my 20+ year old HW doesn't work on my latest Ubuntu, then the word "could" offers me no comfort.

>Not so in the Windows world.

I can install 20+ year old drivers on Windows 11 no problem without the original author needing to change anything or any motivated individual picking up the slack.

Not if they were only distributed through Windows update, or if it was that and the vendors long-gone website with custom flash for downloading the drivers, which archive.org didn't understand at the time...

GPL guarantees you rights to make the old drivers available forever. Of course it is the nature of FOSS that ultimately you are responsible for your own systems and their maintenance.

No, in fact Linux recently decided to screw over the two hobbyists running itanium systems by not maintaining full feature compatibility in new kernels, for that architecture.

I can't tell if this is a joke or satire. Itanium is a microarchitecture which was dead before it was ever implemented in silicon. It only existed because HP was paying Intel to create it, HP doesn't exactly have the reputation of a company with good decision making.

That wouldn't help retrocomputing users at all, who are specifically trying to reproduce specific software/hardware combinations. If that old setup required Windows, well.. guess they need Windows and those specific drivers.

There is already a project to handle this because this has already happened to so much hardware https://theretroweb.com/

Errrr, you can install drivers outside of windows update. Your hardware will continue working fine. Just that you will have to install the driver manually.

Good luck finding them still. If they are not on archive.org, you are out of luck. And if that ceases to exist, even more.

Nothing is stopping for from making your own and gifting it to the world. You can't support old things forever. Eventually you have to move forward as the cost for maintaining things just doesn't support the effort (or the juice isn't worth the squeeze).

OK, I'll bite.

Software is a liability. Especially the typical kind, that one normally runs into, which are not formally verified. And even if they were, the human understanding of what constitutes a vulnerability is in perpetual flux, as that is a human-level semantic concept.

This is why active maintenance is a necessary property. If a software is not actively maintained, it can and will accumulate vulnerability discoveries, putting the entire security boundary it resides in and all the data going through it into jeopardy. To potentially autonomously distribute knowingly unmaintained software borders on malicious.

It sucks that your legacy devices will no longer have their device drivers neatly auto-installed, yes, but it's not some grand conspiracy, it's bottom of the barrel bare minimum safety consciousness.

If what you propose is that manual install specifically should still be possible from Windows Update, I can support that, but I think this entire announcement is such an obvious thing, I'm surprised it hasn't been this way before.

> Personally I always hated the idea of using Windows Update as your warehouse for drivers in the first place. Much better to keep your own collection. (Yes, it takes some work to curate and periodically update).

And most every other person hates dealing with drivers instead, hence why they started distributing them through it.

It's not a step towards that world. We're already in that world. Have been for at least half a decade.

How about first fixing, that Windows update is automatically installing inappropriate drivers for my graphics card, causing system instability and freezes? How about first fixing your shit, MS?

MS could easily say "If users with your driver installed have more than a 10% higher reboot/app crash/windows reinstall/BSOD rate than typical users, then your company will be fined $1 per computer affected per month till the issue is resolved.".

Suddenly every company would be putting loads more effort into battle testing their drivers when there is a financial cost to buggy code.

I think instead every company would suddenly be releasing their own Linux or BSD, and/or lobbying the government to break Microsoft up for being a monopoly. It'd be cheaper.

Here, here! It's time for an operating system revolution, nothing too radical, just enough to secure up company info. I realize this would be really difficult, but don't businesses see that MS wants even more control over their computers? How can any company trust their secret communications about an innovation that could be a boon for profits and expansion ever trust MS not to be spying on them? (Surely MS doesn't collaborate with the feds, which could possibly use this info to sabotage a company they don't like?!?)

Trusting MS means being able to strip down your own security teams. Right now, MS invading everything saves money on experts. (Yes, short term vision. But that's normal.)

Business is usually willing to give up control if it directly increases profits.

GPU drivers are some of the most complex and frequently updated pieces of code in the industry.

I blame the manufacturers for failing to deliver stable products, rather than putting all the blame on windows for delivering drivers to you that were submitted to them by the manufacturer through WHQL arrangements.

GPU drivers also routinely fix buggy or inefficient shader code in individual computer games, at least for popular ones. GPU drivers are doing more than what would reasonably expected of them.

And that’s when what is reasonably expected of them is an optimizing compiler for multiple languages, an execution environment providing isolation among instances of arbitrary mutually untrusting code (generated by that compiler), a resource scheduler, etc.

I think this is somewhat misunderstanding my complaint. When I download the AMD drivers directly from AMD websites, they are fine mostly. It is just that Windows every now and then decides to replace them with the shit that comes with Windows update. I never tell it to do that and it acts in such an idiotic way.

You can turn that off and not have drivers installed through Windows Update.

https://answers.microsoft.com/en-us/windows/forum/all/disabl...

What an intuitive way to wrench back control over installed drivers. Thank you, anyway.

And often it doesn't even work.

To my knowledge, windows update always only offers the latest version of a driver for a bit of hardware...

Is there even a UI for a user to select an older driver version from windows update?? I know you can do it if you manually get a .inf file, but thats a different flow.

If not, what exactly is this announcement saying? "Stuff that a user isn't able to install right now won't be available for a user to install in the future"?

https://www.catalog.update.microsoft.com still lives in it's 2000s glory

I'd be interested to know what effort would be needed to decouple the manual download database from what is connected to WU within currently supported versions of windows, presumably they've already got some way of filtering off which drivers they want to keep live. I think MS could handle the download cost of old drivers when a lot of them can be smaller than an average modern webpage.

I guess it comes down to the question of how much MS cares about old hard/software past its support window, versus delegating that to third party sites like vogons.org and praying someone has the relevant file still available.

I think cost isn't the issue here. The issue is that it's super easy to emulate some ancient USB device, windows auto-installs the ancient driver, and you then exploit that driver to get kernel mode code execution.

However, I don't think filtering old drivers is a good way to combat this. Instead they should be popping up a dialog saying "Do you really want to install this USB joystick last sold in 1998? Older devices can pose security risks. If so, please enter your admin password to confirm. If you did not just plug in a USB Joystick, please [report it]."

It does not. In my experience it always gives drivers that are at least 6-12 months old. Particularly GPU drivers.

Drivers for other random things like disk controllers are likely to be a lot older.

I can't recall ever checking a WU provided driver and not having to immediately go fetch an updated version from the vendor directly.

At the very least Windows Update can offer you two versions, a stable version of the driver and a newer but potentially less stable version through the "Optional Driver Updates" page in Windows Update.

That would require the vendor to provide such versions. I do not think I ever saw that

I don't think its necessarely latest but what they deem to be most stable, which is not what the end user always wants.

Nor is it always the most stable. I've had update overwrite my working video card driver and replace it with one that blackscreens on reboot.

What of windows 10 drivers?

"What category of drivers are targeted in the first cut of the cleanup?

The first phase targets legacy drivers that have newer replacements already on Windows Update."

It'd be useful if they listed information about the other phases; the proposal for this phase seems pretty sensible and I'm surprised they have only now started thinking about it.

Does this include going back through and ensuring they're removing malicious drivers left behind (like from the FTDI driver-bricking fiasco... numerous times over)?

Seems like this would result in a ton of printers etc hitting landfills

Would it? Printers are a great example. Almost every printer made in the last 20 years supports at least PCL6 perfectly fine.

Why do we still need thousands of proprietary drivers, when just one will do?

Yes, I have business justification. Wink wink

We do the eavesdropping and act as a liability shield. Here's our "debug" mode and a bit extra for the effort.

Reply on news.ycombinator.com