Windows Protected Print Mode

  • This is a step in the right direction, but IMO not far enough. Printers can (IIUC) cause the client machines to automatically install “printer support apps”, which are like somewhat limited drivers. They do this stuff:

    https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

    This includes intercepting the raw XPS data being sent to the printer and modifying it.

    It looks like these things are lightly sandboxed, but that’s not enough. These apps get access to extremely sensitive data, and they should be very sandboxed. IMO it should have input access to the document and printer settings, output access to what gets printed, and that’s it. No network, no storage, no Windows API, etc. Think wasm-style sandboxing.

    But I don’t think MS thinks like this.

  • What I do not understand is why the print spooler runs as the highest-privileged SYSTEM account. Any vulnerability in the print stack is basically game over. It seems to me that changing this long due and should be possible without dropping support to all old drivers (and printers).

  • This is well overdue, the existing situation is dire not just in terms of security but the general quality of software from the printer manufacturers.

    However this is going to break a lot of existing applications. The printer manufacturers have been laggards when it comes to adopting v4 drivers which date back to Vista.

  • I wonder if this will impact specialized photo and other graphic art printers? Things like the large format Epson and other Pro printers. What about plotters and vinyl cutout printers?

    They usually have a ton of driver specific settings, etc. for tuning the output. How will these settings be managed without drivers specific to them?

  • Looks like all printers will need to be Mopria certified, which is the first time I've heard of this certification:

    https://mopria.org/certified-products

  • Question, why the printers cannot act like web servers? Just receive a REST api request and then proceed to do their own thing (aka drive the printer to execute the request). Why my computer needs to know how to operate the printer?

  • Obviously the printing situation has been a nightmare for everyone involved for years. That said, Microsoft et al have made me so cynical at this point that I can’t read about “protected printing”, “secure printing”, and “putting the user first” without assuming this is a way to put some DRM filters in place to make sure you don’t print out those locked PDFs regardless of what tool you’re using. I’ll be glad to be wrong.

  • I read the article and am not sure if this will be implemented in Windows 10 or not. I still use a 20 year old HP laserjet via Vista drivers that install OK for now, will I be forced to get a new printer?

  • I’ve been printing using IPP with Haiku for years (since no drivers), works well. Good to see Windows finally go down this route as well, since installing crappy printer drivers was always an issue (dealing with vendor crapware).

  • Can I put a USB printer in the USB port of my router and get network printing? I don't want to use WiFi printing nor want to keep one PC on the network on at all times which HAS to print one page before others on network can print using it.

    This Is windows network BTW

  • If IPP is HTTP-based would it be possible to print directly from the brower to the printer, regardless of OS?

    That would be kinda cool or am I misunderstanding something?

  • The real problem is the printer makers want to make printers as cheap as possible and sell lots of ink to rake in the $.

    An actual good printer would have enough compute (Raspberry Pi would be sufficient) and storage (a small ssd) to handle the task by itself. Then printing is nothing more than copying a file to the printer.

  • > Over the past year, the MORSE team has been working in collaboration with the Windows Print team to modernize the Windows Print System

    So that's why printing in Win 10 is a mess, with no standard print dialogue and no print preview.

  • I just want to know which older printers will be no longer supported because they have an obscure page description language and their drivers will be blocked.

  • Is this some conspiracy with printer vendors to drastically increase sales?

    I have two old photo printers that work quite well and replacing them would be extremely expensive. The driver among other things contains features to match up color profiles.

    I have label printers that are old that also work well.

    All rely on custom printer drivers.

    I hope this new system is going to be phased in over a long timeframe, so I can keep using old printers. Even if writing software to integrate these printers with the new system no printer manufacturer is going to revisit 10 - 15-year-old printeres with a new set of drivers.

  • I'd be much happier if they could just adopt and contribute to CUPS like everyone else.

  • A “Universal Standard” — only available to alliance members.

    Sorry Linux.

  • Can we just remove all printing functionality from the OS?

    Printers are mostly networked in today's world. And the OS usually isn't involved when an application wants to talk to another device on the network beyond TCP connections etc.

    Just get the application to (using a library), connect directly to the printer, submit its job, show status, and disconnect when done.