Back

Windows drive letters are not limited to A-Z

407 points19 hoursryanliptak.com
notepad0x9016 hours ago

The NT paths are how the object manager refers to things. For example the registry hive HKEY_LOCAL_MACHINE is an alias for \Registry\Machine

https://learn.microsoft.com/en-us/windows-hardware/drivers/k...

In this way, NT is similar to Unix in that many things are just files part of one global VFS layout (the object manager name space).

Paths that start with drive letters are called a "DOSPath" because they only exist for DOS compatibility. But unfortunately, even in kernel mode, different sub systems might still refer to a DOSPath.

Powershell also exposes various things as "drives", pretty sure you could create your own custom drive as well for your custom app. For example, by default there is the 'hklm:\' drive path:

https://learn.microsoft.com/en-us/powershell/scripting/sampl...

Get-PSDrive/New-PSDrive

You can't access certificates in linux/bash as a file path for example, but you can in powershell/windows.

I highly recommend getting the NtObjectManager powershell module and exploring about:

https://github.com/googleprojectzero/sandbox-attacksurface-a...

ls NtObject:\

eloisant13 hours ago

It's baffling than after 30 years, Windows is still stuck in a weird directory naming structure inherited from the 80's that no longer make sense when nobody has floppy drives.

Octoth0rpe9 hours ago

> Windows is still stuck in a weird directory naming structure inherited from the 80's that no longer make sense when nobody has floppy drives.

I think you could make this same statement about *nix, except it's 10 years _worse_ (1970s). I strongly prefer the fhs over whatever MS thinks it's doing, but let's not pretend that the fhs isn't a pile of cruft (/usr/bin vs /bin, /etc for config, /media vs /mnt, etc)

kazinator6 hours ago

There is more pliability in the Linux ecosystem to change some of these things.

And anyway, there has to be a naming scheme; the naming scheme is abstracted from the storage scheme.

It's not the case that your /var and /usr are different drives; though it can be in a given installation.

akdev1l4 hours ago

/usr/bin vs /bin distinction is not relevant as all major distros have gone usrmerge for years now so /bin == /usr/bin (usually /bin is a symlink)

gerdesj8 hours ago

Unix starts at root, which is how nature intended. It does not change characteristics based on media - you can mount a floppy at root if you want.

Why get upset over /media vs /mnt? You do you, I know I do.

For example The Step CA docs encourage using /etc/step-ca/ (https://smallstep.com/docs/step-ca/certificate-authority-ser...) for configuration for their product. Normally I would agree but as I am manually installing this thing myself and not following any of the usual docs, I've gone for /srv/step-ca.

I think we get enough direction from the ... "standards" ... for Unix file system layouts that any reasonably incompetent admin can find out which one is being mildly abused today and get a job done. On Windows ... good luck. I've been a sysadmin for both platforms for roughly 30 years and Windows is even odder than Unix.

+3
Wowfunhappy8 hours ago
exidy7 hours ago

Inherited from the 80s? Microsoft effectively inherited drive letters via an 8086 semi-clone of CP/M called QDOS[0], it was the basis for PC-DOS and later MS-DOS. CP/M dates back to 1974.

But Gary Kildall didn't come up with the idea of drive letters in CP/M all on his own, he was likely influenced by TOPS-10[1] and CP/CMS[2], both from the late 60s.

[0] https://en.wikipedia.org/wiki/86-DOS

[1] https://en.wikipedia.org/wiki/TOPS-10

[2] https://en.wikipedia.org/wiki/CP/CMS

notepad0x9013 hours ago

I like being able to run games from early 2000s. Being able to write software that will still run longer after you're gone used to be a thing. But here we are with linux abandoning things like 'a.out'. Microsoft doesn't have the luxury to presume that it's users can recompile software, fork it, patch it,etc.. When your software doesn't work on the latest Windows, most people blame Microsoft not the software author.

Gud11 hours ago

Ok, I prefer to use software which is future compatible, like ZFS, which is 128-bit.

“The file system itself is 128 bit, allowing for 256 quadrillion zettabytes of storage. All metadata is allocated dynamically, so no need exists to preallocate inodes or otherwise limit the scalability of the file system when it is first created. All the algorithms have been written with scalability in mind. Directories can have up to 248 (256 trillion) entries, and no limit exists on the number of file systems or the number of files that can be contained within a file system.”

https://docs.oracle.com/cd/E19253-01/819-5461/6n7ht6qth/inde...

Don’t want to hit the quadrillion zettabyte limit..

bhaney10 hours ago

> Directories can have up to 248 (256 trillion) entries

It took me a minute to figure out that this was supposed to be 2^48, but even then that's ~281 trillion. What a weird time for the tera/tibi binary prefix confusion to show up, when there aren't even any units being used.

amarant10 hours ago

Wait are you saying Linux broke user-space? I've completely missed this and would like to know more, may I be so bold as to request a link?

+1
cesarb9 hours ago
+1
PunchyHamster9 hours ago
simondotau11 hours ago

I don’t like running games from the early 2000s outside of a sandbox of some description. If you disagree, it's because we don't have sandboxes which don't suck. Ideally, running old software in a sandbox on a modern OS should be borderline transparent — not like installing XP in a virtual machine.

While I understand the appeal of software longevity, and I think it's a noble and worthy pursuit, I also think there is an under-appreciated benefit in having unmaintained software less likely to function on modern operating systems. Especially right now, where the concept of serious personal computer security for normal consumers is arguably less than two decades old.

leptons13 hours ago

Windows can still run software from the 80's, backwards compatibility has always been a selling point for Windows, so I'd call that a win.

AndrewDavis12 hours ago

Didn't Microsoft drop 16 bit application support in Windows 10? I remember being saddened by my exe of Jezzball I've carried from machine to machine no longer working.

+1
mkup12 hours ago
+1
notepad0x9011 hours ago
anonymous_sorry11 hours ago

It's very impressive indeed.

Linux goal is only for code compatibility - which makes complete sense given the libre/open source origins. If the culture is one where you expect to have access to the source code for the software you depend on, why should the OS developers make the compromises needed to ensure you can still run a binary compiled decades ago?

chasing0entropy13 hours ago

My original VB6 apps (mostly) still run on win11

+2
mananaysiempre13 hours ago
BobbyTables212 hours ago

Yeah, try explaining “drive C:” to a kid these days, and why it isn’t A: or B: …

Of course software developers are still stuck with 80 column conventions even though we have 16x9 4K displays now… Didn’t that come from punchcards ???

strogonoff11 hours ago

Come for punchcards, stay for legibility.

80 characters per line is an odd convention in the sense that it originated from a technical limitation, but is in fact a rule of thumb perfectly familiar to any typesetting professional from long before personal computing became widespread.

Remember newspapers? Laying the text out in columns[0] is not a random quirk or result of yet another technology limitation. It is the same reason a good blog layout sets a conservative maximum width for when it is read on a landscape oriented screen.

The reason is that when each line is shorter, the entire thing becomes easier to read. Indeed, even accounting for legibility hit caused by hyphenation.

Up to a point, of course. That point may differ depending on the medium and the nature of the material: newspapers, given they deal with solid plain text and have other layout concerns, limit a line to around 50 characters; a book may go up to 80 characters. Given a program is not a relaxed fireside reading, I would place it closer to the former, but there are also factors and conventions that could bring acceptable line length up. For example, indentation and syntax highlighting, or typical identifier length (I’m looking at you, CNLabelContactRelationYoungerCousinMothersSiblingsDaughterOrFathersSistersDaughter), or editor capability to wrap lines nicely[1].

Finally, since the actual technical limitation is gone, it is actually not such a big deal to violate the line length rule on occasion.

[0] Relatedly, codebases roughly following the 80 character line length limitation unlock more interesting columnar layouts in editors and multiplexers.

[1] Isn’t the auto-wrap capability in today’s editors good enough that restricting line length is pointless at the authoring stage? Not really, and (arguably) especially not in case of any language that relies on indentation. Not that it could not be good enough, but considering code becomes increasingly write-only it seems unlikely we will see editors with perfect, context-sensitive, auto-wrap any time soon.

+1
PaulDavisThe1st10 hours ago
Xss310 hours ago

80 chars per line was invented when languages used shortened commands though. Nowadays 120 is more appropriate. Especially in Powershell. Not so much in bash where commands are short, 80 can stay alive there!

naikrovek9 hours ago

I’m very sure this is a myth. Like any good myth, it makes sense on the surface but holds zero water once you look close.

Code isn’t prose. Code doesn’t always go to the line length limit then wrap, and prose doesn’t need a new line after every sentence. (Don’t nitpick this; you know what I’m saying)

The rules about how code and prose are formatted are different, so how the human brain finds the readability of each is necessarily different.

No code readability studies specifically looking for optimal line length have been done, to my knowledge. It may turn out to be the same as prose, but I doubt it. I think it will be different depending on the language and the size of the keywords in the language and the size of the given codebase. Longer keywords and method/function names will naturally lead to longer comfortable line lengths.

Line length is more about concepts per line, or words per line, than it is characters per line.

The 80-column limit was originally a technical one only. It has remained because of backwards compatibility and tradition.

justsomehnguy4 hours ago

> It is the same reason a good blog layout sets a conservative maximum width for when it is read on a landscape oriented screen.

Except 99.9% of times it's becomes 50 characters with 32pt font which occupies ~25% of the horizontal space on a 43".

"Good" my ass.

perching_aix10 hours ago

It really wouldn't be much of a conversation. Historical conventions are a thing in general. Just think of the direction of electron flow.

> even though we have 16x9 4K displays now

Pretty much no normal person uses those at 100% scaling though, so unless you're thinking of the fellas who use a TV for a monitor, that doesn't actually help so much:

- 100% scaling: 6 panels of 80 columns fit, no px go to waste

- 125% scaling: 4 panels of 80 columns fit, 64 px go to waste (8 cols)

- 150% scaling: 4 panels of 80 columns fit, no px go to waste

- 175% scaling: 3 panels of 80 columns fit, 274 px go to waste (34 cols)

- 200% scaling: 3 panels of 80 columns fit, no px go to waste

This sounds good until you need any additional side panels. Think line numbers, scrollbars, breakpoint indicators, or worse: minimaps, and a directory browser. A minimap is usually 20 cols/panel, a directory browser is usually 40 cols. Scrollbar and bp-indicator together 2 cols/panel. Line numbers, probably safe to say, no more than 6 cols/panel.

With 2 panels, this works out to an entire additional panel in overhead, so out of 3 panels only 2 remain usable. That's the fate of the 175% and 200% options. So what is the "appropriate" scaling to use?

Well PPI-wise, if you're rocking a 32" model, then 150%. If a 27" model, then 175%. And of course, given a 22"-23"-24" unit, then 200%. People of course get sold on these for the "additional screen real estate" though, so they'll instead sacrifice seeing the entire screen at once and will put on their glasses. Maybe you prefer to drop down by 25% for each of these.

All of this is to say, it's not all that unreasonable. I personally feel a bit more comfortable with a 100 col margin, but I do definitely appreciate when various files nicely keep to the 80 col mark, they're a lot nicer to work with side-by-side.

Sharlin11 hours ago

It did, but 80 columns also pretty closely matches the 50ish em/70ish character paragraph width that’s usually recommended for readability. I myself wouldn’t go much higher than 100 columns with code.

ahoef12 hours ago

While 80 characters is obviously quite short, my experience is that longer line lengths result in much less readable code. You have to try to be concise on shorter lines, with better phrasing.

mavhc10 hours ago

Try explaining files to a kid these days

kqr7 hours ago

Wait 'til you hear about the PDP-11 emulator of a CPU it is running on.

PunchyHamster9 hours ago

I had game partition mounted as subpath on a drive and it just not worked well with some apps.

Some apps (in this case Steam) don't run "what is is space in current path" (despise say GetDiskFreeSpaceExW accepting full path just fine), they cut it to the drive letter, which causes them to display space of the root drive, not the actual directory that they are using and in my case was mounted as different partition

ForOldHack10 hours ago

In the 80s, running DOS 3.1 on an IBM Network, I was networking dual floppy PCs, and with testing, got through drive '!' '@' '#' '^' So I was able to use 26 floppies, 24 of them non local... It was all removed with the next release, 3.2, so I would make some bets about NT Networking and its NetBIOS roots.

I was inspired by the Dr Seuss, "On beyond Zebra."

fortran776 hours ago

It's baffling tha[t] after 59 years , Unix is still stuck in a weird directory naming structure inherited from the the late 60s that no longer make[s] sense when nobody has floppy drives.

cbm-vic-205 hours ago

Unix pre-dates floppy drives, at least on PDP-11.

monocasa3 hours ago

Unix just barely predates the PDP-11 itself.

naikrovek9 hours ago

It’s not baffling at all. They strongly value maintaining backwards compatibility guarantees.

For example, Windows 11 has no backwards compatibility guarantees for DOS but operating systems that they do have backwards compatibility guarantees for do.

Enterprises need Microsoft to maintain these for as long as possible.

It is AMAZING how much inertia software has that hardware doesn’t, given how difficult each are to create.

monocasa3 hours ago

They've stopped caring as much about backwards compat.

Windows 10 no longer plays the first Crysis without binary patches for instance.

wizzwizz49 hours ago

The 3.5mm audio jack is 75 years old, but electrically-compatible with a nearly 150-year-old standard.

+1
naikrovek9 hours ago
viraptor3 hours ago

> You can't access certificates in linux/bash as a file path for example

Fuse and p9 exist... If anyone wants certs by id in the filesystem, it will exist.

p_ing14 hours ago

PnP PowerShell also includes a PSDrive provider [0] so you can browse SharePoint Online as a drive. These aren't limited to local sources.

[0] https://pnp.github.io/powershell/cmdlets/Connect-PnPOnline.h...

PunchyHamster9 hours ago

> You can't access certificates in linux/bash as a file path for example, but you can in powershell/windows.

sure you can, /usr/share/ca-certificates tho you do need to run 'update-ca-certificates' (in debian derivatives) to update some files, like hashed symlinks in /etc/ssl/certs

there is also of course /sys|/proc for system stuff, but yes, nowhere near as integrated as windows registry

anthk12 hours ago

ReactOS has a graphical NT OBJ browser (maybe as a CLSID) where you can just open an Explorer window and look up the whole registry hierarchy and a lot more.

It works under Windows too.

Proof:

https://winclassic.net/thread/1852/reactos-registry-ntobject...

delusional14 hours ago

> You can't access certificates in linux/bash as a file path for example, but you can in powershell/windows.

I don't understand what you mean by this. I can access them "as a file" because they are in fact just files

    $ ls /etc/ca-certificates/extracted/cadir | tail -n 5
    UCA_Global_G2_Root.pem
    USERTrust_ECC_Certification_Authority.pem
    USERTrust_RSA_Certification_Authority.pem
    vTrus_ECC_Root_CA.pem
    vTrus_Root_CA.pem
notepad0x9014 hours ago

You can access files that contain certificate information (on any OS), but you can't access individual certificates as their own object. In your output, you're listing files that may or may not contain valid certificate information.

The difference is similar to being able to do 'ls /usr/bin/ls' vs 'ls /proc/12345/...' , the first is a literal file listing, the second is a way to access/manipulate the ls process (supposedly pid 12345). In windows, certificates are not just files but parsed/processed/validated usage specific objects. The same applies on Linux but it is up to openssl, gnutls,etc... to make sense of that information. If openssl/gnutls had a VFS mount for their view of the certificates on the system (and GPG!!) that would be similar to cert:\ in powershell.

jeroenhd13 hours ago

Linux lacks a lot of APIs other operating systems have and certificate management is one of them.

A Linux equivalent of listing certificates through the Windows virtual file system would be something like listing /proc/self/tls/certificates (which doesn't actually exist, of course, because Linux has decided that stuff like that is the user's problem to set up and not an OS API).

justsomehnguy4 hours ago

Do note the 'ls' usage:

    PS Cert:\LocalMachine\Root\> ls

       PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\Root

    Thumbprint                                Subject              EnhancedKeyUsageList
    ----------                                -------              --------------------
    CDD4EEAE6000AC7F40C3802C171E30148030C072  CN=Microsoft Root C…
    BE36A4562FB2EE05DBB3D32323ADF445084ED656  CN=Thawte Timestamp…
    A43489159A520F0D93D032CCAF37E7FE20A8B419  CN=Microsoft Root A…
    92B46C76E13054E104F230517E6E504D43AB10B5  CN=Symantec Enterpr…
    8F43288AD272F3103B6FB1428485EA3014C0BCFE  CN=Microsoft Root C…
    7F88CD7223F3C813818C994614A89C99FA3B5247  CN=Microsoft Authen…
    245C97DF7514E7CF2DF8BE72AE957B9E04741E85  OU=Copyright (c) 19…
    18F7C1FCC3090203FD5BAA2F861A754976C8DD25  OU="NO LIABILITY AC…
    E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46  CN=UTN-USERFirst-Ob… {Code Signing, Time Stamping, Encrypting File System}
    DF717EAA4AD94EC9558499602D48DE5FBCF03A25  CN=IdenTrust Commer…
    DF3C24F9BFD666761B268073FE06D1CC8D4F82A4  CN=DigiCert Global …
Now do the same without a convoluted hodge-podge of one-liner involving grep, python and cutting exact text pieces with regex.

I always love how linux fans do like to talk without any experience nor the will to get the said experience.

Iwan-Zotow5 hours ago

No, he meant access like virtual pseudo filesystem - /proc, /sys etc

kadoban14 hours ago

I _suspect_ they mean that certs imported into MMC in Windows can be accessed at magic paths, but...yeah linux can do that because it skips the step of making a magical holding area for certs.

notepad0x9014 hours ago

there are magical holding areas in Linux as well, but that detail is up to TLS libraries like openssl at run-time, and hidden away from their clients. There are a myriad of ways to manage just ca certs, gnutls may not use openssl's paths, and each distro has its own idea of where the certs go. The ideal unix-y way (that windows/powershell gets) would be to mount a virtual volume for certificates where users and client apps alike can view/manipulate certificate information. If you've tried to get a internal certs working with different Linux distros/deployments you might be familiar with the headache (but a minor one I'll admit).

Not for certs specifically (that I know of) but Plan9 and it's derivaties are very hard on making everything VFS abstracted. Of course /proc , /sys and others are awesome, but there are still things that need their own FS view but are relegated to just 'files'. Like ~/.cache ~/.config and all the xdg standards. I get it, it's a standardized path and all, but what's being abstracted is here is not "data in a file" but "cache" and "configuration" (more specific), it should still be in a VFS path, but it shouldn't be a file that is exposed but an abstraction of "configuration settings" or "cache entries" backed by whatever thing you want (e.g.: redis, sqlite, s3,etc..). The windows registry (configuration manager is the real name btw) does a good job of abstracting configurations, but obviously you can't pick and choose the back-end implementation like you potentially could in Linux.

jeroenhd13 hours ago

> The windows registry (configuration manager is the real name btw) does a good job of abstracting configurations, but obviously you can't pick and choose the back-end implementation like you potentially could in Linux.

In theory, this is what dbus is doing, but through APIs rather than arbitrary path-key-value triplets. You can run your secret manager of choice and as long as it responds to the DBUS API calls correctly, the calling application doesn't know who's managing the secrets for you. Same goes for sound, display config, and the Bluetooth API, although some are "branded" so they're not quite interchangeable as they might change on a whim.

Gnome's dconf system looks a lot like the Windows registry and thanks to the capability to add documentation directly to keys, it's also a lot easier to actually use if you're trying to configure a system.

noinsight17 hours ago

Windows is not limited to accessing partitions through drive letters either, it's just the existing convention.

You can mount partitions under directories just like you can in Linux/Unix.

PowerShell has Add-PartitionAccessPath for this:

> mkdir C:\Disk

> Add-PartitionAccessPath -DiskNumber 1 -PartitionNumber 2 -AccessPath "C:\Disk"

> ls C:\Disk

It will persist through reboots too.

jeroenhd13 hours ago

I've used this a few times to put games on exchangeable media. Installers don't like it if you pick an SD card as an install target, but they don't care if C:\Games\Whatever is actually an NTFS mount point that goes unpopulated as soon as I disconnect the memory card. This trick has the downside of confusing installers that try to check free space, though.

For permanently mounted drives, I'd pick symbolic links over mount points because this lets you do file system maintenance and such much easier on a per-drive level. You can still keep everything under C:\ and treat it like a weird / on Unix, but it you need to defragment your backup hard drive you won't need to beat the partition manager into submission to make the defragment button show up for your mounted path.

magicalhippo15 hours ago

Don't have to use PowerShell either, it's been available for ages through Disk Management. Right-click on a partition -> Change Drive Letter and Path -> Add -> Mount in following empty NCTS folder.

EvanAnderson15 hours ago

NTFS mount points can be very handy for engineering around software that doesn't allow you to customize paths. I can choose VM disks with different performance or replication policies and stitch them together like I would on a *nix OS. It's very handy and only in rare occasions have I had applications "notice" it and balk.

jasomill11 hours ago

Symlinks also work on NTFS, though mount points have the advantage of not having a canonical path that might be unintentionally resolved and persisted.

zamadatix17 hours ago

Only for NTFS (both source and dest) though, no exFAT shared drives under a folder mount or what have you. I think the same is actually true of ReFS for some reason.

When you create/format the partition in the GUI tools it'll actually ask if you want to assign a drive letter or mount as a path as well.

chungy16 hours ago

I just tried mounting a exFAT partition at "C:\exFAT" and it worked just fine.

Filligree16 hours ago

Other way around. Try mounting E: in your exfat drive.

p_l14 hours ago

That's because some filesystems like NTFS expose necessary metadata for integration and some don't. FAT and exFAT do not.

p_ing14 hours ago

RAW partitions can be mounted at a mount point (or drive letter).

Used to be able to use these with SQL Server.... 2000.

PunchyHamster9 hours ago

Many programs (Steam did, last time I checked) will look up the parent disk's free space when you do that and might refuse to install if that space is too small (even if target dir have enough)

mschuster9116 hours ago

What, excuse me, the fuck? I never knew one could do this. Thanks!

nolok14 hours ago

It's even available in the regular UI, open "computer management" go to the disk section and many of the 'magic' things about drives in windows world are just UI toggles

korhojoa14 hours ago

Back when Windows 2000 was the new thing, I used to put "Program Files" on another disk with this. Starting programs became faster too, as things loaded both from the OS drive and the drive where the programs were installed.

thrtythreeforty18 hours ago

The cursedness of "€:\" is awesome. It's amazing how much more flexible the NT kernel is vs what's exposed to the user.

jeffbee15 hours ago

Yeah only the DOS façade of Windows NT is well known. Under that skin lurks some pretty wild late-1980s concepts. One of the core things to understand is that a lot of the features are based on a reverse map of GUIDs to various actions, and resolution of these map entries pervades the UI. That's why you can put {hexspew} as the name of a shortcut on the Windows desktop and have it magically become a deep link to some feature that Windows doesn't otherwise let you create a shortcut to, and also why you can just add things to the control panel which doesn't seem like it would be an intentional feature. And these actions can be named symbols inside DLLs, so they can do literally anything the OS is capable of doing. This is also why Windows has always been ground zero for malware.

sedatk13 hours ago

Those GUIDs aren't related to NT kernel but Windows Explorer and its COM-based component system. They were introduced with Windows 95, IIRC.

pixl9714 hours ago

>so they can do literally anything the OS is capable of doing

Yea, over the years someone thought of something they wanted to do and then did it without a systematic consideration of what that level of power meant, especially as multi-user network connectivity and untrusted data became the norm.

p_ing13 hours ago

Those weren't a consideration when the NT OS/2 Design Workbook was being written.

Wonkey12 hours ago

That sounds fun. Do you have a link or and example “hexspew”

bialpio11 hours ago
Dwedit14 hours ago

Very cursed, and the drive letter won't even be accessible under certain codepages.

jeroenhd13 hours ago

As far as I can tell, the drive will still be accessible, it'll just require the character equivalent to € on the other code page as a drive letter.

As long as your code page doesn't have gaps, that should be doable. It'll definitely confuse the hell out of anyone who doesn't know about this setup, though!

Dwedit8 hours ago

I don't think it works that way, the actual drive letter is a UTF-16 Unicode path. The application must be able to provide an "ANSI" string that encodes to that UTF-16 value if it uses an "ANSI" function to open the file. It's not like 8-bit systems where they just want the same 8-bit value.

moffkalast10 hours ago

It's not flexible enough until we can have a joy face emoji as the drive letter.

RobotToaster17 hours ago

> Drives with a drive-letter other than A-Z do not appear in File Explorer, and cannot be navigated to in File Explorer.

Well there goes my plan to replace all my drive letters with emojis :(

mananaysiempre16 hours ago

You would be limited to a fairly small subset of emojis, anyway: many (most?) of them are outside of the BMP so don’t fit into a single UTF-16 code unit, and some of the remaining ones are ordinary characters followed by an emoji style selector (U+FE0F), which doesn’t fit either.

BLKNSLVR5 hours ago

Whenever I get onto a computer that someone left unlocked, the first thing I check is their eggplant- and peach-labelled drives.

jeroenhd13 hours ago

With the right code pages, you should be able to find a few smiley faces.

For everything else, the best advice I can offer is that you can put your own autorun config file on the root of a drive to point the drive icon to a different resource. Though the path will stay boring, the GUI will show emoji everywhere, especially if you also enter emoji in the drive label.

bikson13 hours ago

But your computer name can be emoji.

the_mitsuhiko17 hours ago

> In other words, since RtlDosPathNameToNtPathName_U converts C:\foo to \??\C:\foo, then an object named C: will behave like a drive letter. To give an example of what I mean by that: in an alternate universe, RtlDosPathNameToNtPathName_U could convert the path FOO:\bar to \??\FOO:\bar and then FOO: could behave like a drive letter.

For some reason I remember that the original xbox 360 had "drive letters" which were entire strings. Unfortunately I no longer have access to the developer docs and now I wonder if my mind completely made this up. I think it was something like "Game:\foo" and "Hdd0:\foo".

Just_Harry8 hours ago

Your memory is intact :) Those were/are a thing.

The Xenia emulator handles them with symbolic links in its virtual-file-system: https://github.com/xenia-canary/xenia-canary/blob/70e44ab6ec...

vunderba17 hours ago

From the article:

> Drives with a drive-letter other than A-Z do not appear in File Explorer, and cannot be navigated to in File Explorer.

Reminds me of the old-school ALT + 255 trick on Win9x machines where adding this "illegal trailing character" made the directory inaccessible from the regular file explorer.

Telemakhos16 hours ago

Shhh… that’s how we hid the Duke Nukem installs on the boxen in the dorm computer lab.

Someone123416 hours ago

Up until recently, you could do the same thing in the Windows Registry to make it so normal Windows tools (e.g. Regedit) couldn't view/modify certain entries. I believe it was still an issue in the last five~ years.

mavhc10 hours ago
azalemeth17 hours ago

This all sounds like a wonderful way to write some truly annoying malware. I expect to see hidden mounts on SQL-escape-type-maliciously-named drives soon...

Someone123416 hours ago

I understand your point; but I'm struggling to see how this could be weaponized. Keep in mind, that these Dos compatible drive letters need to map to a real NT path endpoint (e.g. a drive/volume); so it isn't clear how the malware could both have a difficult to scan Dos tree while also not exposing that same area elsewhere for trivial scanning.

rwmj15 hours ago

I'm betting there's some badly written AV software out there which will crash on non-standard drive letters, allowing at least a bit of mayhem.

avidiax12 hours ago

Not sure if it is natively supported, but the malware can just decrypt a disk image to RAM and create a RAM disk mounted to +. Or it can maybe have a user space driver for a loop device, so the sectors of the drive are only decrypted on the fly.

It would likely break a lot of analysis tools and just generally make things very difficult.

buzer14 hours ago

The recovery partition might work if it exists.

ahoka15 hours ago

Wait until your learn about Alternate Data Streams…

p_ing13 hours ago

They had their use when running Services for Macintosh.

jeroenhd13 hours ago

They're still actively used to apply the Mark of the Web to indicate a file has been downloaded from an untrusted zone and should be handled with caution. I believe macOS also applies similar metadata.

There are a few other places where they also show up, but the MotW is the most prevalent one I've found. Most antivirus programs will warn you for unusual alternate data streams regardless of what they contain.

p_ing6 hours ago

macOS uses extended attributes (can be manipulated with xattr).

ADS was originally designed to support the HFS resource fork.

boston_clone14 hours ago

Decent writeup from CS with that evasion method described -

https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spid...

hulitu16 hours ago

> This all sounds like a wonderful way to write some truly annoying malware.

AFAIK you need admin priviledges to play with drives in Windows.

ddtaylor13 hours ago

For anyone curious there is a somewhat similar thing in Linux called Abstract Domain Sockets. These are Unix domain sockets where the first character is NUL ('\0')

I am working on a game where every player has system resources on a Linux computer. The basic idea is that some resources need to be shared or protected in some ways, such as files, but the core communication of the game client itself needs to be preserved without getting in the way of the real system environment.

I am using these abstract data sockets because they sidestep most other permissions in Linux. If you have the magic numbers to find the socket, you get access.

bandie9110 hours ago

> If you have the magic numbers

or find it in /proc/net/unix

ddtaylor5 hours ago

Correct. Doing this allows you to implement your own method of checking credentials when a process wants to talk to that socket, such as SO_PEERCRED.

Tanoc17 hours ago

Anybody who's had to look through files on multi-disc arrays knows exactly how weird the drive letters can get. Mount the ISOs of thirty six 8.5GB DVDs because someone thought it was a good idea to split zip a single archive into 7.99GB segments and things get very tricky in cmd. If you weren't in the habit of using several layers of quotation marks to separate everything you'll form it very quickly because the operators can be the same symbols as the drive letters, as shown in the article with the "+" example.

layer814 hours ago

> drive letters are essentially just a convention borne out of the conversion of a Win32 path into a NT path

CMD also has the concept of a current drive, and of a per-drive current directory. (While “X:\” references the root directory of drive X, “X:” references whatever the current directory of drive X is. And the current directory, i.e. “.”, is the current directory of the current drive.) I wonder how those mesh with non-standard drive letters.

squeek50213 hours ago

They work just fine, as the drive-specific CWD is stored in the environment as a normally-hidden =<drive-letter>: environment variable which has all the same WTF-16 and case-insensitive properties as drive letters:

    C:\> cd /D λ:\

    λ:\> cd bar

    λ:\bar> cd /D C:\

    C:\> echo %=Λ:%
    λ:\bar

    C:\> cd /D Λ:

    λ:\bar>
o11c6 hours ago

Hm, what about using `%` itself?

squeek5024 hours ago

That would only interact with the shell, as `%` is not actually part of the environment variable name, it's just a way to tell the shell you want it to get the value of an environment variable. The environment block itself is a NULL terminated list of NULL terminated WTF-16 strings of the format <key>=<value>, so `=` would be the more interesting thing to try.

And indeed, it looks like using `=` as a drive letter breaks things in an interesting way:

    =:\> cd bar
    Not enough memory resources are available to process this command.

    =:\bar>
`cd` exits with error code 1, but the directory change still goes through.

With a program that dumps the NULL terminated <key>=<value> lines of the environment block, it looks like it does still modify the environment, but in an unexpected way:

Before `cd /D =:\`, I had a line that looked like this (i.e. the per-drive CWD for C:\ was C:\foo):

    =C:=C:\foo
After `cd /D =:\`, that was unexpectedly modified to:

    =C:==:\
Funnily enough, that line means that the "working directory" of the C drive is `=:\`, and that actually is acted upon:

    =:\foo> cd /D C:

    =:\>
---

You might also be interested to know that '= in the name of an environment variable' is a more general edge case that is handled inconsistently on more than just Windows: https://github.com/ziglang/zig/issues/23331

kazinator6 hours ago

In the Cygnal fork of the cygwin.dll, I hacked Cygwin's POSIX chdir() function, as well as the path resolution mechanism, to support the per-drive-letter name current directory concept.

A path like "f:myfile.txt" actually means f:\path\to\whatever\myfile.txt" where \path\to\whatever is the current working directory of the f drive.

This is one of the details which makes the replacement DLL more of a "native" run-time library, whose behavior is less surprising to Windows users of the applicaton based on it.

https://www.kylheku.com/cygnal/

WarOnPrivacy14 hours ago

In my first DOS, the drive letter after Z was AA. I created a series of small RAM drives to find out.

That may have been DOS 3.3, not later. IDK when it changed.

pixl978 hours ago

I remember Netware had some kind of drive letter mapping that went way past z:

arcfour17 hours ago

Hmm. This seems like it could be abused rather hilariously (or not, depending on your perspective) by malware...

Loughla17 hours ago

If the malware that exploits my machine also runs off the eggplant emoji drive, I'm becoming Amish.

PunchyHamster9 hours ago

When you mount a partition on eggplant in Linux, nobody bats an eye

When you do that on windows, everybody loses their mind.

joquarky11 hours ago

I miss the 'assign' feature on the Amiga.

layer813 hours ago

> Non-ASCII drive letters are even case-insensitive like A-Z are

I wonder, does `subst I: .` create i: or ı: under the Turkish locale?

rwmj15 hours ago

This is an interesting reference about how drive letters are stored in the Windows Registry: http://www.goodells.net/multiboot/partsigs.shtml

I never tried, but I wonder if you could use direct registry editing to create some really strange drive letters.

ddtaylor14 hours ago

I never knew Λ was the upper case version of λ.

WalterBright13 hours ago

26 drives should be enough for anyone.

xori12 hours ago

The real question is can Windows defender scan these drives?

jasomill11 hours ago

I don't know what it scans in the background by default, but it can custom scan mounted volumes with no visible mount points assigned at all, e.g., my EFI partition containing a copy of the EICAR test file[1]:

  PS C:\Users\jtm> & 'C:\Program Files\Windows Defender\MpCmdRun.exe' -Scan -ScanType 3 -File '\\?\Volume{91ada2dc-bb55-4d7d-aee5-df40f3cfa155}\'
  Scan starting...
  Scan finished.
  Scanning \\?\Volume{91ada2dc-bb55-4d7d-aee5-df40f3cfa155}\ found 1 threats.
  Cleaning started...
  Cleaning finished.
[1] https://www.eicar.org/download-anti-malware-testfile/
robocat15 hours ago

Similar corner cases are the bedrock of security flaws.

If anyone adds this behaviour as a bet on a market about a future CVE or severity, can they add a link to the bet here?

kijin17 hours ago

I remember when A and B were commonly used drive letters. C was a luxury. D was outright bourgeois.

But for some reason, drive letters starting with C feel completely natural, too. Maybe it's because C is also the first note in the most widely known musical scale. We can totally afford to waste two drive letters at the start, right?

skissane10 hours ago

> I remember when A and B were commonly used drive letters. C was a luxury. D was outright bourgeois.

Our first home computer (1989 or 1990?) was a 386SX with a 40MB hard disk (so maybe we were bourgeois). My dad had to partition it into a 32MB C drive and an 8MB D drive, because the DOS version (3.3?) had a 32MB maximum filesystem size. It had two separate 5.25 inch floppy drives, a 1.2MB and a 360KB - although the 1.2MB drives could read 360KB disks, they couldn’t write them in a form readable by 360KB drives, or something like that. And later (circa 1991) we got a 3.5 inch floppy drive too, which became drive A, the 1.2MB became drive B, and the 360KB was relegated to drive E. The FDC that came with the computer (back then they were ISA cards, hadn’t been integrated with the motherboard yet) only supported two drives, so he had to buy a new one that supported four.

urbandw311er17 hours ago

Oh bless you and your youngsterness. A and B, by convention, were reserved for floppy drives and C was typically the first hard drive.

keitmo16 hours ago

On systems with a single floppy, drives A: and B: were two logical drives mapped to the same physical drive. This enabled you to (tediously) copy files from one diskette to another.

dmurray13 hours ago

I don't recall this, and I do recall running something like "diskcopy A: A:" to do that operation.

pxx12 hours ago

phantom drive B is explicitly mentioned in https://en.wikipedia.org/wiki/Drive_letter_assignment#Order_...

the linked source checks out. diskcopy will also do this for you if you give it source = dest.

HPsquared17 hours ago

Hard drives were a luxury.

prerok15 hours ago

While original IBM PCs indeed may not have had HDDs, it did become a standard for PC XT, as early as 1983. Only the cheapest version were without a HDD by the end of the 1980s.

+1
actionfromafar15 hours ago
layer813 hours ago

By the end of the 1980s, a lot of years had passed, and you’d buy an AT instead of an XT.

nopechief13 hours ago

[dead]

euroderf16 hours ago

D was typically a CD-ROM drive. So when CD-ROMs went the way of the dinosaurs, where did D go ? Is it always some kind of SYS drive nowadays ?

tom_16 hours ago

It's just whatever happens to end up there? That's why D was typically the CD-ROM: A was the first floppy drive, B the (typically absent) second floppy drive, C the only hard disk, and then D was the next free letter.

On my laptop, D is the SD card slot. On my desktop, it's the 2nd SSD.

xoxxala14 hours ago

When recordable CDs were brand new, we set up a station at work with two hard drives (C: and D:) and the CD burner (E:). Naturally, the CDR burning software was hard-coded for D: but didn't mention that anywhere (including the error message). Took us a few hours to figure it out.

hilbert4216 hours ago

"That's why D was typically the CD-ROM:"

We used to set our machines so the CD-ROM was always drive L. This way we always had 'room' to add HDs so there was no gap in the alphabetical sequence. Drive D - data drive, E - swapfile, etc.

Test and external drives (being temporary) were assigned letters further down than L. Sticking reasonably rigidly to this nomenclature avoided stuff-up such as cloning an empty drive onto one with data on it (cloning was a frequent activity).

Incidentally, this rule applied to all machines, a laptop with HD would have C drive and L as the CD-ROM. Machines with multiple CD-ROMs would be assigned L, M and so on.

NetMageSCW3 hours ago

I always used J: (I didn’t expect to need to add that many hard drives).

I mainly did it so that CD installs wouldn’t lose their install drive since even Windows tracked it by the absolute path. Not as important with everything installed by download and Windows copying the install media to the hard drive anyway.

retroflexzy11 hours ago

After C:, it really is just allocated in order.

Between CD/DVD drives, writers, Zip Drives, and extra hard drives, it wasn't unusual for a workstation to naturally end up with G: or H:, before mapped network storage became common.

cesarb10 hours ago

> A was the first floppy drive, B the (typically absent) second floppy drive

As another commenter mentioned, when you didn't have a second floppy drive, A: and B: mapped to two floppy disks in the same floppy drive, with DOS pausing and asking you to insert the other floppy disk when necessary. Which explains why, even on single-floppy computers, the hard disk was at C: and not B: (and since so much software ended up expecting it, the convention continued even on computers without any floppy disk drive).

Kwpolska13 hours ago

Depends on your setup. These days, I have a D drive for sharing data with the Linux install I never use. I used to have a D drive for user data (to keep them safe when reinstalling Windows) back in the 9x/XP days (and my CD drive was E).

I also use the drive letter assignment feature, so my external USB drive is always drive X.

tetha16 hours ago

On servers, D is commonly used to push data / vendor installations / other stuff you may want to backup separate from the OS off of the main OS drive C.

rzzzt16 hours ago

C: is the boot partition with the DoubleSpace driver, D: is the compressed volume.

lepicz15 hours ago

Stacker compressed volume ;)

badc0ffee13 hours ago

DriveSpace, surely

kijin16 hours ago

D usually refers to the second internal storage device these days. Either a second SSD, a large HDD, or an extra partition in your system disk. If you don't have any of those, a USB stick might get the D drive temporarily.

theandrewbailey16 hours ago

This topic would make a good post on The Old New Thing.

nunobrito17 hours ago

This was a cool article. Learned something new today.

northantara9 hours ago

What happens if you mount 0x0000?

thenickdude9 hours ago

Deep in the abyss, the dark lord stirs

Iwan-Zotow5 hours ago

Bill Gates will get a call

pdntspa15 hours ago

Seems like a great way to hide a bunch of files from users for a malware payload

perlgeek16 hours ago

Now somebody will uses this to hide their malware, somehow...

rado17 hours ago

Windows drive letters are ridiculous. Use an external drive for e.g. video editing, its letter can be stolen by another drive, you can’t work anymore.

Arainach17 hours ago

Not while it's mounted. This is akin to complaining that on Linux if you unplug a flash drive and plug in a different one that second drive could "steal" /mnt/sdb1 or whatever.

Filligree16 hours ago

People did complain about that, which is why on Linux today that mount would use the disk UUID or label instead.

So it’s fixed. What’s windows’ excuse? :-)

ChrisSD16 hours ago

Windows also has uuids. E.g.:

    \\.\Volume{3558506b-6ae4-11eb-8698-806e6f6e6963}\
+1
Someone123416 hours ago
hulitu16 hours ago

Linux is broken from this point of view. Inserting an USB drive before boot breaks booting .

oasisaimlessly15 hours ago

Only if you have a broken kernel cmdline or fstab that references /dev/sd* instead of using the UUID=xyz or /dev/disk/by-id/xyz syntax.

+1
cesarb10 hours ago
Xiol15 hours ago

Certainly doesn't for me. Skill issue.

dpark13 hours ago

“Works on my machine” is rarely a helpful response. Doubling down with the “skill issue” insult makes it rude in addition to being unhelpful.

Two other people were able to concisely explain the problem instead of being rude and condescending.

lutusp15 hours ago

> [ .. ] Inserting an USB drive before boot breaks booting.

Only if the machine's BIOS is configured to give bootable USB devices boot-order priority. So it's not about Linux -- in fact, the same thing would happen on a Windows machine.

Remember that in a properly configured Linux install, the boot partition is identified by UUID, not hardware identifier (in /etc/fstab). Consequently if you change a drive's hardware connection point, the system still boots.

avhception16 hours ago

I remember vividly when a user couldn't access his smb drive from Windows because both his printer and also the computer's case came with one of these multi-cardreaders with n slots and the drive letters collided. That's when I learned that smb drive letters don't even come from the "global" pool of drive letters, because, and this is obvious in hindsight, they are a per-user affair (credentials and all that).

I think the concept of drive letters is flawed.

mrweasel16 hours ago

Even Microsoft appears to agree with you, given that drive letters are symlinks. It's basically legacy, there's just no plan or reasonable path forward that will remove them.

bluGill5 hours ago

Drive letters made sense in 1981 for personal computers. Of course a network run by IT isn't personal anymore - by definition.

p_ing14 hours ago

I always tried to point people to DFS w/ the FQDN path. We added a shortcut to the user's desktop that pointed to their home folder on the DFS namespace.

TazeTSchnitzel17 hours ago

You can fix the drive letter assignments at any time if they become a problem, or use a directory as a mount point if that's less troublesome. (Win-R, diskmgmt.msc)

Kwpolska13 hours ago

If you go with the defaults, they might be. But if you manually define the letter for your external drive, it will keep it forever. (I have my external drive set to X. I’m not sure if Windows would respect that assignment if I had plugged in 19 other drives, but that is never going to happen.)

p_l14 hours ago

Only if the actual "drive letter" assigned to the drive is the special value for "auto".

Otherwise, the drive letter is allocated statically and won't be used by another volume.

leptons13 hours ago

You can't work anymore only if you are incurious and unable to google a simple solution - assign a different drive letter with the disk management program.

theturtle7 hours ago

[dead]

wheelie_bob8 hours ago

[dead]

lutusp15 hours ago

I hope this article gets archived in a computer history, so people in the future can read how today's default operating system persisted in requiring its vict..., umm, users, to honor an archaic practice long past any imaginable justification, while free alternative operating systems don't have this handicap.

I regularly have this conversation with my end-user neighbor -- I explain that he has once again written his backup archive onto his original because he plugged in his Windows USB drives in the wrong sequence. His reply is, more or less, "Are computers still that backward?" "No," I reply, "Windows is still that backward."

The good news is that Linux is more sophisticated. The bad news is that Linux users must be more sophisticated as well. But this won't always be true.

rwmj15 hours ago

Are Linux /dev device paths (originating from Unix) really much better? They're a pretty odd feature if you think about it. "Everything is a file", except only certain things can be files and at least by convention they only appear under /dev. Plan 9 takes the everything is a file concept to its logical conclusion and is much better designed.

Edit: Also /dev/sdX paths in Linux are not stable. They can and do vary across boot, since Linux 5.6.

lutusp14 hours ago

> Are Linux /dev device paths (originating from Unix) really much better?

Not better at all, which is why Linux uses partition UUIDs to identify specific storage partitions, regardless of hardware identifiers. This isn't automatic, the user must make it happen, which explains why Linux users need to know more than Windows users (and why Linux adoption is stalled).

> Edit: Also /dev/sdX paths in Linux are not stable. They can and do vary across boot, since Linux 5.6.

Yes, true, another reason to use partition UUIDs.

> Plan 9 takes the everything is a file concept to its logical conclusion and is much better designed.

It's a shame that Plan 9 didn't get traction -- too far ahead of its time I guess.

hakfoo13 hours ago

I always saw it as two different mindsets for data storage.

One vision is "medium-centric". You might want paths to always be consistently relative to a specific floppy disc regardless of what drive it's in, or a specific Seagate Barracuda no matter which SATA socket it was wired to.

Conversely it might make more sense to think about things in a "slot-centric" manner. The left hand floppy is drive A no matter what's in it. The third SATA socket is /dev/sdc regardless of how many drives you connected and in what order.

Either works as long as it's consistent. Every so often my secondary SSD swaps between /dev/nvme0 and /dev/nvme1 and it's annoying.

cesarb10 hours ago

> One vision is "medium-centric". You might want paths to always be consistently relative to a specific floppy disc regardless of what drive it's in, or a specific Seagate Barracuda no matter which SATA socket it was wired to.

> Conversely it might make more sense to think about things in a "slot-centric" manner. The left hand floppy is drive A no matter what's in it. The third SATA socket is /dev/sdc regardless of how many drives you connected and in what order.

A third way, which I believe is what most users actually want, is a "controller-centric" view, with the caveat that most "removable media" we have nowadays has its own built-in controller. The left hand floppy is drive A no matter what's in it, the top CD-ROM drive is drive D no matter what's in it, but the removable Seagate Expansion USB drive containing all your porn is drive X no matter which USB port you plugged it in, because the controller resides together with the media in the same portable plastic enclosure. That's also the case for SCSI, SATA, or even old-school IDE HDDs; you'd have to go back to pre-IDE drives to find one where the controller is separate from the media. With tape, CD/DVD/BD, and floppy, the controller is always separate from the media.

stormking8 hours ago

AmigaOS supported both. Each drive and in addition each medium had it's own name. If GAMEDISK was in floppy 0, you could reference it either as DF0: or as GAMEDISK:

You could even reference media that was not loaded at the time (e.g. GAMEDISK2:) and the OS would ask you to insert it into any drive. And there were "virtual" devices (assigns) that could point to a specific directory on a specific device, like LIBRARIES:

ElectricalUnion11 hours ago

And the sad thing is that stuff directly in `/dev` isn't neither, it's just "first come first served" order, that is more or less guaranteed to be non-deterministic BS. One is supposed to use udev /dev/disk/by-path/ subtree if one really wants "slot-centric" connections.

dist-epoch14 hours ago

Windows drive letters are also linked to some partition UUIDs, which is why you can move a partition to a different drive, or move drive to a different address (change SATA/m.2 port)

You can use mountvol command to see the mount-letter/GUID mapping.

stockresearcher14 hours ago

This has (more or less) been covered before!

https://news.ycombinator.com/item?id=17652502

VMS expects to be run as a cluster of machines with a single drive system. How that actually happens is “hidden” from user view, and what you see are “logicals”, which can be stacked on top of each other and otherwise manipulated by a user/process without affecting the underlying file system. The results can be insane in the hands of inexperienced folks. But that is where NT came from.

lutusp14 hours ago

All true, all good points. Some day partitions and their unique UUIDs will be the sole valid identifiers. Then end users will have to be warned not to copy entire partitions including their (no longer unique) UUID. Sounds bizarre but I've had that exact conversation.