NT programming is a lot of fun, though this release was quite challenging, because of all of the toolchain updates. On the plus side, we got to remove pre-Win10 support -- https://lists.zx2c4.com/pipermail/wireguard/2026-March/00954... . But did you know that Microsoft removed support for compiling x86 drivers in their latest driver SDK? So that was interesting to work around. There was also a fun change to the Go runtime included in this release: https://github.com/golang/go/commit/341b5e2c0261cc059b157f1c...
All and all, a fun release, and I'm happy to have the Windows release train cooking again.
What are individual developers of "lesser" (less important, less visible, less used) software with a Windows presence to do? Wait and pray for Goliath to make the first benevolent move, like all the folks who got locked out forever from their Google accounts on a whim? Ha!
The fact of the matter is, the code signing requirements on Windows are a serious threat to Free and Open Source Software on the platform. Code signing requirements are a threat to FOSS on all platforms that support this technique, and infinitely more so where it's effectively mandatory. I firmly believe that these days, THIS is the preferred angle/vector for Microsoft to kill the software variety their C-levels once publicly bad-mouthed as "cancer", and zx2c4 is one of the poor frogs being slowly boiled alive. Just not this time - yet.
Whats next?
Is that a pattern?
By the way, was it only for the Windows application, or was wireguard-go was also affected?
In retrospect, I should have not spent 3 weeks trying to get their incompetent software to work and just gone straight to phone calls. And at least in my case, the support agents seemed broadly unfamiliar, but seemed to have access to higher-priority internal case submission which did finally get to someone who could fix my issue.
This project -- https://git.zx2c4.com/wireguard-nt/about/ -- is used by this app -- https://git.zx2c4.com/wireguard-windows/about/ . The former is what the signing situation was about. The latter is just signed using a normal boring (but very expensive!) EV code signing certificate from one of the CAs.
it was a bit crazy how quickly people got conspiracy-minded about it.
microsoft fucked up, and as per typical big-tech, only fixed it when noise got made on social media. but not everything is a grand conspiracy orchestrated by microsoft or the government or whatever. incompetence is always more likely than malice.
any news from the veracrypt maintainers? i would imagine whatever microsoft employee got tasked with resolving this issue would have also seen that one.
"Incompetence" of this degree is malice. It is actively malicious to create a system that automatically locks people out of their accounts with absolutely no possibility for human review or recourse short of getting traction in the media. "No sir, I didn't grind those orphans up. It was this orphan grinding machine I made that did it, teehee!"
Everything should be treat as suspicious moving forward and I am glad of the skepticism.
Conspiracy 2: Copilot all the things! Probably not too far off.
incompetence is always more likely than [intentional, directed] malice.
microsoft employees did not deliberately attack the wireguard project with a goal of taking it down for whatever grand scheme people's hatred cooks up. if you have evidence that microsoft did this deliberately to ruin the wireguard project, please forward it along to jason (the wireguard maintainer) and several news outlets.
For example by creating working processes which never end up "accidentally" causing awful outcomes. This is sometimes more expensive, but we should ensure that the resulting lack of goodwill if you don't is unaffordable.
Worst case there is malice and you've now made it more difficult to hide the malice so you've at least made things easier for those who remain committed to looking for malice, including criminal prosecutors.
The saying implies that incompetence and malice are polar opposites. They're not.
it does not
my point was that it wasnt a deliberate conspiracy/attack to fuck over wireguard, which would be an absolutely crazy story if it were true.
i am quoting the maintainer of the project. take it up with them if you think microsoft coordinated a directed attack on their project.
sure.
but this was not a deliberate attack by microsoft employees to shutdown wireguard. that is what i was trying to say and the essence of the quote in question.
It's really easy to end up with procedural machinery that makes it unpleasant for other entities that you don't like.
It seems to get the things that you do like and value less often. Why? Because you think about the consequences to what you consider important and you're inclined to ignore potential consequences to those you oppose or are competing with.
The Vogons weren't necessarily overtly malicious when they obliterated Earth.
i get that everyone has a frothing-at-the-mouth extreme hatred to microsoft and its employees. but microsoft did not say "fuck jason, fuck wireguard, lets try and shut that down". that would be a way different story.
its, like, the only thing worth pointing out. if microsoft is deliberately targeting projects and literally attacking them, that would be huge fucking news. like crazy news. lawsuits galore.
i think people are reading my comment as some sort of defense of microsoft. its not.
all i wanted to emphasize was that this incident, while obviously ridiculous, did not come about because a bunch of microsoft employees sat in a cigar-smoke filled room saying "lets destroy wireguard".
Regardless of what the maintainer says of their abuser after being abused, the point I think you are getting stuck on is this:
Creating a system which locks you out if you don't speak to a human isn't de-facto malicious.
Having support where you can't speak to a human isn't de-facto malicious, either.
Doing both at the same time, however, is de-facto malicious. Some executives likely got bonuses for doing it, too.
i interpreted that as you saying i am the hostage of microsoft, and have stockholm syndrome, therefor am speaking well of (defending) microsoft.
if i misinterpreted that, my bad. are you calling jason the hostage?
Jason A. Donenfeld Jason at zx2c4.com
Fri Apr 10 14:20:51 UTC 2026
Hey folks,
I generally don't send announcement emails for the Windows software, because the built-in updater takes care of notifying the relevant users. But because this hasn't been updated in so long, and because of recent news articles, I thought it'd be a good idea to notify the list.
After a lot of hardwork, we've released an updated Windows client, both the low level kernel driver and api harness, called WireGuardNT, and the higher level management software, command line utilities, and UI, called WireGuard for Windows.
There are some new features -- such as support for removing individual allowed IPs without dropping packets (as was added already to Linux and FreeBSD) and setting very low MTUs on IPv4 connections -- but the main improvement is lots of accumulated bug fixes, performance improvements, and above all, immense code streamlining due to ratcheting forward our minimum supported Windows version [1]. These projects are now built in a much more solid foundation, without having to maintain decades of compatibility hacks and alternative codepaths, and bizarre logic, and dynamic dispatching, and all manner of crust. There have also been large toolchain updates -- the EWDK version used for the driver, the Clang/LLVM/MingW version used for the userspace tooling, the Go version used for the main UI, the EV certificate and signing infrastructure -- which all together should amount to better performance and more modern code.
But, as it's our first Windows release in a long while, please test and let me know how it goes. Hopefully there are no regressions, and we've tested this quite a bit -- including on Windows 10 1507 Build 10240, the most ancient Windows that we support which Microsoft does not anymore -- but you never know. So feel free to write me as needed.
As always, the built-in updater should be prompting users to click the update button, which will check signatures and securely update the software. Alternatively, if you're installing for the first time or want to update immediately, our mini 80k fetcher will download and verify the latest version:
And to learn more about each of these two Windows projects:
Finally, I should comment on the aforementioned news articles. When we tried to submit the new NT kernel driver to Microsoft for signing, they had suspended our account, as I wrote about first in a random comment [2] on Hacker News in a thread about this happening to another project, and then later that day on Twitter [3]. The comments that followed were a bit off the rails. There's no conspiracy here from Microsoft. But the Internet discussion wound up catching the attention of Microsoft, and a day later, the account was unblocked, and all was well. I think this is just a case of bureaucratic processes getting a bit out of hand, which Microsoft was able to easily remedy. I don't think there's been any malice or conspiracy or anything weird. I think most news articles currently circulating haven't been updated to show that this was actually fixed pretty quickly. So, in case you were wondering, "but how can there be a new WireGuard for Windows update when the account is blocked?!", now you know that the answer is, "because the account was unblocked."
Anyway, enjoy the new software, and let me know how it works for you.
Thanks, Jason
[1] https://lists.zx2c4.com/pipermail/wireguard/2026-March/009541.html [2] https://news.ycombinator.com/item?id=47687884 [3] https://x.com/EdgeSecurity/status/2041872931576299888