notepad0x90 3 days ago

The NT paths are how the object manager refers to things. For example the registry hive HKEY_LOCAL_MACHINE is an alias for \Registry\Machine

https://learn.microsoft.com/en-us/windows-hardware/drivers/k...

In this way, NT is similar to Unix in that many things are just files part of one global VFS layout (the object manager name space).

Paths that start with drive letters are called a "DOSPath" because they only exist for DOS compatibility. But unfortunately, even in kernel mode, different sub systems might still refer to a DOSPath.

Powershell also exposes various things as "drives", pretty sure you could create your own custom drive as well for your custom app. For example, by default there is the 'hklm:\' drive path:

https://learn.microsoft.com/en-us/powershell/scripting/sampl...

Get-PSDrive/New-PSDrive

You can't access certificates in linux/bash as a file path for example, but you can in powershell/windows.

I highly recommend getting the NtObjectManager powershell module and exploring about:

https://github.com/googleprojectzero/sandbox-attacksurface-a...

ls NtObject:\

  • eloisant 3 days ago

    It's baffling than after 30 years, Windows is still stuck in a weird directory naming structure inherited from the 80's that no longer make sense when nobody has floppy drives.

    • Octoth0rpe 3 days ago

      > Windows is still stuck in a weird directory naming structure inherited from the 80's that no longer make sense when nobody has floppy drives.

      I think you could make this same statement about *nix, except it's 10 years _worse_ (1970s). I strongly prefer the fhs over whatever MS thinks it's doing, but let's not pretend that the fhs isn't a pile of cruft (/usr/bin vs /bin, /etc for config, /media vs /mnt, etc)

      • gerdesj 3 days ago

        Unix starts at root, which is how nature intended. It does not change characteristics based on media - you can mount a floppy at root if you want.

        Why get upset over /media vs /mnt? You do you, I know I do.

        For example The Step CA docs encourage using /etc/step-ca/ (https://smallstep.com/docs/step-ca/certificate-authority-ser...) for configuration for their product. Normally I would agree but as I am manually installing this thing myself and not following any of the usual docs, I've gone for /srv/step-ca.

        I think we get enough direction from the ... "standards" ... for Unix file system layouts that any reasonably incompetent admin can find out which one is being mildly abused today and get a job done. On Windows ... good luck. I've been a sysadmin for both platforms for roughly 30 years and Windows is even odder than Unix.

      • kazinator 3 days ago

        There is more pliability in the Linux ecosystem to change some of these things.

        And anyway, there has to be a naming scheme; the naming scheme is abstracted from the storage scheme.

        It's not the case that your /var and /usr are different drives; though it can be in a given installation.

      • sli 2 days ago

        All of those are optional restrictions, not mandatory. On Windows, it's (practically) mandatory.

        Maybe some Windows wizards could get around the mandatory restrictions, but an average Linux user can get around the optional ones.

      • akdev1l 2 days ago

        /usr/bin vs /bin distinction is not relevant as all major distros have gone usrmerge for years now so /bin == /usr/bin (usually /bin is a symlink)

    • notepad0x90 3 days ago

      I like being able to run games from early 2000s. Being able to write software that will still run longer after you're gone used to be a thing. But here we are with linux abandoning things like 'a.out'. Microsoft doesn't have the luxury to presume that it's users can recompile software, fork it, patch it,etc.. When your software doesn't work on the latest Windows, most people blame Microsoft not the software author.

      • Gud 3 days ago

        Ok, I prefer to use software which is future compatible, like ZFS, which is 128-bit.

        “The file system itself is 128 bit, allowing for 256 quadrillion zettabytes of storage. All metadata is allocated dynamically, so no need exists to preallocate inodes or otherwise limit the scalability of the file system when it is first created. All the algorithms have been written with scalability in mind. Directories can have up to 248 (256 trillion) entries, and no limit exists on the number of file systems or the number of files that can be contained within a file system.”

        https://docs.oracle.com/cd/E19253-01/819-5461/6n7ht6qth/inde...

        Don’t want to hit the quadrillion zettabyte limit..

      • amarant 3 days ago

        Wait are you saying Linux broke user-space? I've completely missed this and would like to know more, may I be so bold as to request a link?

      • simondotau 3 days ago

        I don’t like running games from the early 2000s outside of a sandbox of some description. If you disagree, it's because we don't have sandboxes which don't suck. Ideally, running old software in a sandbox on a modern OS should be borderline transparent — not like installing XP in a virtual machine.

        While I understand the appeal of software longevity, and I think it's a noble and worthy pursuit, I also think there is an under-appreciated benefit in having unmaintained software less likely to function on modern operating systems. Especially right now, where the concept of serious personal computer security for normal consumers is arguably less than two decades old.

    • exidy 3 days ago

      Inherited from the 80s? Microsoft effectively inherited drive letters via an 8086 semi-clone of CP/M called QDOS[0], it was the basis for PC-DOS and later MS-DOS. CP/M dates back to 1974.

      But Gary Kildall didn't come up with the idea of drive letters in CP/M all on his own, he was likely influenced by TOPS-10[1] and CP/CMS[2], both from the late 60s.

      [0] https://en.wikipedia.org/wiki/86-DOS

      [1] https://en.wikipedia.org/wiki/TOPS-10

      [2] https://en.wikipedia.org/wiki/CP/CMS

    • dragonwriter 2 days ago

      I don't particularly like the Windows naming structure, but it made just as much sense with later removable-media-with-fixed-drives systems (like optical drives) as it did with floppy drives. It maybe makes less sense now that storage is either fixed media or detachable drives, rather than some being removable media in fixed drives, but the period after commonn removable media is a lot shorter than the period after common floppy drives.

      (And mostly, I'm talking about using drive letters rather than something like what unix does. C being the first fixed media device, may seem more arbitrary now, but it was pretty arbitrary even in the floppy era.)

    • leptons 3 days ago

      Windows can still run software from the 80's, backwards compatibility has always been a selling point for Windows, so I'd call that a win.

      • AndrewDavis 3 days ago

        Didn't Microsoft drop 16 bit application support in Windows 10? I remember being saddened by my exe of Jezzball I've carried from machine to machine no longer working.

      • anonymous_sorry 3 days ago

        It's very impressive indeed.

        Linux goal is only for code compatibility - which makes complete sense given the libre/open source origins. If the culture is one where you expect to have access to the source code for the software you depend on, why should the OS developers make the compromises needed to ensure you can still run a binary compiled decades ago?

    • ForOldHack 3 days ago

      In the 80s, running DOS 3.1 on an IBM Network, I was networking dual floppy PCs, and with testing, got through drive '!' '@' '#' '^' So I was able to use 26 floppies, 24 of them non local... It was all removed with the next release, 3.2, so I would make some bets about NT Networking and its NetBIOS roots.

      I was inspired by the Dr Seuss, "On beyond Zebra."

    • naikrovek 3 days ago

      It’s not baffling at all. They strongly value maintaining backwards compatibility guarantees.

      For example, Windows 11 has no backwards compatibility guarantees for DOS but operating systems that they do have backwards compatibility guarantees for do.

      Enterprises need Microsoft to maintain these for as long as possible.

      It is AMAZING how much inertia software has that hardware doesn’t, given how difficult each are to create.

      • monocasa 2 days ago

        They've stopped caring as much about backwards compat.

        Windows 10 no longer plays the first Crysis without binary patches for instance.

      • wizzwizz4 3 days ago

        The 3.5mm audio jack is 75 years old, but electrically-compatible with a nearly 150-year-old standard.

    • kqr 3 days ago

      Wait 'til you hear about the PDP-11 emulator of a CPU it is running on.

    • BobbyTables2 3 days ago

      Yeah, try explaining “drive C:” to a kid these days, and why it isn’t A: or B: …

      Of course software developers are still stuck with 80 column conventions even though we have 16x9 4K displays now… Didn’t that come from punchcards ???

      • strogonoff 3 days ago

        Come for punchcards, stay for legibility.

        80 characters per line is an odd convention in the sense that it originated from a technical limitation, but is in fact a rule of thumb perfectly familiar to any typesetting professional from long before personal computing became widespread.

        Remember newspapers? Laying the text out in columns[0] is not a random quirk or result of yet another technology limitation. It is the same reason a good blog layout sets a conservative maximum width for when it is read on a landscape oriented screen.

        The reason is that when each line is shorter, the entire thing becomes easier to read. Indeed, even accounting for legibility hit caused by hyphenation.

        Up to a point, of course. That point may differ depending on the medium and the nature of the material: newspapers, given they deal with solid plain text and have other layout concerns, limit a line to around 50 characters; a book may go up to 80 characters. Given a program is not a relaxed fireside reading, I would place it closer to the former, but there are also factors and conventions that could bring acceptable line length up. For example, indentation and syntax highlighting, or typical identifier length (I’m looking at you, CNLabelContactRelationYoungerCousinMothersSiblingsDaughterOrFathersSistersDaughter), or editor capability to wrap lines nicely[1].

        Finally, since the actual technical limitation is gone, it is actually not such a big deal to violate the line length rule on occasion.

        [0] Relatedly, codebases roughly following the 80 character line length limitation unlock more interesting columnar layouts in editors and multiplexers.

        [1] Isn’t the auto-wrap capability in today’s editors good enough that restricting line length is pointless at the authoring stage? Not really, and (arguably) especially not in case of any language that relies on indentation. Not that it could not be good enough, but considering code becomes increasingly write-only it seems unlikely we will see editors with perfect, context-sensitive, auto-wrap any time soon.

      • Sharlin 3 days ago

        It did, but 80 columns also pretty closely matches the 50ish em/70ish character paragraph width that’s usually recommended for readability. I myself wouldn’t go much higher than 100 columns with code.

      • ahoef 3 days ago

        While 80 characters is obviously quite short, my experience is that longer line lengths result in much less readable code. You have to try to be concise on shorter lines, with better phrasing.

      • account42 2 days ago

        > Of course software developers are still stuck with 80 column conventions

        Speak for yourself, all my projects use at least 100 if not 120 column lines (soft limit only).

        Trying to keep lines at a readable length is still a valid goal though, even without the original technical limitations - although the bigger win there is to keep expression short, not to just wrap them into shorter lines.

      • tracker1 2 days ago

        If you don't have some level of arbitrary limit on line length, it becomes all that much easier to sneak in malicious code prefixed by a bunch of whitespace.

        Linting and autoformats help here... just allowing any length of line in code is just asking to get pwned at some point.

      • int_19h 2 days ago

        Try explaining /usr to a kid these days.

        "That obviously means Users, so that's where the home directories are, right?"

        "Well, no. And it actually means Unix System Resources"

        (but historically it was in fact "user", just not in that sense)

        I'm sure we'll eventually bacronym C: as well.

      • perching_aix 3 days ago

        It really wouldn't be much of a conversation. Historical conventions are a thing in general. Just think of the direction of electron flow.

        > even though we have 16x9 4K displays now

        Pretty much no normal person uses those at 100% scaling though, so unless you're thinking of the fellas who use a TV for a monitor, that doesn't actually help so much:

        - 100% scaling: 6 panels of 80 columns fit, no px go to waste

        - 125% scaling: 4 panels of 80 columns fit, 64 px go to waste (8 cols)

        - 150% scaling: 4 panels of 80 columns fit, no px go to waste

        - 175% scaling: 3 panels of 80 columns fit, 274 px go to waste (34 cols)

        - 200% scaling: 3 panels of 80 columns fit, no px go to waste

        This sounds good until you need any additional side panels. Think line numbers, scrollbars, breakpoint indicators, or worse: minimaps, and a directory browser. A minimap is usually 20 cols/panel, a directory browser is usually 40 cols. Scrollbar and bp-indicator together 2 cols/panel. Line numbers, probably safe to say, no more than 6 cols/panel.

        With 2 panels, this works out to an entire additional panel in overhead, so out of 3 panels only 2 remain usable. That's the fate of the 175% and 200% options. So what is the "appropriate" scaling to use?

        Well PPI-wise, if you're rocking a 32" model, then 150%. If a 27" model, then 175%. And of course, given a 22"-23"-24" unit, then 200%. People of course get sold on these for the "additional screen real estate" though, so they'll instead sacrifice seeing the entire screen at once and will put on their glasses. Maybe you prefer to drop down by 25% for each of these.

        All of this is to say, it's not all that unreasonable. I personally feel a bit more comfortable with a 100 col margin, but I do definitely appreciate when various files nicely keep to the 80 col mark, they're a lot nicer to work with side-by-side.

      • SomeUserName432 2 days ago

        You can make harddrives to A: and B: just fine.

        This will generally work with everything using the Win32 C api.

        You will however run into weird issues when using .Net, with sudden invalid paths etc.

      • UltraSane 2 days ago

        The fact that modern interactive command shells are based on virtual teletype terminals is just absurd when you think about it

      • mavhc 3 days ago

        Try explaining files to a kid these days

    • toolslive 2 days ago

      There's special place in hell for the inventor of drive names. IIRC, it's something that was nicked from CP/M.

    • zoeysmithe 2 days ago

      I mean its a successful commercial project because it doesnt break things, at least not that often. You can run some really old software on windows. Its kind of taken for granted, but this is just not the norm is most industries.

      As for baffling, I mean, I type in things like 'grep' everyday which is a goofy word. I'm not even going to go into all the legacy stuff linux presents and how linux, like windows, tries hard not to break userland software.

    • PunchyHamster 3 days ago

      I had game partition mounted as subpath on a drive and it just not worked well with some apps.

      Some apps (in this case Steam) don't run "what is is space in current path" (despise say GetDiskFreeSpaceExW accepting full path just fine), they cut it to the drive letter, which causes them to display space of the root drive, not the actual directory that they are using and in my case was mounted as different partition

    • fortran77 3 days ago

      It's baffling tha[t] after 59 years , Unix is still stuck in a weird directory naming structure inherited from the the late 60s that no longer make[s] sense when nobody has floppy drives.

      • cbm-vic-20 3 days ago

        Unix pre-dates floppy drives, at least on PDP-11.

        • monocasa 2 days ago

          Unix just barely predates the PDP-11 itself.

  • anthk 3 days ago

    ReactOS has a graphical NT OBJ browser (maybe as a CLSID) where you can just open an Explorer window and look up the whole registry hierarchy and a lot more.

    It works under Windows too.

    Proof:

    https://winclassic.net/thread/1852/reactos-registry-ntobject...

    • cachius 2 days ago

      Awesome!

        After [copying over .dll and importing .reg files], you will already be able to open these shell locations with the following commands:
        NT Object Namespace: explorer.exe shell:::{845b0fb2-66e0-416b-8f91-314e23f7c12d}
        System Registry: explorer.exe shell:::{1c6d6e08-2332-4a7b-a94d-6432db2b5ae6}
        If you want to add these folders in My Computer, just like in ReactOS, add these 2 CLSIDs to the following location:
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
      
      Seems ReactOS holds some goodies even for long time Windows users!
      • anthk 2 days ago

        Yep. NTVDM DLL too; it will run DOS binaries and some other stuff too. Also it has proper solitaires and such which you can just reuse by extracting the EXE files from the CAB file lying in the ReactOS live CD.

  • delusional 3 days ago

    > You can't access certificates in linux/bash as a file path for example, but you can in powershell/windows.

    I don't understand what you mean by this. I can access them "as a file" because they are in fact just files

        $ ls /etc/ca-certificates/extracted/cadir | tail -n 5
        UCA_Global_G2_Root.pem
        USERTrust_ECC_Certification_Authority.pem
        USERTrust_RSA_Certification_Authority.pem
        vTrus_ECC_Root_CA.pem
        vTrus_Root_CA.pem
    • notepad0x90 3 days ago

      You can access files that contain certificate information (on any OS), but you can't access individual certificates as their own object. In your output, you're listing files that may or may not contain valid certificate information.

      The difference is similar to being able to do 'ls /usr/bin/ls' vs 'ls /proc/12345/...' , the first is a literal file listing, the second is a way to access/manipulate the ls process (supposedly pid 12345). In windows, certificates are not just files but parsed/processed/validated usage specific objects. The same applies on Linux but it is up to openssl, gnutls,etc... to make sense of that information. If openssl/gnutls had a VFS mount for their view of the certificates on the system (and GPG!!) that would be similar to cert:\ in powershell.

    • jeroenhd 3 days ago

      Linux lacks a lot of APIs other operating systems have and certificate management is one of them.

      A Linux equivalent of listing certificates through the Windows virtual file system would be something like listing /proc/self/tls/certificates (which doesn't actually exist, of course, because Linux has decided that stuff like that is the user's problem to set up and not an OS API).

    • justsomehnguy 2 days ago

      Do note the 'ls' usage:

          PS Cert:\LocalMachine\Root\> ls
      
             PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\Root
      
          Thumbprint                                Subject              EnhancedKeyUsageList
          ----------                                -------              --------------------
          CDD4EEAE6000AC7F40C3802C171E30148030C072  CN=Microsoft Root C…
          BE36A4562FB2EE05DBB3D32323ADF445084ED656  CN=Thawte Timestamp…
          A43489159A520F0D93D032CCAF37E7FE20A8B419  CN=Microsoft Root A…
          92B46C76E13054E104F230517E6E504D43AB10B5  CN=Symantec Enterpr…
          8F43288AD272F3103B6FB1428485EA3014C0BCFE  CN=Microsoft Root C…
          7F88CD7223F3C813818C994614A89C99FA3B5247  CN=Microsoft Authen…
          245C97DF7514E7CF2DF8BE72AE957B9E04741E85  OU=Copyright (c) 19…
          18F7C1FCC3090203FD5BAA2F861A754976C8DD25  OU="NO LIABILITY AC…
          E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46  CN=UTN-USERFirst-Ob… {Code Signing, Time Stamping, Encrypting File System}
          DF717EAA4AD94EC9558499602D48DE5FBCF03A25  CN=IdenTrust Commer…
          DF3C24F9BFD666761B268073FE06D1CC8D4F82A4  CN=DigiCert Global …
      
      Now do the same without a convoluted hodge-podge of one-liner involving grep, python and cutting exact text pieces with regex.

      I always love how linux fans do like to talk without any experience nor the will to get the said experience.

      • cachius 2 days ago

        This is nice! What I find hard to grapple with is, how do other concepts of the file system map to these providers, even more so to Alias, Environment, Function or Variable? Like creating an item, deleting an item, copying an item, viewing contents and properties like permissions, size, visibility of an item?

        For the Certificate provider specifically: When I think certificates and hierarchy, I think signing hierarchy of issueing certs. But this is not what is exposed here, just the structure of the OS cert store without context. and moving items has much more implications that inside a normal data folder. Thus I prefer certlm/certmgr.msc as they provide some more of it.

        Sometimes It feels as they crammed too much into that idea, a forced concept. https://superuser.com/q/1065812/what-is-psprovider-in-powers...

    • kadoban 3 days ago

      I _suspect_ they mean that certs imported into MMC in Windows can be accessed at magic paths, but...yeah linux can do that because it skips the step of making a magical holding area for certs.

      • notepad0x90 3 days ago

        there are magical holding areas in Linux as well, but that detail is up to TLS libraries like openssl at run-time, and hidden away from their clients. There are a myriad of ways to manage just ca certs, gnutls may not use openssl's paths, and each distro has its own idea of where the certs go. The ideal unix-y way (that windows/powershell gets) would be to mount a virtual volume for certificates where users and client apps alike can view/manipulate certificate information. If you've tried to get a internal certs working with different Linux distros/deployments you might be familiar with the headache (but a minor one I'll admit).

        Not for certs specifically (that I know of) but Plan9 and it's derivaties are very hard on making everything VFS abstracted. Of course /proc , /sys and others are awesome, but there are still things that need their own FS view but are relegated to just 'files'. Like ~/.cache ~/.config and all the xdg standards. I get it, it's a standardized path and all, but what's being abstracted is here is not "data in a file" but "cache" and "configuration" (more specific), it should still be in a VFS path, but it shouldn't be a file that is exposed but an abstraction of "configuration settings" or "cache entries" backed by whatever thing you want (e.g.: redis, sqlite, s3,etc..). The windows registry (configuration manager is the real name btw) does a good job of abstracting configurations, but obviously you can't pick and choose the back-end implementation like you potentially could in Linux.

        • jeroenhd 3 days ago

          > The windows registry (configuration manager is the real name btw) does a good job of abstracting configurations, but obviously you can't pick and choose the back-end implementation like you potentially could in Linux.

          In theory, this is what dbus is doing, but through APIs rather than arbitrary path-key-value triplets. You can run your secret manager of choice and as long as it responds to the DBUS API calls correctly, the calling application doesn't know who's managing the secrets for you. Same goes for sound, display config, and the Bluetooth API, although some are "branded" so they're not quite interchangeable as they might change on a whim.

          Gnome's dconf system looks a lot like the Windows registry and thanks to the capability to add documentation directly to keys, it's also a lot easier to actually use if you're trying to configure a system.

    • Iwan-Zotow 3 days ago

      No, he meant access like virtual pseudo filesystem - /proc, /sys etc

  • viraptor 2 days ago

    > You can't access certificates in linux/bash as a file path for example

    Fuse and p9 exist... If anyone wants certs by id in the filesystem, it will exist.

  • PunchyHamster 3 days ago

    > You can't access certificates in linux/bash as a file path for example, but you can in powershell/windows.

    sure you can, /usr/share/ca-certificates tho you do need to run 'update-ca-certificates' (in debian derivatives) to update some files, like hashed symlinks in /etc/ssl/certs

    there is also of course /sys|/proc for system stuff, but yes, nowhere near as integrated as windows registry

noinsight 3 days ago

Windows is not limited to accessing partitions through drive letters either, it's just the existing convention.

You can mount partitions under directories just like you can in Linux/Unix.

PowerShell has Add-PartitionAccessPath for this:

> mkdir C:\Disk

> Add-PartitionAccessPath -DiskNumber 1 -PartitionNumber 2 -AccessPath "C:\Disk"

> ls C:\Disk

It will persist through reboots too.

  • jeroenhd 3 days ago

    I've used this a few times to put games on exchangeable media. Installers don't like it if you pick an SD card as an install target, but they don't care if C:\Games\Whatever is actually an NTFS mount point that goes unpopulated as soon as I disconnect the memory card. This trick has the downside of confusing installers that try to check free space, though.

    For permanently mounted drives, I'd pick symbolic links over mount points because this lets you do file system maintenance and such much easier on a per-drive level. You can still keep everything under C:\ and treat it like a weird / on Unix, but it you need to defragment your backup hard drive you won't need to beat the partition manager into submission to make the defragment button show up for your mounted path.

    • int_19h 2 days ago

      I use this to put Steam games on a RAM drive to speed up load time.

  • magicalhippo 3 days ago

    Don't have to use PowerShell either, it's been available for ages through Disk Management. Right-click on a partition -> Change Drive Letter and Path -> Add -> Mount in following empty NCTS folder.

  • EvanAnderson 3 days ago

    NTFS mount points can be very handy for engineering around software that doesn't allow you to customize paths. I can choose VM disks with different performance or replication policies and stitch them together like I would on a *nix OS. It's very handy and only in rare occasions have I had applications "notice" it and balk.

    • jasomill 3 days ago

      Symlinks also work on NTFS, though mount points have the advantage of not having a canonical path that might be unintentionally resolved and persisted.

  • zamadatix 3 days ago

    Only for NTFS (both source and dest) though, no exFAT shared drives under a folder mount or what have you. I think the same is actually true of ReFS for some reason.

    When you create/format the partition in the GUI tools it'll actually ask if you want to assign a drive letter or mount as a path as well.

    • chungy 3 days ago

      I just tried mounting a exFAT partition at "C:\exFAT" and it worked just fine.

      • Filligree 3 days ago

        Other way around. Try mounting E: in your exfat drive.

        • p_l 3 days ago

          That's because some filesystems like NTFS expose necessary metadata for integration and some don't. FAT and exFAT do not.

    • p_ing 3 days ago

      RAW partitions can be mounted at a mount point (or drive letter).

      Used to be able to use these with SQL Server.... 2000.

  • PunchyHamster 3 days ago

    Many programs (Steam did, last time I checked) will look up the parent disk's free space when you do that and might refuse to install if that space is too small (even if target dir have enough)

  • int_19h 2 days ago

    Indeed, and if you only have a single drive letter, that drive is always the active one, and so you can just write paths starting with the backslash: \Windows\System32 etc.

  • mschuster91 3 days ago

    What, excuse me, the fuck? I never knew one could do this. Thanks!

    • nolok 3 days ago

      It's even available in the regular UI, open "computer management" go to the disk section and many of the 'magic' things about drives in windows world are just UI toggles

    • korhojoa 3 days ago

      Back when Windows 2000 was the new thing, I used to put "Program Files" on another disk with this. Starting programs became faster too, as things loaded both from the OS drive and the drive where the programs were installed.

thrtythreeforty 3 days ago

The cursedness of "€:\" is awesome. It's amazing how much more flexible the NT kernel is vs what's exposed to the user.

  • jeffbee 3 days ago

    Yeah only the DOS façade of Windows NT is well known. Under that skin lurks some pretty wild late-1980s concepts. One of the core things to understand is that a lot of the features are based on a reverse map of GUIDs to various actions, and resolution of these map entries pervades the UI. That's why you can put {hexspew} as the name of a shortcut on the Windows desktop and have it magically become a deep link to some feature that Windows doesn't otherwise let you create a shortcut to, and also why you can just add things to the control panel which doesn't seem like it would be an intentional feature. And these actions can be named symbols inside DLLs, so they can do literally anything the OS is capable of doing. This is also why Windows has always been ground zero for malware.

    • sedatk 3 days ago

      Those GUIDs aren't related to NT kernel but Windows Explorer and its COM-based component system. They were introduced with Windows 95, IIRC.

    • pixl97 3 days ago

      >so they can do literally anything the OS is capable of doing

      Yea, over the years someone thought of something they wanted to do and then did it without a systematic consideration of what that level of power meant, especially as multi-user network connectivity and untrusted data became the norm.

      • p_ing 3 days ago

        Those weren't a consideration when the NT OS/2 Design Workbook was being written.

    • Wonkey 3 days ago

      That sounds fun. Do you have a link or and example “hexspew”

  • moffkalast 3 days ago

    It's not flexible enough until we can have a joy face emoji as the drive letter.

  • Dwedit 3 days ago

    Very cursed, and the drive letter won't even be accessible under certain codepages.

    • jeroenhd 3 days ago

      As far as I can tell, the drive will still be accessible, it'll just require the character equivalent to € on the other code page as a drive letter.

      As long as your code page doesn't have gaps, that should be doable. It'll definitely confuse the hell out of anyone who doesn't know about this setup, though!

      • Dwedit 3 days ago

        I don't think it works that way, the actual drive letter is a UTF-16 Unicode path. The application must be able to provide an "ANSI" string that encodes to that UTF-16 value if it uses an "ANSI" function to open the file. It's not like 8-bit systems where they just want the same 8-bit value.

RobotToaster 3 days ago

> Drives with a drive-letter other than A-Z do not appear in File Explorer, and cannot be navigated to in File Explorer.

Well there goes my plan to replace all my drive letters with emojis :(

  • mananaysiempre 3 days ago

    You would be limited to a fairly small subset of emojis, anyway: many (most?) of them are outside of the BMP so don’t fit into a single UTF-16 code unit, and some of the remaining ones are ordinary characters followed by an emoji style selector (U+FE0F), which doesn’t fit either.

  • BLKNSLVR 3 days ago

    Whenever I get onto a computer that someone left unlocked, the first thing I check is their eggplant- and peach-labelled drives.

  • jeroenhd 3 days ago

    With the right code pages, you should be able to find a few smiley faces.

    For everything else, the best advice I can offer is that you can put your own autorun config file on the root of a drive to point the drive icon to a different resource. Though the path will stay boring, the GUI will show emoji everywhere, especially if you also enter emoji in the drive label.

  • bikson 3 days ago

    But your computer name can be emoji.

the_mitsuhiko 3 days ago

> In other words, since RtlDosPathNameToNtPathName_U converts C:\foo to \??\C:\foo, then an object named C: will behave like a drive letter. To give an example of what I mean by that: in an alternate universe, RtlDosPathNameToNtPathName_U could convert the path FOO:\bar to \??\FOO:\bar and then FOO: could behave like a drive letter.

For some reason I remember that the original xbox 360 had "drive letters" which were entire strings. Unfortunately I no longer have access to the developer docs and now I wonder if my mind completely made this up. I think it was something like "Game:\foo" and "Hdd0:\foo".

vunderba 3 days ago

From the article:

> Drives with a drive-letter other than A-Z do not appear in File Explorer, and cannot be navigated to in File Explorer.

Reminds me of the old-school ALT + 255 trick on Win9x machines where adding this "illegal trailing character" made the directory inaccessible from the regular file explorer.

ddtaylor 3 days ago

For anyone curious there is a somewhat similar thing in Linux called Abstract Domain Sockets. These are Unix domain sockets where the first character is NUL ('\0')

I am working on a game where every player has system resources on a Linux computer. The basic idea is that some resources need to be shared or protected in some ways, such as files, but the core communication of the game client itself needs to be preserved without getting in the way of the real system environment.

I am using these abstract data sockets because they sidestep most other permissions in Linux. If you have the magic numbers to find the socket, you get access.

  • bandie91 3 days ago

    > If you have the magic numbers

    or find it in /proc/net/unix

    • ddtaylor 3 days ago

      Correct. Doing this allows you to implement your own method of checking credentials when a process wants to talk to that socket, such as SO_PEERCRED.

azalemeth 3 days ago

This all sounds like a wonderful way to write some truly annoying malware. I expect to see hidden mounts on SQL-escape-type-maliciously-named drives soon...

  • Someone1234 3 days ago

    I understand your point; but I'm struggling to see how this could be weaponized. Keep in mind, that these Dos compatible drive letters need to map to a real NT path endpoint (e.g. a drive/volume); so it isn't clear how the malware could both have a difficult to scan Dos tree while also not exposing that same area elsewhere for trivial scanning.

    • rwmj 3 days ago

      I'm betting there's some badly written AV software out there which will crash on non-standard drive letters, allowing at least a bit of mayhem.

    • avidiax 3 days ago

      Not sure if it is natively supported, but the malware can just decrypt a disk image to RAM and create a RAM disk mounted to +. Or it can maybe have a user space driver for a loop device, so the sectors of the drive are only decrypted on the fly.

      It would likely break a lot of analysis tools and just generally make things very difficult.

    • buzer 3 days ago

      The recovery partition might work if it exists.

  • hulitu 3 days ago

    > This all sounds like a wonderful way to write some truly annoying malware.

    AFAIK you need admin priviledges to play with drives in Windows.

  • ahoka 3 days ago

    Wait until your learn about Alternate Data Streams…

    • p_ing 3 days ago

      They had their use when running Services for Macintosh.

      • jeroenhd 3 days ago

        They're still actively used to apply the Mark of the Web to indicate a file has been downloaded from an untrusted zone and should be handled with caution. I believe macOS also applies similar metadata.

        There are a few other places where they also show up, but the MotW is the most prevalent one I've found. Most antivirus programs will warn you for unusual alternate data streams regardless of what they contain.

        • p_ing 3 days ago

          macOS uses extended attributes (can be manipulated with xattr).

          ADS was originally designed to support the HFS resource fork.

layer8 3 days ago

> drive letters are essentially just a convention borne out of the conversion of a Win32 path into a NT path

CMD also has the concept of a current drive, and of a per-drive current directory. (While “X:\” references the root directory of drive X, “X:” references whatever the current directory of drive X is. And the current directory, i.e. “.”, is the current directory of the current drive.) I wonder how those mesh with non-standard drive letters.

  • squeek502 3 days ago

    They work just fine, as the drive-specific CWD is stored in the environment as a normally-hidden =<drive-letter>: environment variable which has all the same WTF-16 and case-insensitive properties as drive letters:

        C:\> cd /D λ:\
    
        λ:\> cd bar
    
        λ:\bar> cd /D C:\
    
        C:\> echo %=Λ:%
        λ:\bar
    
        C:\> cd /D Λ:
    
        λ:\bar>
    • o11c 3 days ago

      Hm, what about using `%` itself?

      • squeek502 2 days ago

        That would only interact with the shell, as `%` is not actually part of the environment variable name, it's just a way to tell the shell you want it to get the value of an environment variable. The environment block itself is a NULL terminated list of NULL terminated WTF-16 strings of the format <key>=<value>, so `=` would be the more interesting thing to try.

        And indeed, it looks like using `=` as a drive letter breaks things in an interesting way:

            =:\> cd bar
            Not enough memory resources are available to process this command.
        
            =:\bar>
        
        `cd` exits with error code 1, but the directory change still goes through.

        With a program that dumps the NULL terminated <key>=<value> lines of the environment block, it looks like it does still modify the environment, but in an unexpected way:

        Before `cd /D =:\`, I had a line that looked like this (i.e. the per-drive CWD for C:\ was C:\foo):

            =C:=C:\foo
        
        After `cd /D =:\`, that was unexpectedly modified to:

            =C:==:\
        
        Funnily enough, that line means that the "working directory" of the C drive is `=:\`, and that actually is acted upon:

            =:\foo> cd /D C:
        
            =:\>
        
        ---

        You might also be interested to know that '= in the name of an environment variable' is a more general edge case that is handled inconsistently on more than just Windows: https://github.com/ziglang/zig/issues/23331

Tanoc 3 days ago

Anybody who's had to look through files on multi-disc arrays knows exactly how weird the drive letters can get. Mount the ISOs of thirty six 8.5GB DVDs because someone thought it was a good idea to split zip a single archive into 7.99GB segments and things get very tricky in cmd. If you weren't in the habit of using several layers of quotation marks to separate everything you'll form it very quickly because the operators can be the same symbols as the drive letters, as shown in the article with the "+" example.

kijin 3 days ago

I remember when A and B were commonly used drive letters. C was a luxury. D was outright bourgeois.

But for some reason, drive letters starting with C feel completely natural, too. Maybe it's because C is also the first note in the most widely known musical scale. We can totally afford to waste two drive letters at the start, right?

  • skissane 3 days ago

    > I remember when A and B were commonly used drive letters. C was a luxury. D was outright bourgeois.

    Our first home computer (1989 or 1990?) was a 386SX with a 40MB hard disk (so maybe we were bourgeois). My dad had to partition it into a 32MB C drive and an 8MB D drive, because the DOS version (3.3?) had a 32MB maximum filesystem size. It had two separate 5.25 inch floppy drives, a 1.2MB and a 360KB - although the 1.2MB drives could read 360KB disks, they couldn’t write them in a form readable by 360KB drives, or something like that. And later (circa 1991) we got a 3.5 inch floppy drive too, which became drive A, the 1.2MB became drive B, and the 360KB was relegated to drive E. The FDC that came with the computer (back then they were ISA cards, hadn’t been integrated with the motherboard yet) only supported two drives, so he had to buy a new one that supported four.

  • urbandw311er 3 days ago

    Oh bless you and your youngsterness. A and B, by convention, were reserved for floppy drives and C was typically the first hard drive.

    • keitmo 3 days ago

      On systems with a single floppy, drives A: and B: were two logical drives mapped to the same physical drive. This enabled you to (tediously) copy files from one diskette to another.

    • HPsquared 3 days ago

      Hard drives were a luxury.

      • prerok 3 days ago

        While original IBM PCs indeed may not have had HDDs, it did become a standard for PC XT, as early as 1983. Only the cheapest version were without a HDD by the end of the 1980s.

  • lepicz 2 days ago

    'We have D at home' :)

    c:\> subst d: c:

  • euroderf 3 days ago

    D was typically a CD-ROM drive. So when CD-ROMs went the way of the dinosaurs, where did D go ? Is it always some kind of SYS drive nowadays ?

    • tom_ 3 days ago

      It's just whatever happens to end up there? That's why D was typically the CD-ROM: A was the first floppy drive, B the (typically absent) second floppy drive, C the only hard disk, and then D was the next free letter.

      On my laptop, D is the SD card slot. On my desktop, it's the 2nd SSD.

      • xoxxala 3 days ago

        When recordable CDs were brand new, we set up a station at work with two hard drives (C: and D:) and the CD burner (E:). Naturally, the CDR burning software was hard-coded for D: but didn't mention that anywhere (including the error message). Took us a few hours to figure it out.

      • hilbert42 3 days ago

        "That's why D was typically the CD-ROM:"

        We used to set our machines so the CD-ROM was always drive L. This way we always had 'room' to add HDs so there was no gap in the alphabetical sequence. Drive D - data drive, E - swapfile, etc.

        Test and external drives (being temporary) were assigned letters further down than L. Sticking reasonably rigidly to this nomenclature avoided stuff-up such as cloning an empty drive onto one with data on it (cloning was a frequent activity).

        Incidentally, this rule applied to all machines, a laptop with HD would have C drive and L as the CD-ROM. Machines with multiple CD-ROMs would be assigned L, M and so on.

      • retroflexzy 3 days ago

        After C:, it really is just allocated in order.

        Between CD/DVD drives, writers, Zip Drives, and extra hard drives, it wasn't unusual for a workstation to naturally end up with G: or H:, before mapped network storage became common.

      • cesarb 3 days ago

        > A was the first floppy drive, B the (typically absent) second floppy drive

        As another commenter mentioned, when you didn't have a second floppy drive, A: and B: mapped to two floppy disks in the same floppy drive, with DOS pausing and asking you to insert the other floppy disk when necessary. Which explains why, even on single-floppy computers, the hard disk was at C: and not B: (and since so much software ended up expecting it, the convention continued even on computers without any floppy disk drive).

    • kijin 3 days ago

      D usually refers to the second internal storage device these days. Either a second SSD, a large HDD, or an extra partition in your system disk. If you don't have any of those, a USB stick might get the D drive temporarily.

    • rzzzt 3 days ago

      C: is the boot partition with the DoubleSpace driver, D: is the compressed volume.

    • tetha 3 days ago

      On servers, D is commonly used to push data / vendor installations / other stuff you may want to backup separate from the OS off of the main OS drive C.

    • Kwpolska 3 days ago

      Depends on your setup. These days, I have a D drive for sharing data with the Linux install I never use. I used to have a D drive for user data (to keep them safe when reinstalling Windows) back in the 9x/XP days (and my CD drive was E).

      I also use the drive letter assignment feature, so my external USB drive is always drive X.

mschuster91 2 days ago

> The \?? part of the \??\C:\foo path is actually a special virtual folder within the Object Manager that combines the \GLOBAL?? folder and a per-user DosDevices folder together.

Oh, so that is how terminal servers are able to mount different network shares (e.g. the user's home directory always being H:\) for each user's session on the same drive letter.

WarOnPrivacy 3 days ago

In my first DOS, the drive letter after Z was AA. I created a series of small RAM drives to find out.

That may have been DOS 3.3, not later. IDK when it changed.

  • pixl97 3 days ago

    I remember Netware had some kind of drive letter mapping that went way past z:

arcfour 3 days ago

Hmm. This seems like it could be abused rather hilariously (or not, depending on your perspective) by malware...

  • Loughla 3 days ago

    If the malware that exploits my machine also runs off the eggplant emoji drive, I'm becoming Amish.

    • PunchyHamster 3 days ago

      When you mount a partition on eggplant in Linux, nobody bats an eye

      When you do that on windows, everybody loses their mind.

layer8 3 days ago

> Non-ASCII drive letters are even case-insensitive like A-Z are

I wonder, does `subst I: .` create i: or ı: under the Turkish locale?

kazinator 3 days ago

In the Cygnal fork of the cygwin.dll, I hacked Cygwin's POSIX chdir() function, as well as the path resolution mechanism, to support the per-drive-letter name current directory concept.

A path like "f:myfile.txt" actually means f:\path\to\whatever\myfile.txt" where \path\to\whatever is the current working directory of the f drive.

This is one of the details which makes the replacement DLL more of a "native" run-time library, whose behavior is less surprising to Windows users of the applicaton based on it.

https://www.kylheku.com/cygnal/

account42 2 days ago

I wonder what characters are not allowed in driver letters. Is it the same set that is not allowed in file/directory names?

xori 3 days ago

The real question is can Windows defender scan these drives?

  • jasomill 3 days ago

    I don't know what it scans in the background by default, but it can custom scan mounted volumes with no visible mount points assigned at all, e.g., my EFI partition containing a copy of the EICAR test file[1]:

      PS C:\Users\jtm> & 'C:\Program Files\Windows Defender\MpCmdRun.exe' -Scan -ScanType 3 -File '\\?\Volume{91ada2dc-bb55-4d7d-aee5-df40f3cfa155}\'
      Scan starting...
      Scan finished.
      Scanning \\?\Volume{91ada2dc-bb55-4d7d-aee5-df40f3cfa155}\ found 1 threats.
      Cleaning started...
      Cleaning finished.
    
    [1] https://www.eicar.org/download-anti-malware-testfile/
robocat 3 days ago

Similar corner cases are the bedrock of security flaws.

If anyone adds this behaviour as a bet on a market about a future CVE or severity, can they add a link to the bet here?

nunobrito 3 days ago

This was a cool article. Learned something new today.

fexed 2 days ago

This is amazing and a security flaw waiting to be exploited

pdntspa 3 days ago

Seems like a great way to hide a bunch of files from users for a malware payload

OCTAGRAM 2 days ago

For maximum fun run Win+R eudcedit and

Draw your drive letter today!

ddtaylor 3 days ago

I never knew Λ was the upper case version of λ.

[removed] 3 days ago
[deleted]
rado 3 days ago

Windows drive letters are ridiculous. Use an external drive for e.g. video editing, its letter can be stolen by another drive, you can’t work anymore.

  • Arainach 3 days ago

    Not while it's mounted. This is akin to complaining that on Linux if you unplug a flash drive and plug in a different one that second drive could "steal" /mnt/sdb1 or whatever.

    • Filligree 3 days ago

      People did complain about that, which is why on Linux today that mount would use the disk UUID or label instead.

      So it’s fixed. What’s windows’ excuse? :-)

      • ChrisSD 3 days ago

        Windows also has uuids. E.g.:

            \\.\Volume{3558506b-6ae4-11eb-8698-806e6f6e6963}\
    • hulitu 3 days ago

      Linux is broken from this point of view. Inserting an USB drive before boot breaks booting .

      • lutusp 3 days ago

        > [ .. ] Inserting an USB drive before boot breaks booting.

        Only if the machine's BIOS is configured to give bootable USB devices boot-order priority. So it's not about Linux -- in fact, the same thing would happen on a Windows machine.

        Remember that in a properly configured Linux install, the boot partition is identified by UUID, not hardware identifier (in /etc/fstab). Consequently if you change a drive's hardware connection point, the system still boots.

      • oasisaimlessly 3 days ago

        Only if you have a broken kernel cmdline or fstab that references /dev/sd* instead of using the UUID=xyz or /dev/disk/by-id/xyz syntax.

      • Xiol 3 days ago

        Certainly doesn't for me. Skill issue.

        • dpark 3 days ago

          “Works on my machine” is rarely a helpful response. Doubling down with the “skill issue” insult makes it rude in addition to being unhelpful.

          Two other people were able to concisely explain the problem instead of being rude and condescending.

  • avhception 3 days ago

    I remember vividly when a user couldn't access his smb drive from Windows because both his printer and also the computer's case came with one of these multi-cardreaders with n slots and the drive letters collided. That's when I learned that smb drive letters don't even come from the "global" pool of drive letters, because, and this is obvious in hindsight, they are a per-user affair (credentials and all that).

    I think the concept of drive letters is flawed.

    • mrweasel 3 days ago

      Even Microsoft appears to agree with you, given that drive letters are symlinks. It's basically legacy, there's just no plan or reasonable path forward that will remove them.

    • bluGill 3 days ago

      Drive letters made sense in 1981 for personal computers. Of course a network run by IT isn't personal anymore - by definition.

    • p_ing 3 days ago

      I always tried to point people to DFS w/ the FQDN path. We added a shortcut to the user's desktop that pointed to their home folder on the DFS namespace.

  • TazeTSchnitzel 3 days ago

    You can fix the drive letter assignments at any time if they become a problem, or use a directory as a mount point if that's less troublesome. (Win-R, diskmgmt.msc)

  • Kwpolska 3 days ago

    If you go with the defaults, they might be. But if you manually define the letter for your external drive, it will keep it forever. (I have my external drive set to X. I’m not sure if Windows would respect that assignment if I had plugged in 19 other drives, but that is never going to happen.)

  • p_l 3 days ago

    Only if the actual "drive letter" assigned to the drive is the special value for "auto".

    Otherwise, the drive letter is allocated statically and won't be used by another volume.

  • leptons 3 days ago

    You can't work anymore only if you are incurious and unable to google a simple solution - assign a different drive letter with the disk management program.

perlgeek 3 days ago

Now somebody will uses this to hide their malware, somehow...

[removed] 3 days ago
[deleted]
lutusp 3 days ago

I hope this article gets archived in a computer history, so people in the future can read how today's default operating system persisted in requiring its vict..., umm, users, to honor an archaic practice long past any imaginable justification, while free alternative operating systems don't have this handicap.

I regularly have this conversation with my end-user neighbor -- I explain that he has once again written his backup archive onto his original because he plugged in his Windows USB drives in the wrong sequence. His reply is, more or less, "Are computers still that backward?" "No," I reply, "Windows is still that backward."

The good news is that Linux is more sophisticated. The bad news is that Linux users must be more sophisticated as well. But this won't always be true.

  • rwmj 3 days ago

    Are Linux /dev device paths (originating from Unix) really much better? They're a pretty odd feature if you think about it. "Everything is a file", except only certain things can be files and at least by convention they only appear under /dev. Plan 9 takes the everything is a file concept to its logical conclusion and is much better designed.

    Edit: Also /dev/sdX paths in Linux are not stable. They can and do vary across boot, since Linux 5.6.

    • lutusp 3 days ago

      > Are Linux /dev device paths (originating from Unix) really much better?

      Not better at all, which is why Linux uses partition UUIDs to identify specific storage partitions, regardless of hardware identifiers. This isn't automatic, the user must make it happen, which explains why Linux users need to know more than Windows users (and why Linux adoption is stalled).

      > Edit: Also /dev/sdX paths in Linux are not stable. They can and do vary across boot, since Linux 5.6.

      Yes, true, another reason to use partition UUIDs.

      > Plan 9 takes the everything is a file concept to its logical conclusion and is much better designed.

      It's a shame that Plan 9 didn't get traction -- too far ahead of its time I guess.

      • hakfoo 3 days ago

        I always saw it as two different mindsets for data storage.

        One vision is "medium-centric". You might want paths to always be consistently relative to a specific floppy disc regardless of what drive it's in, or a specific Seagate Barracuda no matter which SATA socket it was wired to.

        Conversely it might make more sense to think about things in a "slot-centric" manner. The left hand floppy is drive A no matter what's in it. The third SATA socket is /dev/sdc regardless of how many drives you connected and in what order.

        Either works as long as it's consistent. Every so often my secondary SSD swaps between /dev/nvme0 and /dev/nvme1 and it's annoying.

      • dist-epoch 3 days ago

        Windows drive letters are also linked to some partition UUIDs, which is why you can move a partition to a different drive, or move drive to a different address (change SATA/m.2 port)

        You can use mountvol command to see the mount-letter/GUID mapping.

  • stockresearcher 3 days ago

    This has (more or less) been covered before!

    https://news.ycombinator.com/item?id=17652502

    VMS expects to be run as a cluster of machines with a single drive system. How that actually happens is “hidden” from user view, and what you see are “logicals”, which can be stacked on top of each other and otherwise manipulated by a user/process without affecting the underlying file system. The results can be insane in the hands of inexperienced folks. But that is where NT came from.

    • lutusp 3 days ago

      All true, all good points. Some day partitions and their unique UUIDs will be the sole valid identifiers. Then end users will have to be warned not to copy entire partitions including their (no longer unique) UUID. Sounds bizarre but I've had that exact conversation.

  • int_19h 2 days ago

    Perhaps instead you could teach your neighbor how to assign drive letters to drives so that the same thing always ends up on the same letter. Because it can do that.

    OTOH on Linux out of the box they'd get /media/usb0, /media/usb1 etc. Which has the same exact problem. And the same exact solution - if you need stable names, mount them as such (except on Windows you can do it with a few clicks with a mouse).

    • lutusp a day ago

      > OTOH on Linux out of the box they'd get /media/usb0, /media/usb1 etc. Which has the same exact problem.

      Linux can exploit the UUIDs of USB drives to avoid confusion, and Linux users know how to do this. Windows has a way to do this also, but Windows users often don't know it.

      > ... (except on Windows you can do it with a few clicks with a mouse)

      Yes, clicks that are not in the average Windows user's skill set. This is more about technical knowledge than it is about a choice of OS, but overall, Linux rewards knowledge, while Windows punishes it.