Re: Should we sunset Windows 7 support?

From: Andrew Fried <afried@spamteq.com>
To: wireguard@lists.zx2c4.com
Subject: Re: Should we sunset Windows 7 support?
Date: Tue, 10 Nov 2020 17:38:19 +0000	[thread overview]
Message-ID: <K17360-33.1605029899@spamhaus.org> (raw)
In-Reply-To: <CAHmME9rW1e+rRc8q+-_eLR=U9OTn+Sn84ECJtGFY=Hjg8kzfEQ@mail.gmail.com>

We recently began deploying clusters of recursive DNS "firewalls" that
use wireguard to secure and authenticate all traffic between the client
and servers.   What we quickly learned was that virtually the entire
customer base in India uses Windows 7 almost exclusively.

I can certainly understand the desire to streamline development and
focus on current versions of client operating systems, but by
deprecating support for Windows 7 you would be reducing the number of
potential Wireguard deployments by hundreds of millions of users,
particularly in Asian and underpopulated communities in Africa.  Most of
the end users there simply can't afford the cost of updating to the
latest version of Windows.  I personally wish this were not the case,
but it is what it is.

Andrew

On 11/10/20 7:27 AM, Jason A. Donenfeld wrote:
> Hi,
>
> Windows 7 has been EOL'd by Microsoft since January of this year. It
> is no longer receiving security updates or fixes. This email is to get
> the conversation started about doing the same with WireGuard for
> Windows.
>
> Supporting Windows 7 is an ongoing maintenance burden. For example, we
> use SHA2 signatures instead of SHA1 signatures for our drivers, which
> is not something we want to compromise on, and as a result Windows 7
> users must have KB2921916 installed. But Microsoft never supplied
> KB2921916 via Windows Update and it removed all Windows 7 hotfixes
> from its webpage last year. So in order to keep supporting this, we're
> forced to add clunky disgusting code like this:
> https://git.zx2c4.com/wireguard-windows/commit/?id=b63957dc830e39c94844d2f0d32ba29575991e44
> Keen readers will wince at all the layering violations there. Do we
> really want to keep maintaining gross stuff like this? It makes me
> uncomfortable to have kludges like that sitting around in the code.
> Shouldn't I write an auto-downloader that then checks hashes?
> Shouldn't I build this into the installer? Shouldn't I.... waste tons
> of time supporting Windows 7 better?
>
> Probably not.
>
> But I know so many users are still using Windows 7. I'd like to hear
> from you to understand why, in order to assess when is the right
> moment to sunset our Windows 7 support.
>
> So, if you care for Windows 7, please pipe up! We're not going to
> remove support for it overnight, and we're not prepared yet to
> announce any sort of formal deprecation plan, but the world is moving
> on at some point.
>
> Jason

-- 
Andrew Fried
afried@spamteq.com