News: Windows Vista x64 To Require Signed Drivers

"For Windows Vista and later versions of the Windows family of operating
systems, kernel-mode software must have a digital signature to load on
x64-based computer systems.

This paper describes how to manage the signing process for kernel-mode code
for Windows Vista, including how to obtain a Publisher Identity Certificate
(PIC), guidelines for protecting keys, and how to sign a driver package by
using tools that are provided in the Windows Driver Kit (WDK).

Why digital signatures? For both consumer and enterprise users of Windows
around the world, protecting personal and corporate data remains a top
concern. Microsoft is committed to implementing new ways to help restrict
the spread of malicious software. Digital signatures for kernel-mode
software are an important way to ensure security on computer systems.

Digital signatures allow the administrator or end user who is installing
Windows-based software to know whether a legitimate publisher has provided
the software package. When users choose to send Windows Error Reporting data
to Microsoft after a fault or other error occurs, Microsoft can analyze the
data to know which publishers' software was running on the system at the
time of the error. Software publishers can then use the information provided
by Microsoft to find and fix problems in their software."

Read on at the following link to learn about the great benefits:

http://www.microsoft.com/whdc/system/platform/64bit/kmsigning.mspx


--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Charlie
Sun Jan 22 00:53:06 CST 2006

Yes, this will be very interesting. It means that we may have a few ongoing
issues with drivers, but it also means that the level of protection from
root kits, etc, that run at the kernel level will be substantially higher.

--
Charlie.
http://msmvps.com/xperts64

Andre Da Costa [Extended64] wrote:
> "For Windows Vista and later versions of the Windows family of operating
> systems, kernel-mode software must have a digital signature to load on
> x64-based computer systems.
>
> This paper describes how to manage the signing process for kernel-mode
> code for Windows Vista, including how to obtain a Publisher Identity
> Certificate (PIC), guidelines for protecting keys, and how to sign a
> driver package by using tools that are provided in the Windows Driver Kit
> (WDK).
> Why digital signatures? For both consumer and enterprise users of Windows
> around the world, protecting personal and corporate data remains a top
> concern. Microsoft is committed to implementing new ways to help restrict
> the spread of malicious software. Digital signatures for kernel-mode
> software are an important way to ensure security on computer systems.
>
> Digital signatures allow the administrator or end user who is installing
> Windows-based software to know whether a legitimate publisher has provided
> the software package. When users choose to send Windows Error Reporting
> data to Microsoft after a fault or other error occurs, Microsoft can
> analyze the data to know which publishers' software was running on the
> system at the time of the error. Software publishers can then use the
> information provided by Microsoft to find and fix problems in their
> software."
> Read on at the following link to learn about the great benefits:
>
> http://www.microsoft.com/whdc/system/platform/64bit/kmsigning.mspx

joeberle
Sun Jan 22 08:25:02 CST 2006

Do NOT listen to Charlie Russel. He is a shiv for MS. The answer is to not
waste any more of your time with the unsupported 64 bit OS. Microsoft has
been selling a poor product and we must all stop using it now! It is not your
job to scrounge around for drivers to make your products work together.
Microsopht should pay us to test out their products because they have no idea
how to provide a straightforward product for the consumer market. Due
dilligence my ass!

"Charlie Russel - MVP" wrote:

> Yes, this will be very interesting. It means that we may have a few ongoing
> issues with drivers, but it also means that the level of protection from
> root kits, etc, that run at the kernel level will be substantially higher.
>
> --
> Charlie.
> http://msmvps.com/xperts64
>
> Andre Da Costa [Extended64] wrote:
> > "For Windows Vista and later versions of the Windows family of operating
> > systems, kernel-mode software must have a digital signature to load on
> > x64-based computer systems.
> >
> > This paper describes how to manage the signing process for kernel-mode
> > code for Windows Vista, including how to obtain a Publisher Identity
> > Certificate (PIC), guidelines for protecting keys, and how to sign a
> > driver package by using tools that are provided in the Windows Driver Kit
> > (WDK).
> > Why digital signatures? For both consumer and enterprise users of Windows
> > around the world, protecting personal and corporate data remains a top
> > concern. Microsoft is committed to implementing new ways to help restrict
> > the spread of malicious software. Digital signatures for kernel-mode
> > software are an important way to ensure security on computer systems.
> >
> > Digital signatures allow the administrator or end user who is installing
> > Windows-based software to know whether a legitimate publisher has provided
> > the software package. When users choose to send Windows Error Reporting
> > data to Microsoft after a fault or other error occurs, Microsoft can
> > analyze the data to know which publishers' software was running on the
> > system at the time of the error. Software publishers can then use the
> > information provided by Microsoft to find and fix problems in their
> > software."
> > Read on at the following link to learn about the great benefits:
> >
> > http://www.microsoft.com/whdc/system/platform/64bit/kmsigning.mspx
>
>
>

Andre
Sun Jan 22 08:43:07 CST 2006

Which drivers and applications are you having problems with on Windows x64
Joe? May we can help you find work arounds or direct you to native drivers.
--
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
"joeberle" <joeberle@discussions.microsoft.com> wrote in message
news:3DFEDDB7-A0A6-4167-B458-F9AE3AA24FF3@microsoft.com...
> Do NOT listen to Charlie Russel. He is a shiv for MS. The answer is to
> not
> waste any more of your time with the unsupported 64 bit OS. Microsoft has
> been selling a poor product and we must all stop using it now! It is not
> your
> job to scrounge around for drivers to make your products work together.
> Microsopht should pay us to test out their products because they have no
> idea
> how to provide a straightforward product for the consumer market. Due
> dilligence my ass!
>
> "Charlie Russel - MVP" wrote:
>
>> Yes, this will be very interesting. It means that we may have a few
>> ongoing
>> issues with drivers, but it also means that the level of protection from
>> root kits, etc, that run at the kernel level will be substantially
>> higher.
>>
>> --
>> Charlie.
>> http://msmvps.com/xperts64
>>
>> Andre Da Costa [Extended64] wrote:
>> > "For Windows Vista and later versions of the Windows family of
>> > operating
>> > systems, kernel-mode software must have a digital signature to load on
>> > x64-based computer systems.
>> >
>> > This paper describes how to manage the signing process for kernel-mode
>> > code for Windows Vista, including how to obtain a Publisher Identity
>> > Certificate (PIC), guidelines for protecting keys, and how to sign a
>> > driver package by using tools that are provided in the Windows Driver
>> > Kit
>> > (WDK).
>> > Why digital signatures? For both consumer and enterprise users of
>> > Windows
>> > around the world, protecting personal and corporate data remains a top
>> > concern. Microsoft is committed to implementing new ways to help
>> > restrict
>> > the spread of malicious software. Digital signatures for kernel-mode
>> > software are an important way to ensure security on computer systems.
>> >
>> > Digital signatures allow the administrator or end user who is
>> > installing
>> > Windows-based software to know whether a legitimate publisher has
>> > provided
>> > the software package. When users choose to send Windows Error Reporting
>> > data to Microsoft after a fault or other error occurs, Microsoft can
>> > analyze the data to know which publishers' software was running on the
>> > system at the time of the error. Software publishers can then use the
>> > information provided by Microsoft to find and fix problems in their
>> > software."
>> > Read on at the following link to learn about the great benefits:
>> >
>> > http://www.microsoft.com/whdc/system/platform/64bit/kmsigning.mspx
>>
>>
>>

Lenard
Sun Jan 22 09:18:43 CST 2006

Joe, what are you an Apple plant trying to sabatage MS?

joeberle wrote:
> Do NOT listen to Charlie Russel. He is a shiv for MS. The answer is to not
> waste any more of your time with the unsupported 64 bit OS. Microsoft has
> been selling a poor product and we must all stop using it now! It is not your
> job to scrounge around for drivers to make your products work together.
> Microsopht should pay us to test out their products because they have no idea
> how to provide a straightforward product for the consumer market. Due
> dilligence my ass!
>
> "Charlie Russel - MVP" wrote:
>
>
>>Yes, this will be very interesting. It means that we may have a few ongoing
>>issues with drivers, but it also means that the level of protection from
>>root kits, etc, that run at the kernel level will be substantially higher.
>>
>>--
>>Charlie.
>>http://msmvps.com/xperts64
>>
>>Andre Da Costa [Extended64] wrote:
>>
>>>"For Windows Vista and later versions of the Windows family of operating
>>>systems, kernel-mode software must have a digital signature to load on
>>>x64-based computer systems.
>>>
>>>This paper describes how to manage the signing process for kernel-mode
>>>code for Windows Vista, including how to obtain a Publisher Identity
>>>Certificate (PIC), guidelines for protecting keys, and how to sign a
>>>driver package by using tools that are provided in the Windows Driver Kit
>>>(WDK).
>>>Why digital signatures? For both consumer and enterprise users of Windows
>>>around the world, protecting personal and corporate data remains a top
>>>concern. Microsoft is committed to implementing new ways to help restrict
>>>the spread of malicious software. Digital signatures for kernel-mode
>>>software are an important way to ensure security on computer systems.
>>>
>>>Digital signatures allow the administrator or end user who is installing
>>>Windows-based software to know whether a legitimate publisher has provided
>>>the software package. When users choose to send Windows Error Reporting
>>>data to Microsoft after a fault or other error occurs, Microsoft can
>>>analyze the data to know which publishers' software was running on the
>>>system at the time of the error. Software publishers can then use the
>>>information provided by Microsoft to find and fix problems in their
>>>software."
>>>Read on at the following link to learn about the great benefits:
>>>
>>>http://www.microsoft.com/whdc/system/platform/64bit/kmsigning.mspx
>>
>>
>>

Charlie
Sun Jan 22 09:47:52 CST 2006

no, just a troll. Ignore him.
"Lenard Lund" <alanon5@hotmail.com> wrote in message
news:uz7Xjc2HGHA.3056@TK2MSFTNGP09.phx.gbl...
> Joe, what are you an Apple plant trying to sabatage MS?
>
> joeberle wrote:
>> Do NOT listen to Charlie Russel. He is a shiv for MS. The answer is to
>> not waste any more of your time with the unsupported 64 bit OS.
>> Microsoft has been selling a poor product and we must all stop using it
>> now! It is not your job to scrounge around for drivers to make your
>> products work together. Microsopht should pay us to test out their
>> products because they have no idea how to provide a straightforward
>> product for the consumer market. Due dilligence my ass!
>>
>> "Charlie Russel - MVP" wrote:
>>
>>
>>>Yes, this will be very interesting. It means that we may have a few
>>>ongoing issues with drivers, but it also means that the level of
>>>protection from root kits, etc, that run at the kernel level will be
>>>substantially higher.
>>>
>>>--
>>>Charlie.
>>>http://msmvps.com/xperts64
>>>
>>>Andre Da Costa [Extended64] wrote:
>>>
>>>>"For Windows Vista and later versions of the Windows family of operating
>>>>systems, kernel-mode software must have a digital signature to load on
>>>>x64-based computer systems.
>>>>
>>>>This paper describes how to manage the signing process for kernel-mode
>>>>code for Windows Vista, including how to obtain a Publisher Identity
>>>>Certificate (PIC), guidelines for protecting keys, and how to sign a
>>>>driver package by using tools that are provided in the Windows Driver
>>>>Kit
>>>>(WDK).
>>>>Why digital signatures? For both consumer and enterprise users of
>>>>Windows
>>>>around the world, protecting personal and corporate data remains a top
>>>>concern. Microsoft is committed to implementing new ways to help
>>>>restrict
>>>>the spread of malicious software. Digital signatures for kernel-mode
>>>>software are an important way to ensure security on computer systems.
>>>>
>>>>Digital signatures allow the administrator or end user who is installing
>>>>Windows-based software to know whether a legitimate publisher has
>>>>provided
>>>>the software package. When users choose to send Windows Error Reporting
>>>>data to Microsoft after a fault or other error occurs, Microsoft can
>>>>analyze the data to know which publishers' software was running on the
>>>>system at the time of the error. Software publishers can then use the
>>>>information provided by Microsoft to find and fix problems in their
>>>>software."
>>>>Read on at the following link to learn about the great benefits:
>>>>
>>>>http://www.microsoft.com/whdc/system/platform/64bit/kmsigning.mspx
>>>
>>>
>>>
>

Thomas
Sun Jan 22 09:53:19 CST 2006

Andre Da Costa [Extended64] wrote:
> This paper describes how to manage the signing process for kernel-mode code
> for Windows Vista, including how to obtain a Publisher Identity Certificate
> (PIC), guidelines for protecting keys, and how to sign a driver package by
> using tools that are provided in the Windows Driver Kit (WDK).

Makes me wonder what the requirements for signing a driver are. Is more
required than knowing a credit card number? (as for activeX) :-)

The answer would hint at whether this would protect us from the crappy
drivers that ATI and Nvidia for example are throughing at the customer
at an alarming high rate.

> When users choose to send Windows Error Reporting data
> to Microsoft after a fault or other error occurs, Microsoft can analyze the
> data to know which publishers' software was running on the system at the
> time of the error. Software publishers can then use the information provided
> by Microsoft to find and fix problems in their software.

Sounds cool. Maybe we will get breakdown statistics similar to the ones
we see for cars? :-)

Thomas

Charlie
Sun Jan 22 11:00:07 CST 2006

This won't protect us from poorly written drivers. It won't even protect us
from rogue drivers, if the rogue driver writer is willing to identify
themselves accurately. What it will protect us from is rogue drivers that
install themselves without are realizing it and with no way to track who
wrote and distributed the driver. It's a small, but significant step in the
right direction, but we shouldn't over state the case for it. And it will
raise the bar for OEMs, since the signing requirements are significant. This
will be a burden for smaller OEMs, and even some larger ones have resisted
signing of drivers. That will change, but it may mean longer until we all
have the drivers we've been demanding, I'm afraid.

--
Charlie.
http://msmvps.com/xperts64

Thomas Steffen wrote:
> Andre Da Costa [Extended64] wrote:
>> This paper describes how to manage the signing process for kernel-mode
>> code for Windows Vista, including how to obtain a Publisher Identity
>> Certificate (PIC), guidelines for protecting keys, and how to sign a
>> driver package by using tools that are provided in the Windows Driver
>> Kit (WDK).
>
> Makes me wonder what the requirements for signing a driver are. Is more
> required than knowing a credit card number? (as for activeX) :-)
>
> The answer would hint at whether this would protect us from the crappy
> drivers that ATI and Nvidia for example are throughing at the customer
> at an alarming high rate.
>
>> When users choose to send Windows Error Reporting data
>> to Microsoft after a fault or other error occurs, Microsoft can analyze
>> the data to know which publishers' software was running on the system at
>> the time of the error. Software publishers can then use the information
>> provided by Microsoft to find and fix problems in their software.
>
> Sounds cool. Maybe we will get breakdown statistics similar to the ones
> we see for cars? :-)
>
> Thomas

Andre
Sun Jan 22 11:58:55 CST 2006

Well, I feel good about Vista, its gonna be dang secure and stable, Driver
Signing, UAP, Windows Defender and AntiVirus technologies built, Vista is
definitely beginning to look like a worthy upgrade again.
--
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
"Charlie Russel - MVP" <charlie@mvKILLALLSPAMMERSps.org> wrote in message
news:%2343RsV3HGHA.1192@TK2MSFTNGP11.phx.gbl...
> This won't protect us from poorly written drivers. It won't even protect
> us from rogue drivers, if the rogue driver writer is willing to identify
> themselves accurately. What it will protect us from is rogue drivers that
> install themselves without are realizing it and with no way to track who
> wrote and distributed the driver. It's a small, but significant step in
> the right direction, but we shouldn't over state the case for it. And it
> will raise the bar for OEMs, since the signing requirements are
> significant. This will be a burden for smaller OEMs, and even some larger
> ones have resisted signing of drivers. That will change, but it may mean
> longer until we all have the drivers we've been demanding, I'm afraid.
>
> --
> Charlie.
> http://msmvps.com/xperts64
>
> Thomas Steffen wrote:
>> Andre Da Costa [Extended64] wrote:
>>> This paper describes how to manage the signing process for kernel-mode
>>> code for Windows Vista, including how to obtain a Publisher Identity
>>> Certificate (PIC), guidelines for protecting keys, and how to sign a
>>> driver package by using tools that are provided in the Windows Driver
>>> Kit (WDK).
>>
>> Makes me wonder what the requirements for signing a driver are. Is more
>> required than knowing a credit card number? (as for activeX) :-)
>>
>> The answer would hint at whether this would protect us from the crappy
>> drivers that ATI and Nvidia for example are throughing at the customer
>> at an alarming high rate.
>>
>>> When users choose to send Windows Error Reporting data
>>> to Microsoft after a fault or other error occurs, Microsoft can analyze
>>> the data to know which publishers' software was running on the system at
>>> the time of the error. Software publishers can then use the information
>>> provided by Microsoft to find and fix problems in their software.
>>
>> Sounds cool. Maybe we will get breakdown statistics similar to the ones
>> we see for cars? :-)
>>
>> Thomas
>
>

Andre
Sun Jan 22 12:03:21 CST 2006

mythological Scandinavian being: a supernatural being in Scandinavian
legends depicted as either a dwarf or giant and living in caves or under
bridges

He must own a laptop. :)
Microsoft® Encarta® Reference Library 2005. © 1993-2004 Microsoft
Corporation. All rights reserved.
--
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

"Charlie Russel-MVP" <Charlie@mvKILLALLSPAMMERSps.org> wrote in message
news:%23qoBTt2HGHA.916@TK2MSFTNGP10.phx.gbl...
> no, just a troll. Ignore him.
> "Lenard Lund" <alanon5@hotmail.com> wrote in message
> news:uz7Xjc2HGHA.3056@TK2MSFTNGP09.phx.gbl...
>> Joe, what are you an Apple plant trying to sabatage MS?
>>
>> joeberle wrote:
>>> Do NOT listen to Charlie Russel. He is a shiv for MS. The answer is to
>>> not waste any more of your time with the unsupported 64 bit OS.
>>> Microsoft has been selling a poor product and we must all stop using it
>>> now! It is not your job to scrounge around for drivers to make your
>>> products work together. Microsopht should pay us to test out their
>>> products because they have no idea how to provide a straightforward
>>> product for the consumer market. Due dilligence my ass!
>>>
>>> "Charlie Russel - MVP" wrote:
>>>
>>>
>>>>Yes, this will be very interesting. It means that we may have a few
>>>>ongoing issues with drivers, but it also means that the level of
>>>>protection from root kits, etc, that run at the kernel level will be
>>>>substantially higher.
>>>>
>>>>--
>>>>Charlie.
>>>>http://msmvps.com/xperts64
>>>>
>>>>Andre Da Costa [Extended64] wrote:
>>>>
>>>>>"For Windows Vista and later versions of the Windows family of
>>>>>operating
>>>>>systems, kernel-mode software must have a digital signature to load on
>>>>>x64-based computer systems.
>>>>>
>>>>>This paper describes how to manage the signing process for kernel-mode
>>>>>code for Windows Vista, including how to obtain a Publisher Identity
>>>>>Certificate (PIC), guidelines for protecting keys, and how to sign a
>>>>>driver package by using tools that are provided in the Windows Driver
>>>>>Kit
>>>>>(WDK).
>>>>>Why digital signatures? For both consumer and enterprise users of
>>>>>Windows
>>>>>around the world, protecting personal and corporate data remains a top
>>>>>concern. Microsoft is committed to implementing new ways to help
>>>>>restrict
>>>>>the spread of malicious software. Digital signatures for kernel-mode
>>>>>software are an important way to ensure security on computer systems.
>>>>>
>>>>>Digital signatures allow the administrator or end user who is
>>>>>installing
>>>>>Windows-based software to know whether a legitimate publisher has
>>>>>provided
>>>>>the software package. When users choose to send Windows Error Reporting
>>>>>data to Microsoft after a fault or other error occurs, Microsoft can
>>>>>analyze the data to know which publishers' software was running on the
>>>>>system at the time of the error. Software publishers can then use the
>>>>>information provided by Microsoft to find and fix problems in their
>>>>>software."
>>>>>Read on at the following link to learn about the great benefits:
>>>>>
>>>>>http://www.microsoft.com/whdc/system/platform/64bit/kmsigning.mspx
>>>>
>>>>
>>>>
>>
>
>

Thomas
Sun Jan 22 12:59:51 CST 2006

Andre Da Costa wrote:
> Well, I feel good about Vista, its gonna be dang secure and stable, Driver
> Signing, UAP, Windows Defender and AntiVirus technologies built, Vista is
> definitely beginning to look like a worthy upgrade again.

I hope that UAP is at least 2 steps forward. I run an XP Home system
with restricted user accounts. After reinstalling an application, it
stopped working for "mortal" users any more. Running it as administrator
did *not* fix the problem.

And then I found out that XP Home still has all the complicated ACLs,
but no way of showing or modifying them. Now that is brilliant! I had to
use the seemingly obsolete cacls, which even to an aged command line fan
like me is a major challenge.

Ok, back to my point: one step forward would not cut it. It takes at
least two big steps forward to make UAP feasible.

Thomas

Andre
Sun Jan 22 14:28:35 CST 2006

Thing about UAP presently, it requires permission for everything, a dialogue
pops up every time you launch certain applications under a Standard account
in Vista.
--
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
"Thomas Steffen" <steffen.list.account@gmail.com> wrote in message
news:%23FYmHY4HGHA.3700@TK2MSFTNGP15.phx.gbl...
> Andre Da Costa wrote:
>> Well, I feel good about Vista, its gonna be dang secure and stable,
>> Driver Signing, UAP, Windows Defender and AntiVirus technologies built,
>> Vista is definitely beginning to look like a worthy upgrade again.
>
> I hope that UAP is at least 2 steps forward. I run an XP Home system with
> restricted user accounts. After reinstalling an application, it stopped
> working for "mortal" users any more. Running it as administrator did *not*
> fix the problem.
>
> And then I found out that XP Home still has all the complicated ACLs, but
> no way of showing or modifying them. Now that is brilliant! I had to use
> the seemingly obsolete cacls, which even to an aged command line fan like
> me is a major challenge.
>
> Ok, back to my point: one step forward would not cut it. It takes at least
> two big steps forward to make UAP feasible.
>
> Thomas

Larry
Mon Jan 23 01:11:34 CST 2006

I was just trolling over at adobe.photoshop.windows with the elitist
Crapintosh users. Got it a big thread battle over Windows vs Mac. It
always amazes me how much Apple users hate MS. They are literally vehement,
which always makes me smile. Of course, I poke them with my sharp stick. I
know...bad Larry, bad.



I hear they even have TWO buttons on their mouse now. Wow, imagine that!



And, Apple is down to 1.8% of the PC market now. lmao....



"Charlie Russel-MVP" <Charlie@mvKILLALLSPAMMERSps.org> wrote in message
news:%23qoBTt2HGHA.916@TK2MSFTNGP10.phx.gbl...
> no, just a troll. Ignore him.
> "Lenard Lund" <alanon5@hotmail.com> wrote in message
> news:uz7Xjc2HGHA.3056@TK2MSFTNGP09.phx.gbl...
>> Joe, what are you an Apple plant trying to sabatage MS?
>>
>> joeberle wrote:
>>> Do NOT listen to Charlie Russel. He is a shiv for MS. The answer is to
>>> not waste any more of your time with the unsupported 64 bit OS.
>>> Microsoft has been selling a poor product and we must all stop using it
>>> now! It is not your job to scrounge around for drivers to make your
>>> products work together. Microsopht should pay us to test out their
>>> products because they have no idea how to provide a straightforward
>>> product for the consumer market. Due dilligence my ass!
>>>
>>> "Charlie Russel - MVP" wrote:
>>>
>>>
>>>>Yes, this will be very interesting. It means that we may have a few
>>>>ongoing issues with drivers, but it also means that the level of
>>>>protection from root kits, etc, that run at the kernel level will be
>>>>substantially higher.
>>>>
>>>>--
>>>>Charlie.
>>>>http://msmvps.com/xperts64
>>>>
>>>>Andre Da Costa [Extended64] wrote:
>>>>
>>>>>"For Windows Vista and later versions of the Windows family of
>>>>>operating
>>>>>systems, kernel-mode software must have a digital signature to load on
>>>>>x64-based computer systems.
>>>>>
>>>>>This paper describes how to manage the signing process for kernel-mode
>>>>>code for Windows Vista, including how to obtain a Publisher Identity
>>>>>Certificate (PIC), guidelines for protecting keys, and how to sign a
>>>>>driver package by using tools that are provided in the Windows Driver
>>>>>Kit
>>>>>(WDK).
>>>>>Why digital signatures? For both consumer and enterprise users of
>>>>>Windows
>>>>>around the world, protecting personal and corporate data remains a top
>>>>>concern. Microsoft is committed to implementing new ways to help
>>>>>restrict
>>>>>the spread of malicious software. Digital signatures for kernel-mode
>>>>>software are an important way to ensure security on computer systems.
>>>>>
>>>>>Digital signatures allow the administrator or end user who is
>>>>>installing
>>>>>Windows-based software to know whether a legitimate publisher has
>>>>>provided
>>>>>the software package. When users choose to send Windows Error Reporting
>>>>>data to Microsoft after a fault or other error occurs, Microsoft can
>>>>>analyze the data to know which publishers' software was running on the
>>>>>system at the time of the error. Software publishers can then use the
>>>>>information provided by Microsoft to find and fix problems in their
>>>>>software."
>>>>>Read on at the following link to learn about the great benefits:
>>>>>
>>>>>http://www.microsoft.com/whdc/system/platform/64bit/kmsigning.mspx
>>>>
>>>>
>>>>
>>
>
>

Norman
Mon Jan 23 19:23:03 CST 2006

"Andre Da Costa" <andred25@hotmail.com> wrote in message
news:emA1M23HGHA.3856@TK2MSFTNGP12.phx.gbl...

> Well, I feel good about Vista, its gonna be dang secure and stable,

No, it's going to be signed.

Microsoft's self-signed drivers for DVD drives, PCMCIA slots, and video
adapters have caused blue screens in Windows XP x64, Windows XP 32-bit, and
Windows 2000.

Microsoft's self-signed drivers for NTFS file system and CHKDSK have
recorded events of uncorrectable errors causing loss of files under 32-bit
versions of Vista beta 1, 2003 Server, and XP SP2, though I haven't
experienced it yet in 64-bit.

Vista's going to be signed. Nothing else.

(none)
Tue Jan 24 04:25:04 CST 2006

Norman Diamond wrote:
> "Andre Da Costa" <andred25@hotmail.com> wrote in message
> news:emA1M23HGHA.3856@TK2MSFTNGP12.phx.gbl...
>
>> Well, I feel good about Vista, its gonna be dang secure and stable,
>
>
> No, it's going to be signed.

Exactly. A 500 Dollar credit card bill does not automatically lead to
better drivers :-(. They way it looks at the moment (not configurable,
only for commercial entities) this is a stab at the (small) free
software community around Windows.

I do use a few free kernel level drivers, like UltraVNC, colinux or the
ATI omega driver. I know they could cause problems, but so far I could
always trace my problems back to supposedly respectable drivers (ATI,
HD, Scanner etc). And neither of these work as of yet under x64, but I
wonder why Microsoft would want to prevent them from ever working.

So in the interest of versatility, I hope that this just an announcement
to test the reception. And my reception is negative.

Thomas

PS: and remember that the chain of trust can break in any place. Malware
will certainly find a way round this.