WDK7 custom target path

NTDEV
81

Bob Kjelgaard wrote:

Win2K is rare, because it is a security risk to attach it to the
corporate network- one severe enough to cause you to lose
the privilege of attaching to it

What?? I’d love to hear the explanation behind this one, if only to see you bear witness against yourself that hooking up your own product inside your own company can get you kicked off your own network.

I’ve been using Win2k for what, eight years now, and don’t have any intention of giving it up, either… guess my wife will have to live with the “security risk” on our LAN :slight_smile: ('cept, her machine is 2K also … does that mean she’s immune???)

82

xxxxx@gmail.com wrote:

Bob Kjelgaard wrote:

> Win2K is rare, because it is a security risk to attach it to the
> corporate network- one severe enough to cause you to lose
> the privilege of attaching to it
>

What?? I’d love to hear the explanation behind this one, if only to see you bear witness against yourself that hooking up your own product inside your own company can get you kicked off your own network.

The issue is that there are no more updates. It is quite likely that
many of the security problems that have been automatically patched in XP
over the last couple of years would also apply to Win2K, but policy
prevents them from being released.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

83

Because large numbers of people want to crack our network is why- in general anything not patched to the latest and most secure level is a risk, and as far as I’m concerned this is utterly appropriate stance for our IT department or anyone else’s to take.

My understanding [and in no way an official statement] is that we only push the most absolutely critical fixes out for an OS which, after all, hit end of life several years ago [unless I’m misremembering, there are public statements over that period of time that specific fixes WOULD NOT be made to it because it was so old they weren’t feasible]. Have you seen us tout this at any time in the past several years as a highly secured OS, or actively encourage its continued usage?

I run it (and Win95, and WinME, for that matter) at home [but I limit my browsing, email and anything I want to feel secure about to an XP machine, and I connect none of them to the corporate network]. The most anyone gets for cracking them is old copies of PC games and another spambot [although I do use some other precautions].

If you truly take such glee in eliciting such a statement from me [because I may be crossing some lines that get me unemployed, here]- well at least I know who my friends are…

84

Tim Roberts wrote:

The issue is that there are no more updates. It is quite likely
that many of the security problems that have been automatically
patched in XP over the last couple of years would also apply to
Win2K, but policy prevents them from being released.

Sorry, don’t believe it. I just went to Windows Update a few weeks ago on my Win2k machine, for the first time in awhile, and there was probably 30+ updates waiting for me, most of them marked “critical security update for [blank]”.

Win2k is supposed to be on extended support until 2010 if I remember correctly. If not, why not just drop support for it in, say, KMDF? Then you can include the Win2k KMDF testers in the 5,000 layoffs…

85

At both WINHEC 2008 and DDC 2008 it was announced that KMDF 1.9 will be the final version to support Win2K. See slide 23 in this presentation:

http://download.microsoft.com/download/5/E/6/5E66B27B-988B-4F50-AF3A-C2FF1E62180F/COR-T546_WH08.pptx

That we still support it is why I even got into that issue in the first place- the longer we have to support it the more of a burden it becomes to test it, especially to the level we test everything else.

We’ve kept it this long because we listen to feedback and the demand for it is clearly there. We’ve already elicited and received feedback on the issue [it was one reason we made this announcement], and I know the level and quality of future support will be considered in the post-Win7 planning and I’m sure both the demand level and the costs involved in any such support evaluated as a part of that.

But I’ve worked in other environments, too- and discontinuing support for old products [even when some people are still using them] is not at all unusual. The economics of it aren’t any different, although the scale may be.

86

That is certainly not what he said. However, consider that if an unknown bug *were* to be found, that there’s no NX, no /GS (if memory serves, as I think Win2K was vc6-era, still), no SafeSEH, no SEHOP, no ASLR, or any of the other mitigations to try and stop successful exploitations that more current OS’s have. From that standpoint, you are much better off using something newer than Win2K.

? S

-----Original Message-----
From: xxxxx@gmail.com
Sent: Thursday, January 22, 2009 15:43
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] WDK7 custom target path

Bob Kjelgaard wrote:

> Win2K is rare, because it is a security risk to attach it to the
> corporate network- one severe enough to cause you to lose
> the privilege of attaching to it

What?? I’d love to hear the explanation behind this one, if only to see you bear witness against yourself that hooking up your own product inside your own company can get you kicked off your own network.

I’ve been using Win2k for what, eight years now, and don’t have any intention of giving it up, either… guess my wife will have to live with the “security risk” on our LAN :slight_smile: ('cept, her machine is 2K also … does that mean she’s immune???)

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

87

Windows 2000 still receives security support; the most recent MSRC bullet even included a Win2K patch, for instance.

support.microsoft.com claims that Win2K support exists until July 13, 2010, if you follow the “support lifecycle” link in the latest bulletin.

? S

-----Original Message-----
From: Tim Roberts
Sent: Thursday, January 22, 2009 16:17
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] WDK7 custom target path

xxxxx@gmail.com wrote:
> Bob Kjelgaard wrote:
>
>> Win2K is rare, because it is a security risk to attach it to the
>> corporate network- one severe enough to cause you to lose
>> the privilege of attaching to it
>>
>
> What?? I’d love to hear the explanation behind this one, if only to see you bear witness against yourself that hooking up your own product inside your own company can get you kicked off your own network.
>

The issue is that there are no more updates. It is quite likely that
many of the security problems that have been automatically patched in XP
over the last couple of years would also apply to Win2K, but policy
prevents them from being released.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

88

One more real life scenario where removing TARGETPATH caused problems.

Originally, I expected I’m not affected with the change and all I need
is to edit my SOURCES file for Win7 drivers. But I am. I have a trace
library which is shared between all drivers I have. It is pretty stable
and nothing changed there for years. Because of a friendly nature of
build it has to be built as a library and linked to drivers. So it has
to have its own SOURCES file. There was of course TARGETPATH defined
because it was mandatory in times when I wrote it. Now it broke the
build of Win7 driver because library is always built by WDK used for
given project (which is IMO the only safe way).

Well, let’s remove it and everything will be OK. But I can’t. I have
some old drivers built by 3790.1830 and even 2600.1106 DDKs where it was
mandatory. Drivers are only built for upgrade scenarios when they’re
used to extract files from old encrypted images to a new format handled
by diffent software. But they have to be built event with the newest
software to be included there. The requirement is nothing really change,
only version info which has to be current. That’s why I can’t switch
these projects to newer DDKs because they would have to be completely
retested (call it paranoia but we resist on it).

Well, I solved it, but it costed some time and one broken nighty build.
Please, for the future, never remove what was mandatory in the past. It
isn’t very funny:

DDK 3790.1830:

!IFNDEF TARGETPATH
! ERROR Your .\sources. file must define the TARGETPATH= macro
!ENDIF

WDK 7000:

!if defined(TARGETPATH)
!error $(MAKEDIR): TARGETPATH is no longer allowed. Remove it.
!endif

My temporary solution for the shared library:

!IFNDEF _NT_TARGET_VERSION_WIN7
TARGETPATH=obj
!ENDIF

Best regards,

Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@microsoft.com
Sent: Tuesday, January 20, 2009 7:43 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] WDK7 custom target path

Thanks all for the feedback!

Binplace can do more, TARGETPATH will be restored. We will
consider customizing the _NTTREE and intemediate output so
they can be redirected as desired. Right now they are
predefined in setenv.bat (_NTTREE and OBJECT_ROOT).

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online
at http://www.osronline.com/page.cfm?name=ListServer

89

> The issue is that there are no more updates.

I moved away from w2k only in Aug 08, and there were still regular updates for it that time.

I think it is still supported by Windows Update team.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com