WireGuard makes new Windows release following Microsoft signing resolution
lists.zx2c4.com274 points by zx2c4 5 hours ago
274 points by zx2c4 5 hours ago
As I mentioned in the mailing list post, the Microsoft paperwork shuffling matter got dealt with rather quickly, following all the attention the HN thread from the other day got. And now we're finally out with an update!
NT programming is a lot of fun, though this release was quite challenging, because of all of the toolchain updates. On the plus side, we got to remove pre-Win10 support -- https://lists.zx2c4.com/pipermail/wireguard/2026-March/00954... . But did you know that Microsoft removed support for compiling x86 drivers in their latest driver SDK? So that was interesting to work around. There was also a fun change to the Go runtime included in this release: https://github.com/golang/go/commit/341b5e2c0261cc059b157f1c...
All and all, a fun release, and I'm happy to have the Windows release train cooking again.
Good to know everything was resolved, but did you ever find out why your signing account was suspended? That's not something you brush off as haha silly Microsoft..
Microsoft are saying it's because those accounts didn't undergo verification for the Windows Hardware Program
https://www.theregister.com/2026/04/09/microsoft_dev_account...
They should definitely put up a statement addressing it. Moreover what they plan in the future to avoid such traumatic event, this is not a “simple sign program”, this touches fundamental parts of the OS.
Apparently it's quite widespread, so I would assume a bug on their side. That's what support seemed to imply at least. We're still blocked at my company for one month+ now.
"so I would assume a bug on their side"
Why a "bug".
For something like this, I would generalize a "bug" to encompass both software and human processes. Some decision-maker saw some metrics consistent with spam and enacted a spam-blocking measure. Any decision like this is going to lead to false positives. Maybe they decided "I don't need to confer with anyone", or maybe they did and got the green light even after multiple eyeballs looked at it. I'm not saying that this does any good for Microsoft's already-sullied trust, but mistakes happen and combating spam is a constantly evolving arms race. There's no way any organization is going to get it 100% of the time even after decades of dealing with it.
I doubt someone manually went and flagged all the accounts as invalid suddenly or whatever and that was their goal. By a bug I mean some kind of automated action that did not produce the expected outcome.
Also because, at least on our side, the account was in an inconsistent state: we were correctly enrolled/validated, but could not access the signing interface.
I really appreciate what you wrote in that post re: dropping support for pre-Windows 10 operating systems.
Somewhat on the side - but is there a wireguard that works well for ReactOS? Does the windows version just work fine?
Just curious how/if the version support might work out for ReactOS.
Good question! I've never tried. The NT driver makes use of some of the more advanced features of the networking stack, so possibly not. But you never know. I'd love a Wg4React.
ReactOS was, at one time, targeting a Windows Server 2003-level of compatibility. With that in mind I can't imagine current Wireguard would have even a shred of hope of working on ReactOS.
Hey there, thank you for pushing this out. I saw there's a 0.6.1 update now, that also reboots the machine after updating. I don't remember if it said it'd do said reboot...
As a wireguard user myself (even on the lone Windows machine that I still begrundingly have), I am happy that this problem could have been resolved. I am just wondering - if there had not been this kind of public outcry and outrage that Mr. Donenfeld discounts in his announcement message, would the issue have been fixed by now?
What are individual developers of "lesser" (less important, less visible, less used) software with a Windows presence to do? Wait and pray for Goliath to make the first benevolent move, like all the folks who got locked out forever from their Google accounts on a whim? Ha!
The fact of the matter is, the code signing requirements on Windows are a serious threat to Free and Open Source Software on the platform. Code signing requirements are a threat to FOSS on all platforms that support this technique, and infinitely more so where it's effectively mandatory. I firmly believe that these days, THIS is the preferred angle/vector for Microsoft to kill the software variety their C-levels once publicly bad-mouthed as "cancer", and zx2c4 is one of the poor frogs being slowly boiled alive. Just not this time - yet.
They would be ignored. Having an audience is key to getting problems solved, whether it’s a lone hacker or a large corporation. Without an audience, you have no leverage. At that point you might as well create a new Windows account and re-apply, since that would have more luck than getting around a “we’ve closed your account and there’s no appeal process” barrier.
If that sounds Kafkaesque, it is. It’s a small miracle that getting a post to the top of HN can surmount such bureaucracy at all.
The best way to get an audience is to tell a compelling story. Make it interesting. There are ways of doing that for even the least known developers.
My point is to push back against the idea that it should be fair to everyone and that what’s morally right should prevail in every case. The hardware developer program doesn’t exist to treat every developer fairly. They exist to make money for Microsoft. pg puts it more eloquently here: https://paulgraham.com/judgement.html
While this is a small problem for software (and hardware) that needs custom kernel drivers, or software that needs to run as administrator, you seem to have jumped a long way past that to rant about FOSS on Windows with no justification- general unsigned software works just fine on Windows as it always has.
I got a modestly-similar situation resolved by buying a support package and spending 4+ hours across ... not sure, but probably 4-5 support calls? It's been 5 years. If memory serves it was the $200/mo support package for Azure.
In retrospect, I should have not spent 3 weeks trying to get their incompetent software to work and just gone straight to phone calls. And at least in my case, the support agents seemed broadly unfamiliar, but seemed to have access to higher-priority internal case submission which did finally get to someone who could fix my issue.
An interesting point I don't think I've seen someone make -- people compare the LLM revolution to other technical revolutions. You don't need to worry about skill decay in the same way that you don't know how to bake bread from unprocessed wheat, or you don't know how to build a loom, etc.
But local models aside (which no matter the protests from HN, will only be available to the technically savvy few) all of these LLMs are a service, so, the company could degrade the service, they could charge more than you're willing or able to pay, they could ban you. They could disable your account with no meaningful way appeal or seek support. LLMs could look at lot more like the scenario in this thread than something like not knowing how to make your own shoes.
It might settle into a situation where cutting edge LLMs are a service, while older and smaller LLMs are self-hosted. So you are not at risk of being cut off, but of being degraded.
But what would have happened if they weren't able to get Microsoft's attention through an outside channel (this site) and had to go through the normal process?
I'm glad it was resolved quickly for WireGuard, but I'm concerned the results won't generalize.
Also, thanks for WireGuard!
LibreOffice, VeraCrypt, WireGuard. 2 questions:
Whats next?
Is that a pattern?
yeah three projects, one account lock, everyone's users stop getting updates. that's the pattern
What has LibreOffice got to do with any of this?
MS has a history of fucking up LibreOffice installs.
https://wiki.documentfoundation.org/Faq/General/General_Inst...
I am sure this is by accident, MS would never try to discourage users from installing free alternatives to their offerings.
Perhaps this from last year, though it doesn't directly involve code-signing: https://www.neowin.net/news/microsoft-bans-libreoffice-devel...
Happy to see it resolved and I hope the other developers are able to have the same experience.
By the way, was it only for the Windows application, or was wireguard-go was also affected?
This was just for WireGuardNT, the kernel driver for the NT kernel that Windows uses.
This project -- https://git.zx2c4.com/wireguard-nt/about/ -- is used by this app -- https://git.zx2c4.com/wireguard-windows/about/ . The former is what the signing situation was about. The latter is just signed using a normal boring (but very expensive!) EV code signing certificate from one of the CAs.
>The comments that followed were a bit off the rails. There's no conspiracy here from Microsoft. But the Internet discussion wound up catching the attention of Microsoft, and a day later, the account was unblocked, and all was well. I think this is just a case of bureaucratic processes getting a bit out of hand, which Microsoft was able to easily remedy. I don't think there's been any malice or conspiracy or anything weird.
it was a bit crazy how quickly people got conspiracy-minded about it.
microsoft fucked up, and as per typical big-tech, only fixed it when noise got made on social media. but not everything is a grand conspiracy orchestrated by microsoft or the government or whatever. incompetence is always more likely than malice.
any news from the veracrypt maintainers? i would imagine whatever microsoft employee got tasked with resolving this issue would have also seen that one.
---
edit: well, i certainly underestimated the response to this comment. my mistake for using a common saying rather than being extremely explicit when it comes to something as emotionally charged as microsoft. i dont think i have seen a comment of mine go up and down points so many times before.
what i intended to get across was: "this was not a deliberate, coordinated, purposeful attack on the wireguard project, at the behest of some microsoft executive, to accomplish some goal of making encrypted communication impossible or whatever. instead, this was the result of a stupid system, with a stupid resolution process (social media), that is still awful, but different in important ways from a deliberate attack. this is the typical scenario (stupid system, stupid resolution). the non-typical scenario would be a deliberate choice made and executed by microsoft employees to suddenly destroy a popular project".
i shortened the above paragraph to the common saying "incompetence is always more likely than malice". i shouldnt have. my bad.
> incompetence is always more likely than malice.
"Incompetence" of this degree is malice. It is actively malicious to create a system that automatically locks people out of their accounts with absolutely no possibility for human review or recourse short of getting traction in the media. "No sir, I didn't grind those orphans up. It was this orphan grinding machine I made that did it, teehee!"
i am positive that you understand the spirit of what that saying means.
incompetence is always more likely than [intentional, directed] malice.
microsoft employees did not deliberately attack the wireguard project with a goal of taking it down for whatever grand scheme people's hatred cooks up. if you have evidence that microsoft did this deliberately to ruin the wireguard project, please forward it along to jason (the wireguard maintainer) and several news outlets.
Where possible I recommend not caring because figuring out whether malice was present is difficult and you can likely address a problem without needing to be sure.
For example by creating working processes which never end up "accidentally" causing awful outcomes. This is sometimes more expensive, but we should ensure that the resulting lack of goodwill if you don't is unaffordable.
Worst case there is malice and you've now made it more difficult to hide the malice so you've at least made things easier for those who remain committed to looking for malice, including criminal prosecutors.
>Worst case there is malice and you've now made it more difficult to hide the malice so you've at least made things easier for those who remain committed to looking for malice, including criminal prosecutors.
i am quoting the maintainer of the project. take it up with them if you think microsoft coordinated a directed attack on their project.
I think you're missing the point of the person you're replying to.
It's really easy to end up with procedural machinery that makes it unpleasant for other entities that you don't like.
It seems to get the things that you do like and value less often. Why? Because you think about the consequences to what you consider important and you're inclined to ignore potential consequences to those you oppose or are competing with.
The Vogons weren't necessarily overtly malicious when they obliterated Earth.
"hostage speaks well of hostage-taker"
if you think i am defending microsoft, your hatred has blinded you to what my comments are actually saying.
Why would I think that? That isn't a sensible conclusion from what I posted. I think you replied to the wrong post
Regardless of what the maintainer says of their abuser after being abused, the point I think you are getting stuck on is this:
Creating a system which locks you out if you don't speak to a human isn't de-facto malicious.
Having support where you can't speak to a human isn't de-facto malicious, either.
Doing both at the same time, however, is de-facto malicious. Some executives likely got bonuses for doing it, too.
you said "hostage speaks well of hostage-taker" in response to my comment.
i interpreted that as you saying i am the hostage of microsoft, and have stockholm syndrome, therefor am speaking well of (defending) microsoft.
if i misinterpreted that, my bad. are you calling jason the hostage?