>The comments that followed were a bit off the rails. There's no conspiracy here from Microsoft. But the Internet discussion wound up catching the attention of Microsoft, and a day later, the account was unblocked, and all was well. I think this is just a case of bureaucratic processes getting a bit out of hand, which Microsoft was able to easily remedy. I don't think there's been any malice or conspiracy or anything weird.
it was a bit crazy how quickly people got conspiracy-minded about it.
microsoft fucked up, and as per typical big-tech, only fixed it when noise got made on social media. but not everything is a grand conspiracy orchestrated by microsoft or the government or whatever. incompetence is always more likely than malice.
any news from the veracrypt maintainers? i would imagine whatever microsoft employee got tasked with resolving this issue would have also seen that one.
---
edit: well, i certainly underestimated the response to this comment. my mistake for using a common saying rather than being extremely explicit when it comes to something as emotionally charged as microsoft. i dont think i have seen a comment of mine go up and down points so many times before.
what i intended to get across was: "this was not a deliberate, coordinated, purposeful attack on the wireguard project, at the behest of some microsoft executive, to accomplish some goal of making encrypted communication impossible or whatever. instead, this was the result of a stupid system, with a stupid resolution process (social media), that is still awful, but different in important ways from a deliberate attack. this is the typical scenario (stupid system, stupid resolution). the non-typical scenario would be a deliberate choice made and executed by microsoft employees to suddenly destroy a popular project".
i shortened the above paragraph to the common saying "incompetence is always more likely than malice". i shouldnt have. my bad.
Microsoft has entitled itself to decide what I can and cannot run on the computer and OS that I paid for, this earns them no additional revenue, so they don't care to do a good job.
As I mentioned in the mailing list post, the Microsoft paperwork shuffling matter got dealt with rather quickly, following all the attention the HN thread from the other day got. And now we're finally out with an update!
NT programming is a lot of fun, though this release was quite challenging, because of all of the toolchain updates. On the plus side, we got to remove pre-Win10 support -- https://lists.zx2c4.com/pipermail/wireguard/2026-March/00954... . But did you know that Microsoft removed support for compiling x86 drivers in their latest driver SDK? So that was interesting to work around. There was also a fun change to the Go runtime included in this release: https://github.com/golang/go/commit/341b5e2c0261cc059b157f1c...
All and all, a fun release, and I'm happy to have the Windows release train cooking again.
Hey there, thank you for pushing this out. I saw there's a 0.6.1 update now, that also reboots the machine after updating. I don't remember if it said it'd do said reboot...
> following all the attention the HN thread from the other day got
That's great for you, and no offense, but what about developers who can't get buzz in a HN thread? Are they just doomed? Why is support only available to those who can raise a ruckus on social media?
The broader general problem is that it should not be necessary to attempt amplification of a message via HN or X or other platforms to get a company to have a real human pay attention to something, and write a hand crafted response.
This seems to increasingly be the norm with people who have had their accounts locked, deleted or restricted by automated systems. You have to hope that you can write a message and get it amplified via some sort of platform read by hundreds of thousands of people, and get people to reshare your message, in order to get any form of traction.
If you're not somebody well known, noteworthy or somehow significant in a community your likelihood of having your message successfully amplified is much lower.
As a wireguard user myself (even on the lone Windows machine that I still begrundingly have), I am happy that this problem could have been resolved. I am just wondering - if there had not been this kind of public outcry and outrage that Mr. Donenfeld discounts in his announcement message, would the issue have been fixed by now?
What are individual developers of "lesser" (less important, less visible, less used) software with a Windows presence to do? Wait and pray for Goliath to make the first benevolent move, like all the folks who got locked out forever from their Google accounts on a whim? Ha!
The fact of the matter is, the code signing requirements on Windows are a serious threat to Free and Open Source Software on the platform. Code signing requirements are a threat to FOSS on all platforms that support this technique, and infinitely more so where it's effectively mandatory. I firmly believe that these days, THIS is the preferred angle/vector for Microsoft to kill the software variety their C-levels once publicly bad-mouthed as "cancer", and zx2c4 is one of the poor frogs being slowly boiled alive. Just not this time - yet.
They would be ignored. Having an audience is key to getting problems solved, whether it’s a lone hacker or a large corporation. Without an audience, you have no leverage. At that point you might as well create a new Windows account and re-apply, since that would have more luck than getting around a “we’ve closed your account and there’s no appeal process” barrier.
If that sounds Kafkaesque, it is. It’s a small miracle that getting a post to the top of HN can surmount such bureaucracy at all.
The best way to get an audience is to tell a compelling story. Make it interesting. There are ways of doing that for even the least known developers.
My point is to push back against the idea that it should be fair to everyone and that what’s morally right should prevail in every case. The hardware developer program doesn’t exist to treat every developer fairly. They exist to make money for Microsoft. pg puts it more eloquently here: https://paulgraham.com/judgement.html
While this is a small problem for software (and hardware) that needs custom kernel drivers, or software that needs to run as administrator, you seem to have jumped a long way past that to rant about FOSS on Windows with no justification- general unsigned software works just fine on Windows as it always has.
I think Microsoft, Google, Apple, etc. are happy with the collateral damage caused by false positives and bad product decisions. And the way they implemented this was a bad product decision.
Think about it. If they "accidentally" destroy distribution for small projects that don't have the visibility to make waves, that's fewer possible startups that can eat their lunch. The cynic in me thinks that "at scale", "AI false positives", etc. are just an excuse for them to eliminate small developers.
They don't have to ban them all either. All they have to do is increase the risk to the point where rational people won't take the risk.
There were people that warned not to get into iOS development because it was impossible to guarantee distribution of an app. How do you build things like LoB apps under those circumstances? And who benefits when it's impossible to promise delivery of custom built apps? It favors big companies with the visibility to short circuit the system.
It's asymmetric rules; one set for big companies and another for small developers. I really hope the renewed interest in Linux takes off because it's the last chance we have at holding off big tech from taking over every little aspect of our lives.
I don't think you can let them off that easily, given that the only effective support channel was "get to the front page of hacker news", which isn't usually an option.
But what would have happened if they weren't able to get Microsoft's attention through an outside channel (this site) and had to go through the normal process?
I'm glad it was resolved quickly for WireGuard, but I'm concerned the results won't generalize.
There was a lot of speculation about this issue because readers assumed that WireGuard's was the only account that got locked. There was actually a wave of account locks that happened at the same time. If you only saw one of the headlines you might assume it was targeted or the result of some directed conspiracy, not the result of a widespread process.
Microsoft did a (very!) bad job of communicating what was happening, but The Register has more information:
> He explained that both deactivations were executed as part of the Windows Hardware Program's account verification procedures.
> The company published a blog in October, giving devs a two-week warning that if their accounts had not been verified since April 2024, Microsoft would issue mandatory account verification notifications.
> "We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri.
and imagine for those guys that dont have the reach wireguard/veracrypt does.
NEVER trust microsoft, NEVER trust any mechanism people dont 100% control themselves. having to rely on microsoft to sign stuff is an abomination and something nobody should do
An interesting point I don't think I've seen someone make -- people compare the LLM revolution to other technical revolutions. You don't need to worry about skill decay in the same way that you don't know how to bake bread from unprocessed wheat, or you don't know how to build a loom, etc.
But local models aside (which no matter the protests from HN, will only be available to the technically savvy few) all of these LLMs are a service, so, the company could degrade the service, they could charge more than you're willing or able to pay, they could ban you. They could disable your account with no meaningful way appeal or seek support. LLMs could look at lot more like the scenario in this thread than something like not knowing how to make your own shoes.
Since the impact of the account is presumably known to Microsoft (through telemetry etc), they probably know when these accounts get turned off, and can mark them in case the owner comes back and tries recovery.
Microsoft would not have to automatically and 100% correctly reinstate the account. The goal would be to get high level cases like this one in front of a knowledgable human before the locked account posts angry owner posts complaints in public (If Joe Bloe's defragmentation utility noone has ever heard of and only having 10 installs goes bad, noone would care.)
Here, they don't have to be perfect - you just need to have enough signal-to-voice ratio that employing a very small number of people outweighs the cost to PR and execs to deal with these cases, and to not let accounts get hacked through recovery.
The response from Microsoft [1] is not great, or makes me hopeful.
```
Pavan Davuluri, Microsoft's President of Windows and Devices, said both Idrassi and Donenfeld should have their accounts restored "soon."
"We've seen these reports and are actively working to resolve this as quickly as possible," Davuluri Xeeted. "We've reached out to VeraCrypt and have spoken to Jason at WireGuard, they should be back up and running soon."
He explained that both deactivations were executed as part of the Windows Hardware Program's account verification procedures.
The company published a blog in October, giving devs a two-week warning that if their accounts had not been verified since April 2024, Microsoft would issue mandatory account verification notifications.
"We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri.
"And we know that sometimes things still get missed. We're taking this as an opportunity to review how we communicate changes like this and make sure we're doing it better."
The reality is that unless and until the PR hit from failures like this impact their stock price or their bottom line, companies won't care to fix the processes that created them.
"The comments that followed were a bit off the rails. There's no conspiracy here from Microsoft. But the Internet discussion wound up catching the attention of Microsoft, and a day later, the account was unblocked, and all was well. I think this is just a case of bureaucratic processes getting a bit out of hand, which Microsoft was able to easily remedy. I don't think there's been any malice or conspiracy or anything weird."
Hopefully, this isn't just something Microsoft made them say as part of an agreement to get their account back.
Individual-level ethics and respect are being dispensed with en masse. The excuse being that these companies operate "at scale".
But last time I checked, they are taking money from individuals. Or otherwise encouraging individuals to use their services.
So this lack of respect for individuals by specific large companies, is predicated on their encouraging users to trust them, and depend on them, without taking on any of the implied responsibility to not capriciously ruin someone's day or year. And then hard or soft stone wall them.
As someone who nearly lost everything due to the automated bureaucracy of a financial firm, I cannot stress: We are not safe. And we will not be safe until these companies are legally required to treat customer investment and dependency on their services, as valuable and necessarily recoverable, via prompt recourse and response, in cases where the automated bureaucratic systems fail.
Otherwise, this is going to keep getting worse.
When I hear how Microsoft helps someone who got attention, what I hear is that it takes extraordinary circumstances for Microsoft to care about the significant harm that there systems are causing many other people, today, who did not have the luck of this person.
And that they are very very aware of this.
I think we need to start using the word evil for this. Because it is. It is gross irresponsibility. Gross abuse of a power situation, of a strong dependency, that the company quite knowingly creates.
The "minimum supported Windows version" ratchet is underrated as a maintenance strategy. I've watched codebases drown in compatibility shims that nobody remembers why they exist. Curious how much of the driver size reduction came from dropping pre-Win10 support versus the toolchain updates.
Could someone clarify, why do you need signing whatever to write software on Windows? Why can't you just write the software and run it? And when has this changed?
47 comments
[ 3.0 ms ] story [ 57.5 ms ] threadit was a bit crazy how quickly people got conspiracy-minded about it.
microsoft fucked up, and as per typical big-tech, only fixed it when noise got made on social media. but not everything is a grand conspiracy orchestrated by microsoft or the government or whatever. incompetence is always more likely than malice.
any news from the veracrypt maintainers? i would imagine whatever microsoft employee got tasked with resolving this issue would have also seen that one.
---
edit: well, i certainly underestimated the response to this comment. my mistake for using a common saying rather than being extremely explicit when it comes to something as emotionally charged as microsoft. i dont think i have seen a comment of mine go up and down points so many times before.
what i intended to get across was: "this was not a deliberate, coordinated, purposeful attack on the wireguard project, at the behest of some microsoft executive, to accomplish some goal of making encrypted communication impossible or whatever. instead, this was the result of a stupid system, with a stupid resolution process (social media), that is still awful, but different in important ways from a deliberate attack. this is the typical scenario (stupid system, stupid resolution). the non-typical scenario would be a deliberate choice made and executed by microsoft employees to suddenly destroy a popular project".
i shortened the above paragraph to the common saying "incompetence is always more likely than malice". i shouldnt have. my bad.
That's just the side effect of the Soross tracking chips hidden in vaccines activated by 5g towers
Microsoft has entitled itself to decide what I can and cannot run on the computer and OS that I paid for, this earns them no additional revenue, so they don't care to do a good job.
This system will never work properly.
NT programming is a lot of fun, though this release was quite challenging, because of all of the toolchain updates. On the plus side, we got to remove pre-Win10 support -- https://lists.zx2c4.com/pipermail/wireguard/2026-March/00954... . But did you know that Microsoft removed support for compiling x86 drivers in their latest driver SDK? So that was interesting to work around. There was also a fun change to the Go runtime included in this release: https://github.com/golang/go/commit/341b5e2c0261cc059b157f1c...
All and all, a fun release, and I'm happy to have the Windows release train cooking again.
Just curious how/if the version support might work out for ReactOS.
That's great for you, and no offense, but what about developers who can't get buzz in a HN thread? Are they just doomed? Why is support only available to those who can raise a ruckus on social media?
This seems to increasingly be the norm with people who have had their accounts locked, deleted or restricted by automated systems. You have to hope that you can write a message and get it amplified via some sort of platform read by hundreds of thousands of people, and get people to reshare your message, in order to get any form of traction.
If you're not somebody well known, noteworthy or somehow significant in a community your likelihood of having your message successfully amplified is much lower.
By the way, was it only for the Windows application, or was wireguard-go was also affected?
What are individual developers of "lesser" (less important, less visible, less used) software with a Windows presence to do? Wait and pray for Goliath to make the first benevolent move, like all the folks who got locked out forever from their Google accounts on a whim? Ha!
The fact of the matter is, the code signing requirements on Windows are a serious threat to Free and Open Source Software on the platform. Code signing requirements are a threat to FOSS on all platforms that support this technique, and infinitely more so where it's effectively mandatory. I firmly believe that these days, THIS is the preferred angle/vector for Microsoft to kill the software variety their C-levels once publicly bad-mouthed as "cancer", and zx2c4 is one of the poor frogs being slowly boiled alive. Just not this time - yet.
If that sounds Kafkaesque, it is. It’s a small miracle that getting a post to the top of HN can surmount such bureaucracy at all.
The best way to get an audience is to tell a compelling story. Make it interesting. There are ways of doing that for even the least known developers.
My point is to push back against the idea that it should be fair to everyone and that what’s morally right should prevail in every case. The hardware developer program doesn’t exist to treat every developer fairly. They exist to make money for Microsoft. pg puts it more eloquently here: https://paulgraham.com/judgement.html
Whats next?
Is that a pattern?
https://sourceforge.net/p/veracrypt/discussion/general/threa...
I think Microsoft, Google, Apple, etc. are happy with the collateral damage caused by false positives and bad product decisions. And the way they implemented this was a bad product decision.
Think about it. If they "accidentally" destroy distribution for small projects that don't have the visibility to make waves, that's fewer possible startups that can eat their lunch. The cynic in me thinks that "at scale", "AI false positives", etc. are just an excuse for them to eliminate small developers.
They don't have to ban them all either. All they have to do is increase the risk to the point where rational people won't take the risk.
There were people that warned not to get into iOS development because it was impossible to guarantee distribution of an app. How do you build things like LoB apps under those circumstances? And who benefits when it's impossible to promise delivery of custom built apps? It favors big companies with the visibility to short circuit the system.
It's asymmetric rules; one set for big companies and another for small developers. I really hope the renewed interest in Linux takes off because it's the last chance we have at holding off big tech from taking over every little aspect of our lives.
I'm glad it was resolved quickly for WireGuard, but I'm concerned the results won't generalize.
Also, thanks for WireGuard!
Microsoft did a (very!) bad job of communicating what was happening, but The Register has more information:
> He explained that both deactivations were executed as part of the Windows Hardware Program's account verification procedures.
> The company published a blog in October, giving devs a two-week warning that if their accounts had not been verified since April 2024, Microsoft would issue mandatory account verification notifications.
> "We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri.
Wink if there’s someone else in the room :)
NEVER trust microsoft, NEVER trust any mechanism people dont 100% control themselves. having to rely on microsoft to sign stuff is an abomination and something nobody should do
But local models aside (which no matter the protests from HN, will only be available to the technically savvy few) all of these LLMs are a service, so, the company could degrade the service, they could charge more than you're willing or able to pay, they could ban you. They could disable your account with no meaningful way appeal or seek support. LLMs could look at lot more like the scenario in this thread than something like not knowing how to make your own shoes.
Microsoft would not have to automatically and 100% correctly reinstate the account. The goal would be to get high level cases like this one in front of a knowledgable human before the locked account posts angry owner posts complaints in public (If Joe Bloe's defragmentation utility noone has ever heard of and only having 10 installs goes bad, noone would care.)
Here, they don't have to be perfect - you just need to have enough signal-to-voice ratio that employing a very small number of people outweighs the cost to PR and execs to deal with these cases, and to not let accounts get hacked through recovery.
The response from Microsoft [1] is not great, or makes me hopeful.
``` Pavan Davuluri, Microsoft's President of Windows and Devices, said both Idrassi and Donenfeld should have their accounts restored "soon."
"We've seen these reports and are actively working to resolve this as quickly as possible," Davuluri Xeeted. "We've reached out to VeraCrypt and have spoken to Jason at WireGuard, they should be back up and running soon."
He explained that both deactivations were executed as part of the Windows Hardware Program's account verification procedures.
The company published a blog in October, giving devs a two-week warning that if their accounts had not been verified since April 2024, Microsoft would issue mandatory account verification notifications.
"We worked hard to make sure partners understood this was coming, from emails, banners, reminders," said Davuluri.
"And we know that sometimes things still get missed. We're taking this as an opportunity to review how we communicate changes like this and make sure we're doing it better."
```
[1] https://www.theregister.com/2026/04/09/microsoft_dev_account...
I believe the transparency would be a huge plus.
This happened to Wireguard, Veracrypt, Windscribe, and possibly others. Certainly not isolated and very unnerving.
There are still many unanswered questions...
Hopefully, this isn't just something Microsoft made them say as part of an agreement to get their account back.
But last time I checked, they are taking money from individuals. Or otherwise encouraging individuals to use their services.
So this lack of respect for individuals by specific large companies, is predicated on their encouraging users to trust them, and depend on them, without taking on any of the implied responsibility to not capriciously ruin someone's day or year. And then hard or soft stone wall them.
As someone who nearly lost everything due to the automated bureaucracy of a financial firm, I cannot stress: We are not safe. And we will not be safe until these companies are legally required to treat customer investment and dependency on their services, as valuable and necessarily recoverable, via prompt recourse and response, in cases where the automated bureaucratic systems fail.
Otherwise, this is going to keep getting worse.
When I hear how Microsoft helps someone who got attention, what I hear is that it takes extraordinary circumstances for Microsoft to care about the significant harm that there systems are causing many other people, today, who did not have the luck of this person.
And that they are very very aware of this.
I think we need to start using the word evil for this. Because it is. It is gross irresponsibility. Gross abuse of a power situation, of a strong dependency, that the company quite knowingly creates.
How often do they ship new versions?
My understanding is that:
1. Windows drivers are Attested by Microsoft
2. Windows collects driver telemetry
Which means a really good question to ask is:
Why are they canceling driver signing accounts without looking at metrics?