Why is it easier to use Schiit driver package for DC-1

[jinjuku]

This is the second system I've built, brand new Win 10 64bit Enterprise install and Emotiva's driver package failed but
Schiit's just flew through the install.

[yeahwicked]

This should help:

emotiva.com/resources/Emotiva_C-Media_Drivers_Win10_v101a.pdf

Disabling Driver Signature Enforcement
IMPORTANT: There is a security feature called “driver signature enforcement” that is enabled
by default on many 64 bit versions of Windows 10 (but not usually on 32 bit versions); this
feature prevents drivers from being installed unless they contain a signature hash that is
recognized by Windows. If this feature is enabled on your computer, the drivers will not
install properly, and you will get an ambiguous error message. There is no simple way to
determine if DSE is enabled on your computer; you may either simply disable it (which will
cause no harm if it’s already disabled), or you may wait and see if you get an error message
after attempting the installation.
IF YOU RECEIVE AN ERROR MESSAGE AFTER INSTALLING THE DRIVERS STATING THAT
“WINDOWS WAS UNABLE TO INSTALL DRIVERS” AND THAT “NO CHANGES WERE MADE”,
THEN THE DRIVERS WERE PROBABLY NOT INSTALLED BECAUSE DRIVER SIGNATURE
ENFORCEMENT (DSE) IS ENABLED.
IF YOU RECEIVE THIS ERROR MESSAGE, THEN YOU MUST DISABLE DSE AND REINSTALL
THE DRIVERS FOR YOUR DEVICE TO WORK.
Emotiva C-Media USB Drivers Win10: v1.01a

PREFERRED METHOD OF DISABLING DRIVER SIGNATURE ENFORCEMENT
NOTE: One step in this procedure will require you to press a key on your keyboard. If you
have a laptop or netbook computer, simply use the attached keyboard and, if you have a
“convertible” computer, attach your keyboard before starting the procedure. If you have a
“pure tablet”, then you will be required to temporarily connect a USB keyboard.
(Most WiFi and Bluetooth keyboards won’t work for this.)

1. Click on the Windows “start button” icon (or press the Windows button).
2. Click on Settings.
3. Click on Update and Security.
4. Click on Recovery.
5. Under Advanced Startup, click on Restart Now.
6. Your computer will reboot, and return to a screen that says Choose an Option.
7. Under Choose an Option, click on Troubleshoot.
8. Under Troubleshoot, click on Advanced Options.
9. Under Advanced Options, click on Startup Settings.
10. Under Startup Settings, click Restart.
11. Your computer will reboot, and return to a screen that says Startup Settings.
12. Press the “7” or “F7” key to select Diable Driver Signature Enforcement.
13. Your computer will reboot again, and DSE will be disabled.

NOTE: Once your computer reboots you will be able to install the drivers with no problems,
and they will remain installed and continue to work after you reboot your computer.
(The current Windows literature disagrees on whether DSE will remain entirely disabled after
the next reboot, or whether it will be re-enabled, but will allow the unsigned drivers to remain
installed and in use. Therefore, if you have to reinstall the drivers, you might wish to repeat
the procedure before doing so.)

[jinjuku]

Why isn't their driver package signed?

I'm not going to disable driver signing on any of my computers. Signing has been around since the days of XP. 2003. This should be standard best practice by now.

I have much love for Emotiva but this shouldn't be the case here. Driver signing, and now by extension, code signing is a way to protect the system from malicious driver/code execution.

[Loop 7]

Feb 5, 2017 0:02:26 GMT -5 jinjuku said:

Why isn't their driver package signed?

I'm not going to disable driver signing on any of my computers. Signing has been around since the days of XP. 2003. This should be standard best practice by now.

I have much love for Emotiva but this shouldn't be the case here. Driver signing, and now by extension, code signing is a way to protect the system from malicious driver/code execution.

I had the same question. There's also been some issues with antivirus software blocking the driver downloads. Schiit does seem to have optimized their driver installation.

[garbulky]

Feb 5, 2017 0:02:26 GMT -5 jinjuku said:

Why isn't their driver package signed?

I'm not going to disable driver signing on any of my computers. Signing has been around since the days of XP. 2003. This should be standard best practice by now.

I have much love for Emotiva but this shouldn't be the case here. Driver signing, and now by extension, code signing is a way to protect the system from malicious driver/code execution.

Just disable it man. Then re-enable it. Now you'll have a perfectly fine driver written by Emotiva working on your DC-1.
And yes, it makes sense that being a professional company, they should just have gone through the extra step. But they didn't. So you either do it or you don't. Your computer won't be harmed either way.

[Casey Leedom]

The Emotiva code should be properly signed. This is 2017 with hackers galore. Recommending that someone just disable a security feature even briefly isn't appropriate or professional. This should be fixed.

Casey

[qdtjni]

Mentioning Windows and best security practices in the same context is a contradiction in terms...
Just stop using that crappy OS, Windows that is, and the problem is gone. 

[macromicroman]

I think the reason that Emotiva and others don't sign the software is that they have to pay to get this done. If they did this then they would have to charge for their software or higher prices for their products. This would start another thread complaining about the prices.

[jinjuku]

Feb 5, 2017 6:47:21 GMT -5 qdtjni said:

Mentioning Windows and best security practices in the same context is a contradiction in terms...
Just stop using that crappy OS, Windows that is, and the problem is gone. 

Windows is secure as any other OS as long as best practices are maintained. Be careful about trotting out Linux, cause boy do I have stories from the 70 servers we manage that run CentOS. We run 30 Windows 2012R2 servers also and we manage to keep both locked down as best as possible excluding 0 day.

1. Restricted user accounts (non-admin)
2. Keep AV and Anti-malware up to date
3. Perimeter firewall and machine firewall
4. Used managed DNS
5. Filtered email
6. Practice some common sense.

[qdtjni]

Feb 5, 2017 12:42:43 GMT -5 jinjuku said:

Feb 5, 2017 6:47:21 GMT -5 qdtjni said:

Mentioning Windows and best security practices in the same context is a contradiction in terms...
Just stop using that crappy OS, Windows that is, and the problem is gone. 

Windows is secure as any other OS as long as best practices are maintained. Be careful about trotting out Linux, cause boy do I have stories from the 70 servers we manage that run CentOS. We run 30 Windows 2012R2 servers also and we manage to keep both locked down as best as possible excluding 0 day.

1. Restricted user accounts (non-admin)
2. Keep AV and Anti-malware up to date
3. Perimeter firewall and machine firewall
4. Used managed DNS
5. Filtered email
6. Practice some common sense.

Does it make sense to polish a turd?

[jinjuku]

Feb 5, 2017 10:08:04 GMT -5 macromicroman said:

I think the reason that Emotiva and others don't sign the software is that they have to pay to get this done. If they did this then they would have to charge for their software or higher prices for their products. This would start another thread complaining about the prices.

You sign it with a certificate from a trusted authority: Comodo, Verisign, DigiCert. There is a submission process to MS. It's not cost prohibitive nor even exorbitant. Less than $200 / year.

[Casey Leedom]

(woof) I did a quick search for Windows Security Signing Fees and I ran into this "Practical 'How To' Guide" ... so much harder than Apple ...

Casey

[jinjuku]

Feb 5, 2017 12:46:40 GMT -5 qdtjni said:

Feb 5, 2017 12:42:43 GMT -5 jinjuku said:

Windows is secure as any other OS as long as best practices are maintained. Be careful about trotting out Linux, cause boy do I have stories from the 70 servers we manage that run CentOS. We run 30 Windows 2012R2 servers also and we manage to keep both locked down as best as possible excluding 0 day.

1. Restricted user accounts (non-admin)
2. Keep AV and Anti-malware up to date
3. Perimeter firewall and machine firewall
4. Used managed DNS
5. Filtered email
6. Practice some common sense.

Does it make sense to polish a turd?

You mean the same best practices that are applicable to Linux:

Restricted user accounts, managed the DNS, filtered Email, AV/AM aren't polishing a turd? Thanks to that turd CPanel we've had compromised Linux boxes. MORE SO than our 2012R2 boxes. Think about that for a second.

[jinjuku]

Feb 4, 2017 23:12:54 GMT -5 yeahwicked said:

This should help:

That's ABSURD to have to go through. Emotiva needs to simply go through the signing process and re-release that package installer. Again, I like Emotiva but you have to admit that the easiest way to get their own product working is to use their competitors install package.

It it what it is.

[qdtjni]

Feb 5, 2017 12:49:41 GMT -5 jinjuku said:

Feb 5, 2017 12:46:40 GMT -5 qdtjni said:

Does it make sense to polish a turd?

You mean the same best practices that are applicable to Linux:

Restricted user accounts, managed the DNS, filtered Email, AV/AM aren't polishing a turd? Thanks to that turd CPanel we've had compromised Linux boxes. MORE SO than our 2012R2 boxes. Think about that for a second.

No I mean that Windows is fundamentally broken in so many ways including the security model.
Onviously, you need to have best practices in place despite that if you have to use Windows and you need them for other OSes as well.

[jinjuku]

Feb 5, 2017 12:54:08 GMT -5 qdtjni said:

Feb 5, 2017 12:49:41 GMT -5 jinjuku said:

You mean the same best practices that are applicable to Linux:

Restricted user accounts, managed the DNS, filtered Email, AV/AM aren't polishing a turd? Thanks to that turd CPanel we've had compromised Linux boxes. MORE SO than our 2012R2 boxes. Think about that for a second.

No I mean that Windows is fundamentally broken in so many ways including the security model.
Onviously, you need to have best practices in place despite that if you have to use Windows and you need them for other OSes as well.

Not to get off topic, but this is a good point:

In what way, if I let you access a system over RDP, that I took and applied best practices to it would you be able to compromise the entire system as it applies to dedicated audio playback?

[qdtjni]

Feb 5, 2017 12:56:53 GMT -5 jinjuku said:

Feb 5, 2017 12:54:08 GMT -5 qdtjni said:

No I mean that Windows is fundamentally broken in so many ways including the security model.
Onviously, you need to have best practices in place despite that if you have to use Windows and you need them for other OSes as well.

Not to get off topic, but this is a good point:

In what way, if I let you access a system over RDP, that I took and applied best practices to it would you be able to compromise the entire system as it applies to dedicated audio playback?

You are the one whinging about the unsigned driver, so what is the risk that your music PC get's compromised during the time you disable the requirement for signed drivers?

[Casey Leedom]

The problem with unsigned files is that it removes a layer of protection. Frankly, I hate anything but the Walled Garden model myself. I want all of my software to come through a portal where things are monitored and retracted if necessary. It's one of the things which irritates me about Apple: they have a great model for software distribution on iOS but they haven't extended that to Mac OS. Just the other day I had to cancel an HDTracks.com order because they stupidly insisted on me installing their own Download Manager instead of simply using the one already present in the Browser. And don't get me started with Adobe Flash and its endless "phishing" for system access to update itself 30 times a day.

Casey

[qdtjni]

The real problem here is that Microsoft has been unwilling to adapt to UAC2, hence calling for driver installation in the first place.
That is not Emotiva's fault, is it?

[KeithL]

Driver signing serves a purpose IF YOU GET DRIVERS FROM UNKNOWN SOURCES.
The layer of security that Driver Signing provides is in terms of allowing you to verify that the drivers weren't tampered with before you got them.
It protects the drivers en-route between their original source and you.
It does NOT ensure that the original source is trustworthy, and it does not ensure that your computer is trustworthy.
Since you can only get our drivers from us, and NOT from any potentially untrusted third party, then this is meaningless.
(Signed drivers can still be defective, or even infected with malware, if it happened before they were signed.)

I personally can't stand Walled Gardens.... the view is always so very limited, and the fees tend to be too high.
However, in this case, as someone else already pointed out, if only Microsoft included support in Windows for the now quite standard UAC2 audio class, this would all be moot.
(Individual UAC2 drivers only need to be installed separately because Windows lacks them internally.)

Feb 5, 2017 13:58:09 GMT -5 Casey Leedom said:

The problem with unsigned files is that it removes a layer of protection. Frankly, I hate anything but the Walled Garden model myself. I want all of my software to come through a portal where things are monitored and retracted if necessary. It's one of the things which irritates me about Apple: they have a great model for software distribution on iOS but they haven't extended that to Mac OS. Just the other day I had to cancel an HDTracks.com order because they stupidly insisted on me installing their own Download Manager instead of simply using the one already present in the Browser. And don't get me started with Adobe Flash and its endless "phishing" for system access to update itself 30 times a day.

Casey