8 ms·

WireGuard makes new Windows release following Microsoft signing resolution

549 points by zx2c4 5mo ago

Recent and related: Microsoft terminated the account VeraCrypt used to sign Windows drivers - https://news.ycombinator.com/item?id=47686549 https://news.ycombinator.com/item?id=47686549

john_strinlai 5mo ago
>The comments that followed were a bit off the rails. There's no conspiracy here from Microsoft. But the Internet discussion wound up catching the attention of Microsoft, and a day later, the account was unblocked, and all was well. I think this is just a case of bureaucratic processes getting a bit out of hand, which Microsoft was able to easily remedy. I don't think there's been any malice or conspiracy or anything weird. it was a bit crazy how quickly people got conspiracy-minded about it. microsoft fucked up, and as per typical big-tech, only fixed it when noise got made on social media. but not everything is a grand conspiracy orchestrated by microsoft or the government or whatever. incompetence is always more likely than malice. any news from the veracrypt maintainers? i would imagine whatever microsoft employee got tasked with resolving this issue would have also seen that one. --- edit: well, i certainly underestimated the response to this comment. my mistake for using a common saying rather than being extremely explicit when it comes to something as emotionally charged as microsoft. i dont think i have seen a comment of mine go up and down points so many times before. what i intended to get across was: "this was not a deliberate, coordinated, purposeful attack on the wireguard project, at the behest of some microsoft executive, to accomplish some goal of making encrypted communication impossible or whatever. instead, this was the result of a stupid system, with a stupid resolution process (social media), that is still awful, but different in important ways from a deliberate attack. this is the typical scenario (stupid system, stupid resolution). the non-typical scenario would be a deliberate choice made and executed by microsoft employees to suddenly destroy a popular project". i shortened the above paragraph to the common saying "incompetence is always more likely than malice". i shouldnt have. my bad.
- anonymous908213 5mo ago
  > incompetence is always more likely than malice. "Incompetence" of this degree is malice. It is actively malicious to create a system that automatically locks people out of their accounts with absolutely no possibility for human review or recourse short of getting traction in the media. "No sir, I didn't grind those orphans up. It was this orphan grinding machine I made that did it, teehee!"
  - john_strinlai 5mo ago
    i am positive that you understand the spirit of what that saying means. incompetence is always more likely than [intentional, directed] malice. microsoft employees did not deliberately attack the wireguard project with a goal of taking it down for whatever grand scheme people's hatred cooks up. if you have evidence that microsoft did this deliberately to ruin the wireguard project, please forward it along to jason (the wireguard maintainer) and several news outlets.
    - acedTrex 5mo ago
      And the person you are responding is asserting that the response to incompetence of this level should be the SAME as if it directed and intentional malice. Which is a completely valid way to view a fuckup like this.
      - john_strinlai 5mo ago
        >response to incompetence of this level should be the SAME sure. but this was not a deliberate attack by microsoft employees to shutdown wireguard. that is what i was trying to say and the essence of the quote in question.
        acedTrex 5mo ago
        They are saying that "deliberate attack" or not does not matter and is not worth pointing out. The response is the same so its a worthless point.
- BLKNSLVR 5mo ago
  Conspiracy 1: rules from on-high about encryption projects to be suppressed. Debunked. Conspiracy 2: Copilot all the things! Probably not too far off.
  - john_strinlai 5mo ago
    i think they have explicitly made it clear that they want to copilot all of the things (unfortunately), so i dont quite file it under the conspiracy label.
    - wongarsu 5mo ago
      If it's not a conspiracy (and to be clear, I don't think it is one) its still a failure on multiple levels of the organisation We can probably blame copilot for the email about new verification reqirements not going out to everyone. Maybe even for the reports of people who jumped through all the hoops and still got blocked as if they hadn't. But rolling out new verification reqirements, then not monitoring how many developers fulfill your new reqirements and following up is entirely on Microsoft employees. That's management failure and disregard for developers on their platform
- trinsic2 5mo ago
  With the way things are going right now with all the corruption in governments and corporations were way past the point of giving the benefit of the doubt. These organizations are clearly making changes to their OS's to slowly remove user control. Everything should be treat as suspicious moving forward and I am glad of the skepticism.
  - sscaryterry 5mo ago
    The question is, did they notify the user that the account was blocked, or was it done silently? My money is on the latter, obviously I don’t know, just my guess. Was there a reason? Blocked is semantically harsher, than it has been disabled.
    - billziss 5mo ago
      It was done silently. I am one of the affected developers and my software is the open source file system driver WinFsp: https://github.com/winfsp/winfsp https://github.com/winfsp/winfsp
      - sscaryterry 5mo ago
        Uncool. Now the question is, how many people, many not reading hn, are actually affected. Seems like a blanket ban of some sort.
- TiredOfLife 5mo ago
  > it was a bit crazy how quickly people got conspiracy-minded about it. That's just the side effect of the Soross tracking chips hidden in vaccines activated by 5g towers
- orbital-decay 5mo ago
  All this doesn't matter. What matters is the destructive potential and a breach of trust. CAs have been distrusted for less.
  - john_strinlai 5mo ago
    >CAs have been distrusted for less. root programs are super specific about root cause analysis, what actions lead up to distrust, differentiating deliberate maliciousness from systemic incompetence, etc. its like the exact opposite of "all this doesnt matter". of course they still look at the outcome (danger to users, etc.), typically as a first step. but they take great care to determine exactly what lead up to a specific outcome.
    - orbital-decay 5mo ago
      It really depends on the scale of the breach, for example DigiNotar was immediately killed for their gross incompetence. In this case even the scale is unclear, with heavy suspicion towards malice and little hope on fixing any process inside that monstrous bureaucracy or even making it meaningfully care if it's not. I see no reason to trust Microsoft anymore, regardless of it being a fuckup or malice.
    - direwolf20 5mo ago
      I think they meant a CA that acted like Microsoft would be distrusted. Not a CA that acted like WireGuard would be distrusted.
- Scaled 5mo ago
  Society is a bit fatigued of big tech companies making their various accounts essential and then locking people out of them without any due process.
  - john_strinlai 5mo ago
    yes, i am in agreement. i tried to be extremely clear in my edit that i think that the whole social media being the only way to get an account back is crazy stupid.
- dec0dedab0de 5mo ago
  Microsoft lost the benefit of the doubt decades ago.
- themafia 5mo ago
  Who needs conspiracy? Microsoft has entitled itself to decide what I can and cannot run on the computer and OS that I paid for, this earns them no additional revenue, so they don't care to do a good job. This system will never work properly.
zx2c4 5mo ago
As I mentioned in the mailing list post, the Microsoft paperwork shuffling matter got dealt with rather quickly, following all the attention the HN thread from the other day got. And now we're finally out with an update! NT programming is a lot of fun, though this release was quite challenging, because of all of the toolchain updates. On the plus side, we got to remove pre-Win10 support -- https://lists.zx2c4.com/pipermail/wireguard/2026-March/009541.html https://lists.zx2c4.com/pipermail/wireguard/2026-March/00954... . But did you know that Microsoft removed support for compiling x86 drivers in their latest driver SDK? So that was interesting to work around. There was also a fun change to the Go runtime included in this release: https://github.com/golang/go/commit/341b5e2c0261cc059b157f1c7a2a2c4d1f417f0d https://github.com/golang/go/commit/341b5e2c0261cc059b157f1c... All and all, a fun release, and I'm happy to have the Windows release train cooking again.
- deleted 5mo ago
  [deleted]
- BLKNSLVR 5mo ago
  Off topic: Thanks for wireguard. It is a truly great piece of software.
- sammy2255 5mo ago
  Good to know everything was resolved, but did you ever find out why your signing account was suspended? That's not something you brush off as haha silly Microsoft..
  - Leherenn 5mo ago
    Apparently it's quite widespread, so I would assume a bug on their side. That's what support seemed to imply at least. We're still blocked at my company for one month+ now.
    - PeterStuer 5mo ago
      "so I would assume a bug on their side" Why a "bug".
manbash 5mo ago
Happy to see it resolved and I hope the other developers are able to have the same experience. By the way, was it only for the Windows application, or was wireguard-go was also affected?
- zx2c4 5mo ago
  This was just for WireGuardNT, the kernel driver for the NT kernel that Windows uses. This project -- https://git.zx2c4.com/wireguard-nt/about/ https://git.zx2c4.com/wireguard-nt/about/ -- is used by this app -- https://git.zx2c4.com/wireguard-windows/about/ https://git.zx2c4.com/wireguard-windows/about/ . The former is what the signing situation was about. The latter is just signed using a normal boring (but very expensive!) EV code signing certificate from one of the CAs.
c0l0 5mo ago
As a wireguard user myself (even on the lone Windows machine that I still begrundingly have), I am happy that this problem could have been resolved. I am just wondering - if there had not been this kind of public outcry and outrage that Mr. Donenfeld discounts in his announcement message, would the issue have been fixed by now? What are individual developers of "lesser" (less important, less visible, less used) software with a Windows presence to do? Wait and pray for Goliath to make the first benevolent move, like all the folks who got locked out forever from their Google accounts on a whim? Ha! The fact of the matter is, the code signing requirements on Windows are a serious threat to Free and Open Source Software on the platform. Code signing requirements are a threat to FOSS on all platforms that support this technique, and infinitely more so where it's effectively mandatory. I firmly believe that these days, THIS is the preferred angle/vector for Microsoft to kill the software variety their C-levels once publicly bad-mouthed as "cancer", and zx2c4 is one of the poor frogs being slowly boiled alive. Just not this time - yet.
- x0x0 5mo ago
  I got a modestly-similar situation resolved by buying a support package and spending 4+ hours across ... not sure, but probably 4-5 support calls? It's been 5 years. If memory serves it was the $200/mo support package for Azure. In retrospect, I should have not spent 3 weeks trying to get their incompetent software to work and just gone straight to phone calls. And at least in my case, the support agents seemed broadly unfamiliar, but seemed to have access to higher-priority internal case submission which did finally get to someone who could fix my issue.
- sillysaurusx 5mo ago
  They would be ignored. Having an audience is key to getting problems solved, whether it’s a lone hacker or a large corporation. Without an audience, you have no leverage. At that point you might as well create a new Windows account and re-apply, since that would have more luck than getting around a “we’ve closed your account and there’s no appeal process” barrier. If that sounds Kafkaesque, it is. It’s a small miracle that getting a post to the top of HN can surmount such bureaucracy at all. The best way to get an audience is to tell a compelling story. Make it interesting. There are ways of doing that for even the least known developers. My point is to push back against the idea that it should be fair to everyone and that what’s morally right should prevail in every case. The hardware developer program doesn’t exist to treat every developer fairly. They exist to make money for Microsoft. pg puts it more eloquently here: https://paulgraham.com/judgement.html https://paulgraham.com/judgement.html
maltris 5mo ago
LibreOffice, VeraCrypt, WireGuard. 2 questions: Whats next? Is that a pattern?
- ChocolateGod 5mo ago
  What has LibreOffice got to do with any of this?
  - Terr_ 5mo ago
    Perhaps this from last year, though it doesn't directly involve code-signing: https://www.neowin.net/news/microsoft-bans-libreoffice-developers-account-without-warning-rejects-appeal/ https://www.neowin.net/news/microsoft-bans-libreoffice-devel...
  - IvyMike 5mo ago
    Maybe this from 8 months ago? https://news.ycombinator.com/item?id=44728369 https://news.ycombinator.com/item?id=44728369
  - quantum_magpie 5mo ago
    MS has a history of fucking up LibreOffice installs. https://wiki.documentfoundation.org/Faq/General/General_Installation_Issues_%28Windows%29 https://wiki.documentfoundation.org/Faq/General/General_Inst...
    - elAhmo 5mo ago
      I am sure this is by accident, MS would never try to discourage users from installing free alternatives to their offerings.
- Lihh27 5mo ago
  yeah three projects, one account lock, everyone's users stop getting updates. that's the pattern
- direwolf20 5mo ago
  And Windscribe
IshKebab 5mo ago
I don't think you can let them off that easily, given that the only effective support channel was "get to the front page of hacker news", which isn't usually an option.
volume_tech 5mo ago
[dead]
looneysquash 5mo ago
But what would have happened if they weren't able to get Microsoft's attention through an outside channel (this site) and had to go through the normal process? I'm glad it was resolved quickly for WireGuard, but I'm concerned the results won't generalize. Also, thanks for WireGuard!
- aaronmdjones 5mo ago
  > and had to go through the normal process? There is no normal process. The error message clearly states "There are no appeals available, we have closed your application". If the company makes it impossible for you to communicate with them, the only recourse is to draw public attention to it in order to shame them. This only works if you can gather enough public support and kick up enough of a stink about it. All of the small developers still locked out of their accounts are screwed.
  - wpollock 5mo ago
    > If the company makes it impossible for you to communicate with them, the only recourse is to draw public attention to it in order to shame them. Legal action works too. You'd be surprised how effective a letter from an attorney can be.
Aurornis 5mo ago
There was a lot of speculation about this issue because readers assumed that WireGuard's was the only account that got locked. There was actually a wave of account locks that happened at the same time. If you only saw one of the headlines you might assume it was targeted or the result of some directed conspiracy, not the result of a widespread process. Microsoft did a (very!) bad job of communicating what was happening, but The Register has more information: > He explained that both deactivations were executed as part of the Windows Hardware Program's account verification procedures. > The company published a blog in October, giving devs a two-week warning that if their accounts had not been verified since April 2024, Microsoft would issue mandatory account verification notifications. > "We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri.
- donmcronald 5mo ago
  > "We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri. Emails are useless given the volume of trivial crap that MS emails about. Banners don't help for systems on auto-pilot. Reminders how? Break my workflow and let me un-break it when I notice.
shevy-java 5mo ago
What's going on at Microsoft? Why did they suddenly declare war on VPN and related software projects?
- direwolf20 5mo ago
  Wouldn't comply with CIA backdoor requirements, but now they do ;)
tamimio 5mo ago
> I don't think there's been any malice or conspiracy or anything weird Wink if there’s someone else in the room :)
redeeman 5mo ago
and imagine for those guys that dont have the reach wireguard/veracrypt does. NEVER trust microsoft, NEVER trust any mechanism people dont 100% control themselves. having to rely on microsoft to sign stuff is an abomination and something nobody should do
everdrive 5mo ago
An interesting point I don't think I've seen someone make -- people compare the LLM revolution to other technical revolutions. You don't need to worry about skill decay in the same way that you don't know how to bake bread from unprocessed wheat, or you don't know how to build a loom, etc. But local models aside (which no matter the protests from HN, will only be available to the technically savvy few) all of these LLMs are a service, so, the company could degrade the service, they could charge more than you're willing or able to pay, they could ban you. They could disable your account with no meaningful way appeal or seek support. LLMs could look at lot more like the scenario in this thread than something like not knowing how to make your own shoes.
- kbelder 5mo ago
  It might settle into a situation where cutting edge LLMs are a service, while older and smaller LLMs are self-hosted. So you are not at risk of being cut off, but of being degraded.
  - donmcronald 5mo ago
    I hope you're right. I played around with a bunch of AI stuff recently and that's kind of the conclusion I came to. Use local AI for mission critical stuff, if you're confident in that, and use the SOTA models for reviewing. Tap the latest general knowledge for asking "could this be improved", but make the improvements with local systems and models. But then the obvious problem becomes finding new data to train the AIs. In my opinion, there's no way their plan doesn't involve stealing from everyone to keep training, so is it really going to be safe to use the cutting edge models at all?
- donmcronald 5mo ago
  If they manage to build good memory systems, people will stop keeping personal docs and rely on the “AI” for everything. Imagine 20 years from now when people don’t even have copies of the recipe to bake bread and then you’ll see what the goal is.
  - 5mo ago
globular-toast 5mo ago
Why do people put so much effort into supporting a hostile platform? I really don't get it.
- DarkUranium 5mo ago
  Monopolies.
rajptech 5mo ago
[dead]
golem14 5mo ago
Since the impact of the account is presumably known to Microsoft (through telemetry etc), they probably know when these accounts get turned off, and can mark them in case the owner comes back and tries recovery. Microsoft would not have to automatically and 100% correctly reinstate the account. The goal would be to get high level cases like this one in front of a knowledgable human before the locked account posts angry owner posts complaints in public (If Joe Bloe's defragmentation utility noone has ever heard of and only having 10 installs goes bad, noone would care.) Here, they don't have to be perfect - you just need to have enough signal-to-voice ratio that employing a very small number of people outweighs the cost to PR and execs to deal with these cases, and to not let accounts get hacked through recovery. The response from Microsoft [1] is not great, or makes me hopeful. ``` Pavan Davuluri, Microsoft's President of Windows and Devices, said both Idrassi and Donenfeld should have their accounts restored "soon." "We've seen these reports and are actively working to resolve this as quickly as possible," Davuluri Xeeted. "We've reached out to VeraCrypt and have spoken to Jason at WireGuard, they should be back up and running soon." He explained that both deactivations were executed as part of the Windows Hardware Program's account verification procedures. The company published a blog in October, giving devs a two-week warning that if their accounts had not been verified since April 2024, Microsoft would issue mandatory account verification notifications. "We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri. "And we know that sometimes things still get missed. We're taking this as an opportunity to review how we communicate changes like this and make sure we're doing it better." ``` [1] https://www.theregister.com/2026/04/09/microsoft_dev_account_deactivations/ https://www.theregister.com/2026/04/09/microsoft_dev_account...
- donmcronald 5mo ago
  It could be dead simple. Lock the account, but let the owner temporarily unlock it for X days so they have enough time to undergo verification.
- drewfax 5mo ago
  > make sure partners understood this Since when they were partners to Micro$lop? First, it's thug like behavior taking the ability to run code on our own computers without their approval. Second it's even more evil justifying this behaviour by calling the developers "partners".
Ms-J 5mo ago
Could you give us an update on how everything was resolved? I believe the transparency would be a huge plus. This happened to Wireguard, Veracrypt, Windscribe, and possibly others. Certainly not isolated and very unnerving. There are still many unanswered questions...
incompatible 5mo ago
"The comments that followed were a bit off the rails. There's no conspiracy here from Microsoft. But the Internet discussion wound up catching the attention of Microsoft, and a day later, the account was unblocked, and all was well. I think this is just a case of bureaucratic processes getting a bit out of hand, which Microsoft was able to easily remedy. I don't think there's been any malice or conspiracy or anything weird." Hopefully, this isn't just something Microsoft made them say as part of an agreement to get their account back.
- donmcronald 5mo ago
  I would guess they realized they missed a notification or warning and feel a bit bad about the whole thing blowing up. Hopefully not though. The fact there were several high profile projects that got caught off guard puts the blame mostly on MS IMO. I think the reason these things go viral is that a ton of people reading about them can see themselves in the same situation, minus the clout needed to get it resolved. A short term PR crisis is the best we can get, so everyone piles on. I don't think MS will fix it though. IMO, they're more likely to create a program for open source code signing. That way they can capture all the high visibility projects, get a bunch of goodwill for being philanthropic, and all the small projects that don't qualify are too small to cause a fuss, so they can continue to treat them poorly.
Nevermark 5mo ago
Individual-level ethics and respect are being dispensed with en masse. The excuse being that these companies operate "at scale". But last time I checked, they are taking money from individuals. Or otherwise encouraging individuals to use their services. So this lack of respect for individuals by specific large companies, is predicated on their encouraging users to trust them, and depend on them, without taking on any of the implied responsibility to not capriciously ruin someone's day or year. And then hard or soft stone wall them. As someone who nearly lost everything due to the automated bureaucracy of a financial firm, I cannot stress: We are not safe. And we will not be safe until these companies are legally required to treat customer investment and dependency on their services, as valuable and necessarily recoverable, via prompt recourse and response, in cases where the automated bureaucratic systems fail. Otherwise, this is going to keep getting worse. When I hear how Microsoft helps someone who got attention, what I hear is that it takes extraordinary circumstances for Microsoft to care about the significant harm that there systems are causing many other people, today, who did not have the luck of this person. And that they are very very aware of this. I think we need to start using the word evil for this. Because it is. It is gross irresponsibility. Gross abuse of a power situation, of a strong dependency, that the company quite knowingly creates.
- donmcronald 5mo ago
  Software distribution is largely controlled by 3 companies; Microsoft, Google, and Apple. We used to have the web and web apps as an escape hatch, but, surprise, all 3 of those companies use a shared “safe” browsing blacklist that can be used to wipe your domain / website out of existence. Mozilla participates by using the same list which is a shame. Big tech shouldn’t be allowed to control the platforms and the ability to distribute / blacklist software and sites. That needs to be legislated against and those companies need to be broken into a thousand pieces each.
  - Nevermark 5mo ago
    Agreed. The strong gatekeeping, the encouragement of vital dependency (i.e. treating user/customer data, email, content as if it were the company's, even to the point of cutting access without recourse), the dark pattern upsells, unpermissioned or dark permissioned surveillance, manipulation, the hosting of pervasive scam ads (even Apple News is full of scam ads), ... None of this should be acceptable. All these ethical violations degrade the lives of countless individuals in the name of "freedom" for corporations. Conflicts of interest and anticompetitiveness should not be "free" in either sense of the word.
swisniewski 5mo ago
How big is the Wire Guard user base on Windows? How often do they ship new versions? My understanding is that: 1. Windows drivers are Attested by Microsoft 2. Windows collects driver telemetry Which means a really good question to ask is: Why are they canceling driver signing accounts without looking at metrics?
- emj 5mo ago
  "it is only 0.01 promille of our customers" chopping off the long tail.
kuzivaai 5mo ago
The "minimum supported Windows version" ratchet is underrated as a maintenance strategy. I've watched codebases drown in compatibility shims that nobody remembers why they exist. Curious how much of the driver size reduction came from dropping pre-Win10 support versus the toolchain updates.
jiusanzhou 5mo ago
[dead]
ekjhgkejhgk 5mo ago
Could someone clarify, why do you need signing whatever to write software on Windows? Why can't you just write the software and run it? And when has this changed?
luckman212 5mo ago
Would be great to see a fresh macOS App Store release. The current one (3+ years old) has a few sharp edges.
microespana 5mo ago
[dead]
Xiaoher-C 5mo ago
The code-signing problem on Windows is fundamentally asymmetric. WireGuard survived because it was visible enough that losing signing became embarrassing for Microsoft. Most projects aren't. They just quietly stop working and nobody notices except the users. This situation got fixed because of an HN thread. That's a terrible way to maintain software infrastructure. You shouldn't need to go viral to keep your project running on a major OS. The underlying problem isn't going away unless there's either regulatory pressure or a credible community attestation model that bypasses the single-CA trust structure. Microsoft has no obvious incentive to build that themselves.

549 points by zx2c4 5mo ago

Recent and related: Microsoft terminated the account VeraCrypt used to sign Windows drivers - https://news.ycombinator.com/item?id=47686549 https://news.ycombinator.com/item?id=47686549

john_strinlai 5mo ago

>The comments that followed were a bit off the rails. There's no conspiracy here from Microsoft. But the Internet discussion wound up catching the attention of Microsoft, and a day later, the account was unblocked, and all was well. I think this is just a case of bureaucratic processes getting a bit out of hand, which Microsoft was able to easily remedy. I don't think there's been any malice or conspiracy or anything weird. it was a bit crazy how quickly people got conspiracy-minded about it. microsoft fucked up, and as per typical big-tech, only fixed it when noise got made on social media. but not everything is a grand conspiracy orchestrated by microsoft or the government or whatever. incompetence is always more likely than malice. any news from the veracrypt maintainers? i would imagine whatever microsoft employee got tasked with resolving this issue would have also seen that one. --- edit: well, i certainly underestimated the response to this comment. my mistake for using a common saying rather than being extremely explicit when it comes to something as emotionally charged as microsoft. i dont think i have seen a comment of mine go up and down points so many times before. what i intended to get across was: "this was not a deliberate, coordinated, purposeful attack on the wireguard project, at the behest of some microsoft executive, to accomplish some goal of making encrypted communication impossible or whatever. instead, this was the result of a stupid system, with a stupid resolution process (social media), that is still awful, but different in important ways from a deliberate attack. this is the typical scenario (stupid system, stupid resolution). the non-typical scenario would be a deliberate choice made and executed by microsoft employees to suddenly destroy a popular project". i shortened the above paragraph to the common saying "incompetence is always more likely than malice". i shouldnt have. my bad.

anonymous908213 5mo ago
> incompetence is always more likely than malice. "Incompetence" of this degree is malice. It is actively malicious to create a system that automatically locks people out of their accounts with absolutely no possibility for human review or recourse short of getting traction in the media. "No sir, I didn't grind those orphans up. It was this orphan grinding machine I made that did it, teehee!"
- john_strinlai 5mo ago
  i am positive that you understand the spirit of what that saying means. incompetence is always more likely than [intentional, directed] malice. microsoft employees did not deliberately attack the wireguard project with a goal of taking it down for whatever grand scheme people's hatred cooks up. if you have evidence that microsoft did this deliberately to ruin the wireguard project, please forward it along to jason (the wireguard maintainer) and several news outlets.
  - acedTrex 5mo ago
    And the person you are responding is asserting that the response to incompetence of this level should be the SAME as if it directed and intentional malice. Which is a completely valid way to view a fuckup like this.
    - john_strinlai 5mo ago
      >response to incompetence of this level should be the SAME sure. but this was not a deliberate attack by microsoft employees to shutdown wireguard. that is what i was trying to say and the essence of the quote in question.
      - acedTrex 5mo ago
        They are saying that "deliberate attack" or not does not matter and is not worth pointing out. The response is the same so its a worthless point.
BLKNSLVR 5mo ago
Conspiracy 1: rules from on-high about encryption projects to be suppressed. Debunked. Conspiracy 2: Copilot all the things! Probably not too far off.
- john_strinlai 5mo ago
  i think they have explicitly made it clear that they want to copilot all of the things (unfortunately), so i dont quite file it under the conspiracy label.
  - wongarsu 5mo ago
    If it's not a conspiracy (and to be clear, I don't think it is one) its still a failure on multiple levels of the organisation We can probably blame copilot for the email about new verification reqirements not going out to everyone. Maybe even for the reports of people who jumped through all the hoops and still got blocked as if they hadn't. But rolling out new verification reqirements, then not monitoring how many developers fulfill your new reqirements and following up is entirely on Microsoft employees. That's management failure and disregard for developers on their platform
trinsic2 5mo ago
With the way things are going right now with all the corruption in governments and corporations were way past the point of giving the benefit of the doubt. These organizations are clearly making changes to their OS's to slowly remove user control. Everything should be treat as suspicious moving forward and I am glad of the skepticism.
- sscaryterry 5mo ago
  The question is, did they notify the user that the account was blocked, or was it done silently? My money is on the latter, obviously I don’t know, just my guess. Was there a reason? Blocked is semantically harsher, than it has been disabled.
  - billziss 5mo ago
    It was done silently. I am one of the affected developers and my software is the open source file system driver WinFsp: https://github.com/winfsp/winfsp https://github.com/winfsp/winfsp
    - sscaryterry 5mo ago
      Uncool. Now the question is, how many people, many not reading hn, are actually affected. Seems like a blanket ban of some sort.
TiredOfLife 5mo ago
> it was a bit crazy how quickly people got conspiracy-minded about it. That's just the side effect of the Soross tracking chips hidden in vaccines activated by 5g towers
orbital-decay 5mo ago
All this doesn't matter. What matters is the destructive potential and a breach of trust. CAs have been distrusted for less.
- john_strinlai 5mo ago
  >CAs have been distrusted for less. root programs are super specific about root cause analysis, what actions lead up to distrust, differentiating deliberate maliciousness from systemic incompetence, etc. its like the exact opposite of "all this doesnt matter". of course they still look at the outcome (danger to users, etc.), typically as a first step. but they take great care to determine exactly what lead up to a specific outcome.
  - orbital-decay 5mo ago
    It really depends on the scale of the breach, for example DigiNotar was immediately killed for their gross incompetence. In this case even the scale is unclear, with heavy suspicion towards malice and little hope on fixing any process inside that monstrous bureaucracy or even making it meaningfully care if it's not. I see no reason to trust Microsoft anymore, regardless of it being a fuckup or malice.
  - direwolf20 5mo ago
    I think they meant a CA that acted like Microsoft would be distrusted. Not a CA that acted like WireGuard would be distrusted.
Scaled 5mo ago
Society is a bit fatigued of big tech companies making their various accounts essential and then locking people out of them without any due process.
- john_strinlai 5mo ago
  yes, i am in agreement. i tried to be extremely clear in my edit that i think that the whole social media being the only way to get an account back is crazy stupid.
dec0dedab0de 5mo ago
Microsoft lost the benefit of the doubt decades ago.
themafia 5mo ago
Who needs conspiracy? Microsoft has entitled itself to decide what I can and cannot run on the computer and OS that I paid for, this earns them no additional revenue, so they don't care to do a good job. This system will never work properly.

zx2c4 5mo ago

As I mentioned in the mailing list post, the Microsoft paperwork shuffling matter got dealt with rather quickly, following all the attention the HN thread from the other day got. And now we're finally out with an update! NT programming is a lot of fun, though this release was quite challenging, because of all of the toolchain updates. On the plus side, we got to remove pre-Win10 support -- https://lists.zx2c4.com/pipermail/wireguard/2026-March/009541.html https://lists.zx2c4.com/pipermail/wireguard/2026-March/00954... . But did you know that Microsoft removed support for compiling x86 drivers in their latest driver SDK? So that was interesting to work around. There was also a fun change to the Go runtime included in this release: https://github.com/golang/go/commit/341b5e2c0261cc059b157f1c7a2a2c4d1f417f0d https://github.com/golang/go/commit/341b5e2c0261cc059b157f1c... All and all, a fun release, and I'm happy to have the Windows release train cooking again.

deleted 5mo ago
[deleted]
BLKNSLVR 5mo ago
Off topic: Thanks for wireguard. It is a truly great piece of software.
sammy2255 5mo ago
Good to know everything was resolved, but did you ever find out why your signing account was suspended? That's not something you brush off as haha silly Microsoft..
- Leherenn 5mo ago
  Apparently it's quite widespread, so I would assume a bug on their side. That's what support seemed to imply at least. We're still blocked at my company for one month+ now.
  - PeterStuer 5mo ago
    "so I would assume a bug on their side" Why a "bug".

manbash 5mo ago

Happy to see it resolved and I hope the other developers are able to have the same experience. By the way, was it only for the Windows application, or was wireguard-go was also affected?

zx2c4 5mo ago
This was just for WireGuardNT, the kernel driver for the NT kernel that Windows uses. This project -- https://git.zx2c4.com/wireguard-nt/about/ https://git.zx2c4.com/wireguard-nt/about/ -- is used by this app -- https://git.zx2c4.com/wireguard-windows/about/ https://git.zx2c4.com/wireguard-windows/about/ . The former is what the signing situation was about. The latter is just signed using a normal boring (but very expensive!) EV code signing certificate from one of the CAs.

c0l0 5mo ago

As a wireguard user myself (even on the lone Windows machine that I still begrundingly have), I am happy that this problem could have been resolved. I am just wondering - if there had not been this kind of public outcry and outrage that Mr. Donenfeld discounts in his announcement message, would the issue have been fixed by now? What are individual developers of "lesser" (less important, less visible, less used) software with a Windows presence to do? Wait and pray for Goliath to make the first benevolent move, like all the folks who got locked out forever from their Google accounts on a whim? Ha! The fact of the matter is, the code signing requirements on Windows are a serious threat to Free and Open Source Software on the platform. Code signing requirements are a threat to FOSS on all platforms that support this technique, and infinitely more so where it's effectively mandatory. I firmly believe that these days, THIS is the preferred angle/vector for Microsoft to kill the software variety their C-levels once publicly bad-mouthed as "cancer", and zx2c4 is one of the poor frogs being slowly boiled alive. Just not this time - yet.

x0x0 5mo ago
I got a modestly-similar situation resolved by buying a support package and spending 4+ hours across ... not sure, but probably 4-5 support calls? It's been 5 years. If memory serves it was the $200/mo support package for Azure. In retrospect, I should have not spent 3 weeks trying to get their incompetent software to work and just gone straight to phone calls. And at least in my case, the support agents seemed broadly unfamiliar, but seemed to have access to higher-priority internal case submission which did finally get to someone who could fix my issue.
sillysaurusx 5mo ago
They would be ignored. Having an audience is key to getting problems solved, whether it’s a lone hacker or a large corporation. Without an audience, you have no leverage. At that point you might as well create a new Windows account and re-apply, since that would have more luck than getting around a “we’ve closed your account and there’s no appeal process” barrier. If that sounds Kafkaesque, it is. It’s a small miracle that getting a post to the top of HN can surmount such bureaucracy at all. The best way to get an audience is to tell a compelling story. Make it interesting. There are ways of doing that for even the least known developers. My point is to push back against the idea that it should be fair to everyone and that what’s morally right should prevail in every case. The hardware developer program doesn’t exist to treat every developer fairly. They exist to make money for Microsoft. pg puts it more eloquently here: https://paulgraham.com/judgement.html https://paulgraham.com/judgement.html

maltris 5mo ago

LibreOffice, VeraCrypt, WireGuard. 2 questions: Whats next? Is that a pattern?

ChocolateGod 5mo ago
What has LibreOffice got to do with any of this?
- Terr_ 5mo ago
  Perhaps this from last year, though it doesn't directly involve code-signing: https://www.neowin.net/news/microsoft-bans-libreoffice-developers-account-without-warning-rejects-appeal/ https://www.neowin.net/news/microsoft-bans-libreoffice-devel...
- IvyMike 5mo ago
  Maybe this from 8 months ago? https://news.ycombinator.com/item?id=44728369 https://news.ycombinator.com/item?id=44728369
- quantum_magpie 5mo ago
  MS has a history of fucking up LibreOffice installs. https://wiki.documentfoundation.org/Faq/General/General_Installation_Issues_%28Windows%29 https://wiki.documentfoundation.org/Faq/General/General_Inst...
  - elAhmo 5mo ago
    I am sure this is by accident, MS would never try to discourage users from installing free alternatives to their offerings.
Lihh27 5mo ago
yeah three projects, one account lock, everyone's users stop getting updates. that's the pattern
direwolf20 5mo ago
And Windscribe

IshKebab 5mo ago

I don't think you can let them off that easily, given that the only effective support channel was "get to the front page of hacker news", which isn't usually an option.

volume_tech 5mo ago

[dead]

looneysquash 5mo ago

But what would have happened if they weren't able to get Microsoft's attention through an outside channel (this site) and had to go through the normal process? I'm glad it was resolved quickly for WireGuard, but I'm concerned the results won't generalize. Also, thanks for WireGuard!

aaronmdjones 5mo ago
> and had to go through the normal process? There is no normal process. The error message clearly states "There are no appeals available, we have closed your application". If the company makes it impossible for you to communicate with them, the only recourse is to draw public attention to it in order to shame them. This only works if you can gather enough public support and kick up enough of a stink about it. All of the small developers still locked out of their accounts are screwed.
- wpollock 5mo ago
  > If the company makes it impossible for you to communicate with them, the only recourse is to draw public attention to it in order to shame them. Legal action works too. You'd be surprised how effective a letter from an attorney can be.

Aurornis 5mo ago

There was a lot of speculation about this issue because readers assumed that WireGuard's was the only account that got locked. There was actually a wave of account locks that happened at the same time. If you only saw one of the headlines you might assume it was targeted or the result of some directed conspiracy, not the result of a widespread process. Microsoft did a (very!) bad job of communicating what was happening, but The Register has more information: > He explained that both deactivations were executed as part of the Windows Hardware Program's account verification procedures. > The company published a blog in October, giving devs a two-week warning that if their accounts had not been verified since April 2024, Microsoft would issue mandatory account verification notifications. > "We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri.

donmcronald 5mo ago
> "We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri. Emails are useless given the volume of trivial crap that MS emails about. Banners don't help for systems on auto-pilot. Reminders how? Break my workflow and let me un-break it when I notice.

shevy-java 5mo ago

What's going on at Microsoft? Why did they suddenly declare war on VPN and related software projects?

direwolf20 5mo ago
Wouldn't comply with CIA backdoor requirements, but now they do ;)

tamimio 5mo ago

> I don't think there's been any malice or conspiracy or anything weird Wink if there’s someone else in the room :)

redeeman 5mo ago

and imagine for those guys that dont have the reach wireguard/veracrypt does. NEVER trust microsoft, NEVER trust any mechanism people dont 100% control themselves. having to rely on microsoft to sign stuff is an abomination and something nobody should do

everdrive 5mo ago

An interesting point I don't think I've seen someone make -- people compare the LLM revolution to other technical revolutions. You don't need to worry about skill decay in the same way that you don't know how to bake bread from unprocessed wheat, or you don't know how to build a loom, etc. But local models aside (which no matter the protests from HN, will only be available to the technically savvy few) all of these LLMs are a service, so, the company could degrade the service, they could charge more than you're willing or able to pay, they could ban you. They could disable your account with no meaningful way appeal or seek support. LLMs could look at lot more like the scenario in this thread than something like not knowing how to make your own shoes.

kbelder 5mo ago
It might settle into a situation where cutting edge LLMs are a service, while older and smaller LLMs are self-hosted. So you are not at risk of being cut off, but of being degraded.
- donmcronald 5mo ago
  I hope you're right. I played around with a bunch of AI stuff recently and that's kind of the conclusion I came to. Use local AI for mission critical stuff, if you're confident in that, and use the SOTA models for reviewing. Tap the latest general knowledge for asking "could this be improved", but make the improvements with local systems and models. But then the obvious problem becomes finding new data to train the AIs. In my opinion, there's no way their plan doesn't involve stealing from everyone to keep training, so is it really going to be safe to use the cutting edge models at all?
donmcronald 5mo ago
If they manage to build good memory systems, people will stop keeping personal docs and rely on the “AI” for everything. Imagine 20 years from now when people don’t even have copies of the recipe to bake bread and then you’ll see what the goal is.
- 5mo ago

globular-toast 5mo ago

Why do people put so much effort into supporting a hostile platform? I really don't get it.

DarkUranium 5mo ago
Monopolies.

rajptech 5mo ago

[dead]

golem14 5mo ago

Since the impact of the account is presumably known to Microsoft (through telemetry etc), they probably know when these accounts get turned off, and can mark them in case the owner comes back and tries recovery. Microsoft would not have to automatically and 100% correctly reinstate the account. The goal would be to get high level cases like this one in front of a knowledgable human before the locked account posts angry owner posts complaints in public (If Joe Bloe's defragmentation utility noone has ever heard of and only having 10 installs goes bad, noone would care.) Here, they don't have to be perfect - you just need to have enough signal-to-voice ratio that employing a very small number of people outweighs the cost to PR and execs to deal with these cases, and to not let accounts get hacked through recovery. The response from Microsoft [1] is not great, or makes me hopeful. ``` Pavan Davuluri, Microsoft's President of Windows and Devices, said both Idrassi and Donenfeld should have their accounts restored "soon." "We've seen these reports and are actively working to resolve this as quickly as possible," Davuluri Xeeted. "We've reached out to VeraCrypt and have spoken to Jason at WireGuard, they should be back up and running soon." He explained that both deactivations were executed as part of the Windows Hardware Program's account verification procedures. The company published a blog in October, giving devs a two-week warning that if their accounts had not been verified since April 2024, Microsoft would issue mandatory account verification notifications. "We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri. "And we know that sometimes things still get missed. We're taking this as an opportunity to review how we communicate changes like this and make sure we're doing it better." ``` [1] https://www.theregister.com/2026/04/09/microsoft_dev_account_deactivations/ https://www.theregister.com/2026/04/09/microsoft_dev_account...

donmcronald 5mo ago
It could be dead simple. Lock the account, but let the owner temporarily unlock it for X days so they have enough time to undergo verification.
drewfax 5mo ago
> make sure partners understood this Since when they were partners to Micro$lop? First, it's thug like behavior taking the ability to run code on our own computers without their approval. Second it's even more evil justifying this behaviour by calling the developers "partners".

Ms-J 5mo ago

Could you give us an update on how everything was resolved? I believe the transparency would be a huge plus. This happened to Wireguard, Veracrypt, Windscribe, and possibly others. Certainly not isolated and very unnerving. There are still many unanswered questions...

incompatible 5mo ago

"The comments that followed were a bit off the rails. There's no conspiracy here from Microsoft. But the Internet discussion wound up catching the attention of Microsoft, and a day later, the account was unblocked, and all was well. I think this is just a case of bureaucratic processes getting a bit out of hand, which Microsoft was able to easily remedy. I don't think there's been any malice or conspiracy or anything weird." Hopefully, this isn't just something Microsoft made them say as part of an agreement to get their account back.

donmcronald 5mo ago
I would guess they realized they missed a notification or warning and feel a bit bad about the whole thing blowing up. Hopefully not though. The fact there were several high profile projects that got caught off guard puts the blame mostly on MS IMO. I think the reason these things go viral is that a ton of people reading about them can see themselves in the same situation, minus the clout needed to get it resolved. A short term PR crisis is the best we can get, so everyone piles on. I don't think MS will fix it though. IMO, they're more likely to create a program for open source code signing. That way they can capture all the high visibility projects, get a bunch of goodwill for being philanthropic, and all the small projects that don't qualify are too small to cause a fuss, so they can continue to treat them poorly.

Nevermark 5mo ago

Individual-level ethics and respect are being dispensed with en masse. The excuse being that these companies operate "at scale". But last time I checked, they are taking money from individuals. Or otherwise encouraging individuals to use their services. So this lack of respect for individuals by specific large companies, is predicated on their encouraging users to trust them, and depend on them, without taking on any of the implied responsibility to not capriciously ruin someone's day or year. And then hard or soft stone wall them. As someone who nearly lost everything due to the automated bureaucracy of a financial firm, I cannot stress: We are not safe. And we will not be safe until these companies are legally required to treat customer investment and dependency on their services, as valuable and necessarily recoverable, via prompt recourse and response, in cases where the automated bureaucratic systems fail. Otherwise, this is going to keep getting worse. When I hear how Microsoft helps someone who got attention, what I hear is that it takes extraordinary circumstances for Microsoft to care about the significant harm that there systems are causing many other people, today, who did not have the luck of this person. And that they are very very aware of this. I think we need to start using the word evil for this. Because it is. It is gross irresponsibility. Gross abuse of a power situation, of a strong dependency, that the company quite knowingly creates.

donmcronald 5mo ago
Software distribution is largely controlled by 3 companies; Microsoft, Google, and Apple. We used to have the web and web apps as an escape hatch, but, surprise, all 3 of those companies use a shared “safe” browsing blacklist that can be used to wipe your domain / website out of existence. Mozilla participates by using the same list which is a shame. Big tech shouldn’t be allowed to control the platforms and the ability to distribute / blacklist software and sites. That needs to be legislated against and those companies need to be broken into a thousand pieces each.
- Nevermark 5mo ago
  Agreed. The strong gatekeeping, the encouragement of vital dependency (i.e. treating user/customer data, email, content as if it were the company's, even to the point of cutting access without recourse), the dark pattern upsells, unpermissioned or dark permissioned surveillance, manipulation, the hosting of pervasive scam ads (even Apple News is full of scam ads), ... None of this should be acceptable. All these ethical violations degrade the lives of countless individuals in the name of "freedom" for corporations. Conflicts of interest and anticompetitiveness should not be "free" in either sense of the word.

swisniewski 5mo ago

How big is the Wire Guard user base on Windows? How often do they ship new versions? My understanding is that: 1. Windows drivers are Attested by Microsoft 2. Windows collects driver telemetry Which means a really good question to ask is: Why are they canceling driver signing accounts without looking at metrics?

emj 5mo ago
"it is only 0.01 promille of our customers" chopping off the long tail.

kuzivaai 5mo ago

The "minimum supported Windows version" ratchet is underrated as a maintenance strategy. I've watched codebases drown in compatibility shims that nobody remembers why they exist. Curious how much of the driver size reduction came from dropping pre-Win10 support versus the toolchain updates.

jiusanzhou 5mo ago

[dead]

ekjhgkejhgk 5mo ago

Could someone clarify, why do you need signing whatever to write software on Windows? Why can't you just write the software and run it? And when has this changed?

luckman212 5mo ago

Would be great to see a fresh macOS App Store release. The current one (3+ years old) has a few sharp edges.

microespana 5mo ago

[dead]

Xiaoher-C 5mo ago

The code-signing problem on Windows is fundamentally asymmetric. WireGuard survived because it was visible enough that losing signing became embarrassing for Microsoft. Most projects aren't. They just quietly stop working and nobody notices except the users. This situation got fixed because of an HN thread. That's a terrible way to maintain software infrastructure. You shouldn't need to go viral to keep your project running on a major OS. The underlying problem isn't going away unless there's either regulatory pressure or a credible community attestation model that bypasses the single-CA trust structure. Microsoft has no obvious incentive to build that themselves.