Aero Taskforce

clifgriffin wrote on June 3, 2008, 7:46pm

Why would someone spoof a bad driver dialog? That doesn't seem very useful.

I still promoted this because it is a valid issue. More details should be included.

murdocdv wrote on June 3, 2008, 8:15pm

Maybe I am being paranoid, but if any kind of security exploit can be triggered by a mouse click by the user on something that looks like this, you might have something. Seems to me users can get conditioned to clicking "Install this driver software anyway" because sometimes its still the right thing to do, VMware Fusion for example. At a minimum, this seems like it could just pop-up from anywhere and no user would have an idea why. Sure, if you are running an installer, and you don't get distracted doing something, you can figure it out. But if you lose track of what you are doing, this is a big scary dialog with no data to make decisions on.

cosmin2007 wrote on June 7, 2008, 3:04pm

Further details should be given. I think these dialogs are unfinished, beta - age ones, left in there because of a big hurry in delivering the WOW.

I N C O N S I S T E N T W O R K , M I C R O S O F T !

TheQuestor wrote on June 8, 2008, 8:30pm

Exactly, why not tell me useful things like exactly which driver is asking for this.

drdoug99 wrote on June 9, 2008, 3:39am

I agree, more information that is actually useful and can help you make an informed decision about the driver you are installing would be nice, and you'd think it would be there by default.

The problem is that MS is thinking to keep the dialogs simple so as to not be confusing, but really with the dialog given they are as useless as the UAC dialog boxes. Anyone installing a driver, or doing something that needs administrator rights is going to hopefully know what they are doing and be familiar with the process of installing drivers.

Dialog boxes like these are just another annoying thing to click on to waste time and have no relevance really, as I'm just going to install the driver anyway regardless of the stupid warning box.

JeremyG wrote on June 9, 2008, 2:43pm

I wish I could promote this issue with 500 extra points!!!

I came across this a couple of weeks ago after integrating drivers into a Vista build for a Proof-Of-Concept deployment scenario at a client. This popped up and I there was NO information on which driver it was. The client picked up on it immediately, and I had to agree with him, that I thought it was a major flaw.

Very stupid mistake!!!

Ensign Joe wrote on June 10, 2008, 10:07am

The best thing still is if you intsall some piece of hardware and windows finds a driver that fits from its own driver library and says "This driver has not passed the Windows Logo test".. so the driver is even marked with "ATI Rage Theater Video (Microsoft Corporation)" and is unsigned and whatever... Great!

ui_guy wrote on June 10, 2008, 10:26am

This is actually a regression from the equivalent XP dialog. It used to give you the name of driver or the device you were trying to install. I understand the desire to simply such things to the end user but if you compare the XP dialog with this one, there's so much more textual information than there ever was and precious little of it is useful. How is that simplified? It definitely looks like a leftover beta placeholder.

fowl wrote on June 12, 2008, 1:52am

The reason there is no evidence in this dialog is that, because there is no signature, THERE IS NO EVIDENCE! This is why it's red with scary text, it's saying

"Hey! I have absolutely now way of knowing anything about this driver"

anything it could say, would be misleading.

The real bug is unsigned drivers....

zooba wrote on June 12, 2008, 10:21am

"The real bug is unsigned drivers...."

Agreed. What is the dialog supposed to show? "The program 'setup.exe' wants to install an unverified driver." 3rd party drivers cause something like 90% of all Windows (XP/Vista) crashes. Anything to reduce that is a good thing.

jlandheer wrote on June 12, 2008, 6:12pm

I have to agree with fowl and zooba.

But what most people don't know and what anyone forgets to mention is not that a driver can cause crashes... but the real problem is somewhat bigger.

Fact: An unsigned driver can be made by anyone (including bad guys) and has access to everything. Drivers (signed and unsigned) can do sometimes even more than an administrator!

So the big question here is: What are these details to show, since everything can be spoofed it can be used to mislead someone into making a wrong assumption on whether this driver can be trusted or not. (Someone could make a setup of something, popup a driver dialog with details that look legit, and install the worst rootkit ever... )

Not providing any additional details will make people think twice before they hit: "Install anyway..."

ui_guy wrote on June 13, 2008, 5:46pm

"Not providing any additional details will make people think twice before they hit: "Install anyway...""

Not providing any details at all won't give anybody any clear indication about which driver happens to be unsigned which is worse as people won't even bother to look any further.

NathanB wrote on June 13, 2008, 9:27pm

> Not providing any additional details will make people think twice before they hit: "Install anyway..."

Which would be good if they had something to think. As it stands, all they have to think about is whether or not the program trying to install a driver might actually be the program they're hoping it is. If I were writing malware which I wanted to have install a driver, I'd wait until it looked like a setup program was running and then try to install myself, hoping that even a careful user will assume that the driver installation was valid.

.Chris wrote on August 21, 2008, 10:35pm

I would want an actual picture, downloaded from the net of the hardware with infomation on it to.

xp2whereru wrote on December 25, 2008, 4:52am

I think the dialog is the least of our worries... there probably won't even be a warning like this if Microsoft continues it's "no unsigned drivers" policy. 64-bit Vista already mandates that all drivers *must* be signed. You don't get an option. There isn't even a crack for this due to Patchguard (another component in it's DRM/security strategy) and aggressive updates.

When using Vista64 (now happily back on XP), I wish I got to see something like this. Even if it was the ugliest thing ever, allowing me to have control over my own machine would've been nice...