News for hackers. Stuff that matters.
Re:Windows 0day privilege escalation still not fixed by stefan_ on Wednesday December 23, 2020 @01:18PM (#25520371)
I'm dumbfounded why Microsoft can't fix this, it's essentially just a parameter validation issue. They must have some ghoulish software actually relying on the broken behavior.

Add to that their recklessly incompetent initial fix:

https://twitter.com/maddiestone/status/1341781306766573568

Re:Windows 0day privilege escalation still not fixed by mwcampbell on Wednesday December 23, 2020 @07:40PM (#25524007)
Having gone from sole developer at a tiny company to a developer at Microsoft (and now back again), I'd like to propose a corollary to Hanlon's Razor: Never attribute to either malice or incompetence what can be explained by complexity that you don't know about.
Re:Windows 0day privilege escalation still not fixed by bawolff on Wednesday December 23, 2020 @08:04PM (#25524143)
Isn't allowing complexity to grow to such an extent that you cannot fix critical bugs in a reasonable amount of time a form of incompetence?
Re:Windows 0day privilege escalation still not fixed by natpalmer1776 on Wednesday December 23, 2020 @08:17PM (#25524221)
In my view, it is a form of incompetence so common and, in practice essential for growth as a business that it has become a ubiquitous baseline against which we should strive to differentiate ourselves from.

It is complexity that is accepted in small amounts across dozens of projects over many years. Projects that add real value to the business while contributing to this invisible debt that from the business point of view, matters only once it has started directly affecting your revenue.

Eventually an organization can't scale without a major refactoring, rewrite, or an entirely new market vertical.

Re:Windows 0day privilege escalation still not fixed by martamorena284 on Wednesday December 23, 2020 @11:14PM (#25525003)
It's simply not economically viable to build software at the scale of windows without such issues. There are thousands of teams (not people) working on it and hundreds of thousands of people over the lifetime of the software. Even companies like Microsoft have pressure to deliver on time and be frugal, not just startups.

Incompetence is to spend too much time making software into a golden, egg laying donkey. As is building software that becomes impossible to change after a couple of years. Finding the fine line in between these extremes is what professional software engineering is all about.

Re:Windows 0day privilege escalation still not fixed by bawolff on Wednesday December 23, 2020 @11:49PM (#25525136)
Which is why there is a bussiness cycle, where every once in a while a startup will wipe the floor with a big inflexible competitor despite not having even a thousandth of the resources.
Re:Windows 0day privilege escalation still not fixed by pjmlp on Thursday December 24, 2020 @03:43AM (#25525977)
Or just end being bought by the competitor and turned into yet another of their departments.
Re:Windows 0day privilege escalation still not fixed by extropy on Thursday December 24, 2020 @11:13AM (#25528718)
That's organizational incompetence not technical one however.

IMO there is no good fix for that past certain company size.

Re:Windows 0day privilege escalation still not fixed by smt88 on Thursday December 24, 2020 @10:17AM (#25528151)
It's impossible to have software as massive as Windows with 30+ years of backward compatibility that is not extremely complex.
Re:Windows 0day privilege escalation still not fixed by tamrix on Friday December 25, 2020 @09:02AM (#25536529)
Your comment is about 20-25 years too late.

Most of these problems are likely contributed to legacy code and backwards compatibility.

Re:Windows 0day privilege escalation still not fixed by LASR on Wednesday December 23, 2020 @11:41PM (#25525106)
You’re talking about Microsoft.

It takes me a couple of lines of code now to spin up a web server than can handle thousands of connections. Or an app with beautiful fluid UI.

But I remember that I am standing on the shoulders of giants. What seems like zero complexity to someone on the shoulder is actually not.

Sometimes the giants fuck up too. Ultimately it is incompetence. But not the kind that is attributable to laziness or stupidity. Engineers at Microsoft, I would assume are like engineers everywhere - no smarter, no dumber.

Just because I can build a Lego bridge perfectly, doesn’t make the guys who’ve built an imperfect actual bridge are incompetent. They’re just solving very different problems.

Re:Windows 0day privilege escalation still not fixed by webmaven on Thursday December 24, 2020 @06:35PM (#25532640)
It sounds like what you are saying is that over the long term, there are no competent developers or organizations.

Or perhaps that due to survivorship bias, the evidence for incompetence that we see sticking around longest is also the most pathological.

Re:Windows 0day privilege escalation still not fixed by konjin on Wednesday December 23, 2020 @10:11PM (#25524733)
I have a modification to Hanlon's Razor: anyone who invokes it is both.
Re:Windows 0day privilege escalation still not fixed by isatty on Thursday December 24, 2020 @01:43AM (#25525517)
Except the user of a commercial application does not need to know about the complexity. They just care if a security loophole is fixed.
Re:Windows 0day privilege escalation still not fixed by TwoBit on Wednesday December 23, 2020 @10:44PM (#25524857)
This is very true. So often I hear people arguing that something surely is simple to do and obviously people are idiots for not being able to, all while having no idea whatsoever about the system to which they are referring.
Re:Windows 0day privilege escalation still not fixed by sinsterizme on Wednesday December 23, 2020 @11:40PM (#25525102)
Re:Windows 0day privilege escalation still not fixed by qz2 on Wednesday December 23, 2020 @02:42PM (#25521314)
Alt+tab has been thoroughly broken on Windows 10 20H2 for over two months now. It randomly switches between the second and third window. No fix in customer facing versions yet either.

They are slow and incompetent.

Re:Windows 0day privilege escalation still not fixed by FartyMcFarter on Wednesday December 23, 2020 @03:19PM (#25521706)
This may explain it:

https://www.wsj.com/articles/microsoft-diminishes-windows-ro...

> The company is breaking Windows in pieces. The platform technology, on which Microsoft’s partners build their own devices, apps and services, will now fall under Scott Guthrie, who runs the Azure business. Mr. Guthrie’s unit, called Cloud + AI Platform, will also include the company’s mixed-reality business, including Microsoft’s Hololens device, as well as its artificial-intelligence business.

Maybe someone with insider knowledge will comment, but it looks like Windows is far from being a priority for Microsoft.

Re:Windows 0day privilege escalation still not fixed by dmix on Wednesday December 23, 2020 @03:48PM (#25522046)
Man I still can’t believe Azure is number 2 behind Amazon for cloud computing. When they first started their marketing push to developers years ago, which I remember was very aggressive and full of evangelism marketing which I disliked, I kind of blew them off as some mid tier or old school oddity.

But it really shows you how powerful their enterprise sales machine is and the legacy reach of existing programming languages/frameworks.

It’s always easy to underestimate Microsoft I guess. Ditto with Oracle and the like. From our view down in the startup world.

That said. Alt-tab not working is an embarrassment though. And I hope they really haven’t let their OS QA slip this badly in favour of some growth area or whatever.

Re:Windows 0day privilege escalation still not fixed by ManBlanket on Wednesday December 23, 2020 @06:15PM (#25523397)
The comparison of cloud platforms truly is heavily distorted at a startup. Most companies aren't comparing AWS and MS in a vacuum when presented with the decision. How much of the world's software runs on dotnet? Windows, Office, and Active Directory command their own predominant shares, not to mention other tools like CRM. MS earned a reputation for the battleship; relatively stable, plays nicely with their other products, LTS, backward compatibility, etc. Suppose the CTO for an insurance claims company is presented with the decision of migrating a legacy platform which already runs on a fat stack of MS products. They don't even need a salesperson to convince them Azure is the obvious first choice, because to them it's just another cannon on the battleship.

In my experience the tribal evangelism for AWS is... intense... and they've somehow convinced people to proselytize unpaid on their behalf. Having worked with both I'll occasionally mention Azure if only to revel at the spicy takes. Honestly though, I worked at that claims company I mentioned. Likewise the startup I work at today threw their hats in with AWS. Both were respectively good decisions, both bad in their own right. As ever, try to do everything and something is going to give.

Re:Windows 0day privilege escalation still not fixed by toast0 on Wednesday December 23, 2020 @07:31PM (#25523947)
> MS earned a reputation for the battleship; relatively stable, plays nicely with their other products, LTS, backward compatibility, etc.

Microsoft earned thst reputation with a lot of development and organizational practices that they've since abandoned. It may take people a while to notice, but today's Microsoft is not prioritizing stable software interfaces and backwards compatability.

It took a lot of testing to ensure existing software and hardware continued to work with new operating systems, and they're not doing as much testing anymore.

Re:Windows 0day privilege escalation still not fixed by jiggawatts on Wednesday December 23, 2020 @08:12PM (#25524187)
Microsoft had some of the best documentation in the world. People really don't understand how valuable that is, and how important. Microsoft in 2020 certainly doesn't understand. They produce vast reams of auto-generated "documentation" where the only text is the function names with spaces added between the words.
Re:Windows 0day privilege escalation still not fixed by TeMPOraL on Thursday December 24, 2020 @05:22AM (#25526378)
Reminds me of PowerShell. There's extensive, detailed and super-useful documentation for pretty much all the commandlets available... but it's not installed by default. Get-Help ... will happily tell you that you need to download help if you want to see any details beyond command signature. Who in their right mind though this is a good idea? Such documentation should be shipped with the default install.

I have it on the top of my mind because it bit me twice in recent month. I had to do some PS work on some VMs that didn't have Internet access (beyond RDP). Sure, I can Alt+Tab to a browser on my machine, but at this point, why even have Get-Help? Contrast that with Emacs experience, where everything is documented, and documentation is easily accessible, off-line, and by default.

Re:Windows 0day privilege escalation still not fixed by TwoBit on Wednesday December 23, 2020 @10:50PM (#25524885)
> I'll occasionally mention Azure if only to revel at the spicy takes.

Well there are a lot of old school Microsoft haters. I used to know a bunch of Unix guys ~ten years ago whose unstated principle was that anything Microsoft did was unilaterally a bad idea (and everything Unix ever did was always the best possible way).

Re:Windows 0day privilege escalation still not fixed by plif on Wednesday December 23, 2020 @04:20PM (#25522342)
Microsoft is also mostly purely tech. Amazon and Google (Alphabet) are more pervasive and threatening to other industries.

For that reason, I'm not surprised. I've seen the decision come down to not wanting to give money to the other two many times. MS is in a great position there.

Re:Windows 0day privilege escalation still not fixed by 411111111111111 on Wednesday December 23, 2020 @04:11PM (#25522273)
They're including managed services like office 365 in that number though.

Might be fair because aws includes their services as well, but I'm pretty sure aws main income is from ec2, while azure is business tooling like active directory, office etc

Re:Windows 0day privilege escalation still not fixed by semi-extrinsic on Wednesday December 23, 2020 @05:34PM (#25523069)
And they seem to be pushing customers very hard on moving from on-prem to cloud for Office and email stuff. I don't know if they're subsidising the cloud services for now, or what.
Re:Windows 0day privilege escalation still not fixed by jiggawatts on Wednesday December 23, 2020 @08:20PM (#25524235)
It's really obvious that Azure has much lower adoption than AWS. For example, I evaluated their new Front Door combo accelerator / CDN product recently. One page listed their customers, and there were about a half dozen total. Out of curiosity, I scanned the top 1000 domains and found none using it. I got the impression that I was one of the few people even evaluating it, let alone using it in production.

Despite just kicking the tyres on the thing, I found about half a dozen bugs or missing critical features. That's just shocking to me.

For comparison, CloudFront -- the most direct competitor -- is far ahead in features and is used by far more customers. It also works out of the box.

All of the other Azure services other than plain virtual machines give me the same impression of being a first adopter and one of only a handful of customers.

Re:Windows 0day privilege escalation still not fixed by PretzelPirate on Thursday December 24, 2020 @08:57AM (#25527456)
Those customers are probably using it in some of their services. I’ve worked with a number of enterprise companies who are moving to the cloud and most of them have never considered something like front door to route their traffic.

I’ve brought Front Door into their architecture for the services I was working on, but even if they decide it’s a great thing for the entire company to use, it will take them over a year to get security to approve it, and then multiple years to get it rolled out to all of their products.

With Azure’s core customer base being major enterprises, it’s not surprising that you had a hard time finding evidence.

Re:Windows 0day privilege escalation still not fixed by Quarrelsome on Wednesday December 23, 2020 @05:51PM (#25523211)
They still have a big .NET following and they make it easier to use Azure via their toolsets. I feel like it was mildly obvious that they'd do okay.
Re:Windows 0day privilege escalation still not fixed by recursive on Wednesday December 23, 2020 @11:15PM (#25525010)
Alt-Tab isn't broken for everyone. It's working on all three of the windows machines I regularly use.
Re:Windows 0day privilege escalation still not fixed by dboreham on Thursday December 24, 2020 @12:33AM (#25525292)
Alt-tab is working for me. Meanwhile, the bug first seen in prerelease versions of the new shell on NT3.51 in 1995, where the taskbar won't hide, is still present in the latest Win10 insider preview.
Re:Windows 0day privilege escalation still not fixed by vntok on Friday December 25, 2020 @11:31AM (#25537337)
Sounds like a feature, not a bug!
Re:Windows 0day privilege escalation still not fixed by thekyle on Wednesday December 23, 2020 @04:00PM (#25522166)
I may be wrong but I don't believe Microsoft even has a dedicated Windows division any more.
Re:Windows 0day privilege escalation still not fixed by radicaldreamer on Wednesday December 23, 2020 @04:33PM (#25522475)
Well that and they got rid of their QA and test engineers so nothing is caught before it's sent out... you just can't rely on free beta testers for everything.
Re:Windows 0day privilege escalation still not fixed by jodrellblank on Wednesday December 23, 2020 @04:52PM (#25522663)
> You just can't rely on free beta testers for everything.

Linux distros seem to manage pretty well...?

Or is this "it's only bad if Microsoft do it"?

Re:Windows 0day privilege escalation still not fixed by _jal on Wednesday December 23, 2020 @05:30PM (#25523029)
We pay RH rather a lot of money for the excellent testing and integration they do. (And alt-tab works, if you want it to.)

Or if you're trying to limit this to individual use, I'll grant you equivalence once Microsoft stops charging their beta testers and offers them the source.

Re:Windows 0day privilege escalation still not fixed by fomine3 on Thursday December 24, 2020 @12:04AM (#25525198)
Fedora and CentOS Stream is RHEL's upstream so it can be said as "beta test" from RHEL's perspective. (gamma?)
Re:Windows 0day privilege escalation still not fixed by rbanffy on Thursday December 24, 2020 @06:38AM (#25526687)
They all do upstream integration tests because nobody sane likes being caught by surprise.

Even I do it and I work for a company orders of magnitude smaller

Re:Windows 0day privilege escalation still not fixed by ehvatum on Wednesday December 23, 2020 @05:08PM (#25522830)
That’s an interesting point. Which for-profit Linux distro is using you as an unpaid beta tester for their closed-source code?
Re:Windows 0day privilege escalation still not fixed by gralx on Wednesday December 23, 2020 @05:14PM (#25522886)
Fair point. But 90% of Linux submissions are corporate, last I checked. Corporations (usually) do a lot of internal testing before submitting, and then maintainers have to review submissions. This is long before the public ("beta testers") has to deal with any bugs.

And that's only the kernel. Distributions and their package maintainers have their own quality controls, as do cross-distribution upstream developers. Public bug trackers (beta testers) are a complement to these. The division of labour in quality control of Linux systems is fine, diverse, and of variable effectiveness before beta testers come into the picture.

Re:Windows 0day privilege escalation still not fixed by 9HZZRfNlpR on Wednesday December 23, 2020 @05:01PM (#25522765)
If I'm paying for it, which I do hell no. O also use Linux but I don't ost for it, and it's hobbyist / power user os and I can actually fix things there unlike windows.
Re:Windows 0day privilege escalation still not fixed by withinrafael on Wednesday December 23, 2020 @04:33PM (#25522479)
Yep. For those that are seeking a temporary remedy, open Registry Editor, navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer, create/modify REG_DWORD value named AltTabSettings and set its value to 1. Restart your PC (restarting the Shell alone is possible but will currently introduce more bugs).
Re:Windows 0day privilege escalation still not fixed by tubs on Thursday December 24, 2020 @07:35PM (#25533040)
Thank you! This is honestly the best winterveil gift I have received this year, very much appreciated!

When you say "temporary" remedy, is that implying there will be a real fix that obsoletes this, or this workaround will stop working at some point?

Re:Windows 0day privilege escalation still not fixed by withinrafael on Thursday December 24, 2020 @08:12PM (#25533270)
It's fixed in the next major release so hopefully we can restore the value back to 0 when it's pushed out in Q1 2021.
Re:Windows 0day privilege escalation still not fixed by tubs on Thursday December 24, 2020 @08:21PM (#25533327)
Awesome, thanks for the fix, and the super quick replies, have a great season. :-)
Re:Windows 0day privilege escalation still not fixed by tubs on Wednesday December 23, 2020 @04:09PM (#25522258)
Oh god I thought I was the only one who had noticed this... it drives me mad every single day.
Re:Windows 0day privilege escalation still not fixed by jasdine817 on Wednesday December 23, 2020 @06:11PM (#25523362)
Sure it's not including Edge tabs in the alt tab screen? You can turn that off.
Re:Windows 0day privilege escalation still not fixed by sandworm101 on Wednesday December 23, 2020 @10:49PM (#25524877)
Me2. I tried three keyboards before concluding that wasn't the problem.
Re:Windows 0day privilege escalation still not fixed by millzlane on Wednesday December 23, 2020 @04:41PM (#25522546)
I rely heavily on alt+tab. I haven't noticed this. Can you explain a bit more?
Re:Windows 0day privilege escalation still not fixed by cheschire on Wednesday December 23, 2020 @04:54PM (#25522681)
It does exactly as described. Sometimes it will shift to the second window as intended. Often it will skip to the third window open instead, requiring one to continue cycling back to the second window.
Re:Windows 0day privilege escalation still not fixed by nkrisc on Wednesday December 23, 2020 @05:14PM (#25522884)
You can Alt+Shift+Tab to go in reverse direction.
Re:Windows 0day privilege escalation still not fixed by gralx on Wednesday December 23, 2020 @05:20PM (#25522944)
Or just release Tab while keeping Alt depressed and navigate the thumbnails with the arrow keys.
Re:Windows 0day privilege escalation still not fixed by bzb6 on Wednesday December 23, 2020 @05:47PM (#25523178)
I think it only happens if you use Edge
Re:Windows 0day privilege escalation still not fixed by millzlane on Thursday December 24, 2020 @08:54AM (#25527436)
Oh okay, I use FF. This must be why. I alt+tabbed 100+times and didn't experience the issue. Didn't edge tabs now recently show in alt+tab? I wonder if it's because they are surfing between two tabs and alt tab is showing the last tab they clicked on rather than the last window they had up.

FF uses CTRL+Tab to cycle through tabs like alt tab.

Re:Windows 0day privilege escalation still not fixed by franga2000 on Thursday December 24, 2020 @04:53AM (#25526250)
Same here, along with Win+Tab (the "exploded" window view) crashing the shell. Every time I have to boot into Windows, I'm even more disappointed by what has happened to what was once a great OS.
Re:Windows 0day privilege escalation still not fixed by pmontra on Thursday December 24, 2020 @08:23AM (#25527205)
Ubuntu user here and very occasional Windows user too. Is the problem only with the GUI (same as liking or not Gnome Shell or having it crash) or is the problem with the "real" OS under the GUI?

Example 1 for the GUI: it drives me crazy that I can't resize the dialogs to edit the properties of a scheduled task. They were probably designed for 800x600 screens and they were a bad design back then (a text area please and join the lines.)

Example 2 for the core: a process keeps track of its parent but if the patent exits the process doesn't update the reference so you can end up with a reused process id in the child process data table. I run into that a couple of weeks ago.

Re:Windows 0day privilege escalation still not fixed by franga2000 on Thursday December 24, 2020 @06:29PM (#25532583)
I don't relly develop for Windows, so most of my problems are related to OS GUIs and bundled software. Like how for some reason, most of the bundled UWP programs stopped working on my laptop after an update or how Windows 10 still supports two audio "channels" (default and communication) which many apps respect but the output device switcher only switches the default one and not the communication one and these options aren't even available in the "new" (it's been like 5 years at this point!!) settings app so you have to use the old "control panel" one which has now been removed from the menu and sometimes even search and the only way to get to it is to search for something related ans when it opens switch the tab to what you need even though this is not some obscure feature but something that every mainstream communication program uses and most users eventually run into and everyone constantly bitches about yet there is still no fix or even acknowledgement from MSFT because they fired all their testers/QC and care less about their paying customers than even the meanest of OSS maintainers. </rant>

Regarding the more technical side, while I'm entirely unqualified to comment on kernels and low-level APIs, I actually like some NT/Windows design choices quite a lot more than Linux. Network transparency (\\shares) is a big one and in general the way external filesystems are handled (mounting makes no sense for desktop use - especially the way udisks or whatever does it). And while the way programs are stored and installed on Linux is a neat idea in theory, it all breaks the moment one app doesn't follow the standard and it imposes far too many restrictions that Windows doesn't suffer from.

Edit: sorry for the rant, I'm stupidly tired and have had a few drinks. Happy holidays!

Re:Windows 0day privilege escalation still not fixed by tonyedgecombe on Wednesday December 23, 2020 @01:46PM (#25520674)
Perhaps they are trying to avoid breaking 3rd party code.

I've spent quite a lot of time poking around in the print spooler and my gut feeling is it's probably riddled with issues like this.

Re:Windows 0day privilege escalation still not fixed by Meph504 on Wednesday December 23, 2020 @01:52PM (#25520743)
I would agree I was baffled how basically windows will take anything from print drivers and ram it into the spooler.
Re:Windows 0day privilege escalation still not fixed by tonyedgecombe on Wednesday December 23, 2020 @04:19PM (#25522340)
Also I suspect nobody wants to work on it because who wants to do printing.
Re:Windows 0day privilege escalation still not fixed by asveikau on Wednesday December 23, 2020 @06:39PM (#25523577)
I actually think working on printing infrastructure might be fun. There is image processing, font rendering, etc. which are fun niches. And you can see something physically tangible from your work.

It's not going to increase in relevance or take over the world, but it is probably satisfying.

Re:Windows 0day privilege escalation still not fixed by x0x0 on Wednesday December 23, 2020 @08:36PM (#25524321)
I strongly suspect it's a haphazard, under-tested mess of compat hacks to work with thousands of models of printers, with thousands of quirks and bugs that Microsoft has painfully worked around to take care of their customers.

As opposed to Apple, who just assumes you don't use printers older than 2 years and liberally breaks old printers and scanners.

Re:Windows 0day privilege escalation still not fixed by asveikau on Wednesday December 23, 2020 @09:42PM (#25524594)
App compat hacks can be a fun sport for the right kind of person. I was on the Windows team for a few years and I sometimes looked at those or saw posts about them on mailing lists. It can get interesting.
Re:Windows 0day privilege escalation still not fixed by rbanffy on Thursday December 24, 2020 @10:28AM (#25528275)
Printing was complicated in those days because a computer couldn't hold a bitmap of a printed page in memory and still do anything. Early PostScript printers were also much more powerful than the PCs that drove them, often with 32 bit RISC CPUs, dozens of megabytes of RAM and some even had SCSI disks.

Now that most computers can hold a page in their L2 caches, it's easy and much faster to render in-memory and send a bitmap over to the printer driver to let it print with whatever options it wants. All the driver needs is to accept a bitmap and print it as well as it can and you can safely ignore most of the printer's own PDL.

Most of the thorny issues in printing are with special-purpose printers - thermal, barcode, embedded text only, etc.

Apple uses CUPS and it should work fine with older printers. Last time I checked, CUPS could handle an HP Deskjet 500 (if you have the parallel port)

Re:Windows 0day privilege escalation still not fixed by tubs on Thursday December 24, 2020 @07:39PM (#25533069)
Fun story I heard from an aerospace engineer - they were running some heavy simulations and producing graphs.

He found the printer that was emitting the graphs was actually more powerful than the (very expensive) machines running the simulations, to the point that converting the simulation to postscript (or some variant thereof) and running it directly on the printer was some orders of magnitude faster.

Re:Windows 0day privilege escalation still not fixed by rbanffy on Friday December 25, 2020 @05:51AM (#25535694)
Indeed. I've seen printers churn out beautiful fractals at a fraction of the time it took 68K Macs to do it.
Re:Windows 0day privilege escalation still not fixed by j16sdiz on Wednesday December 23, 2020 @09:04PM (#25524428)
> There is image processing, font rendering, etc.

And stump upon sb else code that you have no permission to modify

Re:Windows 0day privilege escalation still not fixed by m-p-3 on Wednesday December 23, 2020 @05:34PM (#25523060)
That must be some kind of purgatory where developers goes to slowly die inside.
Re:Windows 0day privilege escalation still not fixed by tonyedgecombe on Thursday December 24, 2020 @10:17AM (#25528152)
I said it somewhat tongue in cheek because I have been working with printing technologies for my whole career.
Re:Windows 0day privilege escalation still not fixed by sosodev on Wednesday December 23, 2020 @06:53PM (#25523679)
I’ve been working on a printing related project at my job and it’s been awful. Printers are the worst.
Re:Windows 0day privilege escalation still not fixed by fuzzfactor on Thursday December 24, 2020 @12:01AM (#25525189)
In the 1980's with MS-DOS you started out printing without a print spooler.

When IBM chose the I/O ports for the PC, they used a parallel port compatible with early office printers from Centronics, but used a female DB-25 connector (previously seen mainly on external serial RS-232 modems) on the PC. The printer end of the cable had the Centronics type connector.

By that time Centronics and other pre-DOS printers were already issued with standard or optional serial RS-232 input, or parallel.

Serial printers most often still used a DB-25 like modems, and parallel the Centronics connector. The only bidirectional communication was logical handshaking which had dedicated conductors in the cable, serial only needed one conductor plus ground for the data and 2 or 3 more conductors if you were even using handshaking. Parallel uses 8 data conductors and about half a dozen logic lines.

The early IBM PC offered an optional serial RS-232 I/O card having a male DB-25 (9 pins is actually more than enough for serial but the DB-9 connectors didn't show up much until you got 2 COM ports on a single card) then once people started using a mouse they were serial DB-9 and built into the mainboard. This was the bidirectional port to communicate with modems and send to printers. Or anything else, the RS-232C standard specifies you must be able to short any of the conductors or connect them to anything within +/- 25VDC without damage, whether the hardware is powered on or not. Not everything meets the full standard.

OTOH, parallel connects directly to the bus and can be very sensitive to incorrect connections or plugging cables while powered. Often damaging motherboard chips for a while there if a stray DB-25 serial modem cable were plugged into the parallel port of a PC. Which might contain jumpers between pins in either or both RS-232 connector hoods to effect self-handshake.

The printer was conceptualized to be the one _peripheral_ that every office was going to surely have or the PC could not function like a typewriter, so the printer has actually always been part of the PC which you connect first before powering them up as one.

Anyway, DOS would only do one thing at a time, so for paperwork you would have to wait for the printer to finish before you could move on. Some printers were slower than others. Fast was not in the vocabulary for early-adopting offices.

Within a couple years at Radio Shack you could get a print spooler to come between the CPU and the printer. An external hardware print spooler of course.

What a time-saver! When you hit PRINT your data went into the spooler much faster than the printer could accept it, within a few seconds you had your command prompt back and the printer could finish the task on its own, however long it took.

Eventually significant buffers came inside the printers themselves, plus Windows became accepted in mainstream offices and it had a software spooler.

With printing handled within Windows at the actual DOS layer for the first decade while Windows was only a shell around whichever DOS you installed it over.

Re:Windows 0day privilege escalation still not fixed by tonyedgecombe on Thursday December 24, 2020 @10:16AM (#25528143)
I remember writing a print spooler for the Apple II. It only worked with RS-2332 because the Centronics interface didn't support interupts.

I don't think parallel ports connected directly to the bus, there was always an interface chip like the Intel 8255.

Re:Windows 0day privilege escalation still not fixed by fuzzfactor on Saturday December 26, 2020 @04:26PM (#25546568)
You're right, just not as well isolated as RS-232.
Re:Windows 0day privilege escalation still not fixed by UweSchmidt on Wednesday December 23, 2020 @07:05PM (#25523764)
How bad could it be? It's about assigning people to the task and if necessary increase the pay. If it's a bigger mess make it a priority and have your best people fix it asap. Printing and security are important.
Re:Windows 0day privilege escalation still not fixed by to11mtm on Wednesday December 23, 2020 @11:25PM (#25525058)
From my knowledge of the horrors of printing and being the 'printer guy' for a Drafting department where we dealt with all kinds of interesting printers...

The scenario I'm theorizing, is that there's probably at least one major vendor who's drivers are dependent on this behavior, and Microsoft is trying to avoid the flack that could result from an update 'breaking usability'. Working around that behavior could be complicated. I feel like if this is the case, I know the vendor.

Re:Windows 0day privilege escalation still not fixed by q3k on Wednesday December 23, 2020 @01:26PM (#25520469)
I assume it's bigcorp slowness, having to roll up all updates into patch batches, following release schedules, testing against all release trains, going through QA, etc. No accelerated way to push critical, but trivial software fixes.
Re:Windows 0day privilege escalation still not fixed by foepys on Wednesday December 23, 2020 @02:03PM (#25520859)
Last year they pushed some "simple" fixes fast and broke quite a few older VB applications. That was quite a fun day at my office when some customers couldn't work anymore...
Re:Windows 0day privilege escalation still not fixed by dmix on Wednesday December 23, 2020 @03:41PM (#25521965)
This is interesting do you have more details you could share or point to a link?
Re:Windows 0day privilege escalation still not fixed by foepys on Thursday December 24, 2020 @12:11AM (#25525220)
Re:Windows 0day privilege escalation still not fixed by the8472 on Wednesday December 23, 2020 @01:57PM (#25520806)
MS can and does issue out of schedule patches every now and then. This presumably doesn't meet the bar since it only is a local privesc.
Re:Windows 0day privilege escalation still not fixed by Retric on Wednesday December 23, 2020 @01:47PM (#25520695)
Microsoft has patched issues fairly quickly in the past. This may be a “critical” issue, but I think they have even higher internal classifications which this doesn’t qualify for.
Re:Windows 0day privilege escalation still not fixed by sedatk on Wednesday December 23, 2020 @04:00PM (#25522172)
> 2020-12-03 Microsoft advises that due to issues identified in testing, the fix will now slip to January 2021.
Re:Windows 0day privilege escalation still not fixed by bigiain on Wednesday December 23, 2020 @10:43PM (#25524854)
> They must have some ghoulish software actually relying on the broken behavior.

Probably XKeyscore or Solarwinds Orion or something... Can't break that shit, it gets important work done!