Hacker News Reader

https://www.catalog.update.microsoft.com still lives in it's 2000s glory

I'd be interested to know what effort would be needed to decouple the manual download database from what is connected to WU within currently supported versions of windows, presumably they've already got some way of filtering off which drivers they want to keep live. I think MS could handle the download cost of old drivers when a lot of them can be smaller than an average modern webpage.

I guess it comes down to the question of how much MS cares about old hard/software past its support window, versus delegating that to third party sites like vogons.org and praying someone has the relevant file still available.

I think cost isn't the issue here. The issue is that it's super easy to emulate some ancient USB device, windows auto-installs the ancient driver, and you then exploit that driver to get kernel mode code execution.

However, I don't think filtering old drivers is a good way to combat this. Instead they should be popping up a dialog saying "Do you really want to install this USB joystick last sold in 1998? Older devices can pose security risks. If so, please enter your admin password to confirm. If you did not just plug in a USB Joystick, please [report it]."

Reply on news.ycombinator.com