Windows 11 is trying to make it easier to clean-install the OS using a ReFS partition instead of defaulting to the familiar NTFS. While that still remains in testing and we don’t know when ReFS will replace NTFS as the default format on Windows, Microsoft says it won’t allow ReFS on USB drives, and it makes you wonder what happened to the big ReFS bet.

For those unaware, it’s widely believed that ReFS will replace Windows 11’s NTFS as the default storage partition, and it totally makes sense, as it’s the ideal “successor.”

ReFS stands for Resilient File System, and it’s better than NTFS in many ways, including performance, security, and even improved data integrity. Microsoft already uses it for the Dev Drive in Windows 11, and there have been plans to show a ReFS option in Windows Setup.

ReFS also boosts partition size to 35 petabytes, and there are many other benefits, but we’re going to talk about that a bit later.

For now, Microsoft has confirmed that it’ll block ReFS-formatted USB drives by default with the January 2027 security update.

Microsoft confirms Windows 11 will block ReFS on USB drives

Windows has allowed ReFS on removable media until now, even though it’s officially “unsupported.” It is important to understand that “unsupported” doesn’t necessarily mean “Windows cannot use it.” Microsoft is now choosing to block these volumes by default and lists “security” as one of the reasons.

“ReFS on removable media, such as a USB disk, is not a supported configuration,” Microsoft explains in a support document spotted by Windows Latest.

However, if you want to keep using ReFS-formatted removable media, you will need to manually override the setting using either Group Policy or the Windows Registry.

Windows 11 starts with warnings before blocking ReFS USB drives in January

In our tests, Windows Latest observed that Microsoft is already showing an alert when you try to use a ReFS-formatted USB drive, but it does not block your drive automatically.

Only the first phase of the “restriction” is rolling out with the Windows 11 October 2026 update. In this phase, Windows audits external ReFS volumes by default. The warning shows up in Event Viewer with Event ID 524, under the ReFS source. You’ll also see the alert in the system tray under the Removable device icon.

One more thing I noticed is that Windows logs the warning once per affected volume during each boot and keeps track of up to 32 affected ReFS volumes.

Finally, the second phase kicks off in January 2027 with the monthly security update.

“Auditing and blocking are enabled by default. ReFS volumes that meet either configured external-media condition are blocked from mounting unless an administrator explicitly changes the applicable setting,” Microsoft explained in a document.

If you keep using ReFS removable drives, Windows could stop making the volume available after the update. Note that the restriction applies at the mounting level, which means you’ll simply lose access to the drive, but Microsoft won’t delete files stored on the removable drive.

“Blocking can affect access to data on an external ReFS volume. Ensure that required data is available from supported storage before enforcing the policy,” the company noted.

Microsoft has been giving ReFS a bigger role in Windows 11

I wasn’t really expecting Microsoft to block ReFS on USB drives because it’s not supposed to be a “supported” configuration, especially at a time when we’ve been hoping for ReFS to become the default, replacing NTFS. It’s even stranger because Microsoft has recently made ReFS more useful on Windows PCs.

For example, Dev Drive, if you remember, also uses ReFS storage aimed at developer workloads.

In the last two years, there have been numerous ReFS-related changes on Windows. In 2024, Microsoft added support for native block cloning, which allows eligible copies within the same ReFS volume to share existing data blocks. That means when one file changes, ReFS writes the changed data separately to keep the files independent.

ReFS is faster than NTFS

ReFS is clearly faster than NTFS, and Microsoft officially confirmed this in a benchmark we spotted in 2024.

According to Microsoft, Windows 11 can copy a 10GB file in 7.964 seconds on a drive with NTFS versus just 641 milliseconds on a drive that uses the Dev Drive feature and has block cloning enabled. This is a massive 92% reduction in copy time.

As I noted, Microsoft has been testing ReFS as an option for formatting Windows, and we spotted it in Windows builds released in March 2025. But when I actually attempted to install Windows on ReFS, Windows Setup failed with an error. However, the fact that ReFS showed up as an option suggests that Microsoft might replace NTFS with ReFS at some point.

We don’t know when that day will come, but there’s a chance that Microsoft might make the better format the default only for high-workload use cases, while NTFS remains the general-purpose file system for Windows.

You can stop Windows 11 from blocking ReFS USB devices

For now, if you have an external drive or USB drive formatted in ReFS, you should either reformat it to NTFS or change Windows settings.

There’s a setting called RefsRemovableDeviceMountPolicy, and if you configure it using Group Policy Editor, you can prevent Windows from blocking ReFS USB drives in January 2027.

I also found that there’s a local registry setting, which is a DWORD value with that name under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

The available values are:

Value	Behavior
0	Off
1	Audit
2	Block

Microsoft also documents the same DWORD under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies for Group Policy configuration.

However, Microsoft argues that it’s not a good idea to use ReFS on an external drive and mount it on Windows, as Windows doesn’t support it. It won’t explain why it wouldn’t choose to add support instead of making it difficult to use ReFS drives.

The post Windows 11 will block ReFS on USB drives, even as Microsoft bets big on its NTFS alternative appeared first on Windows Latest

Windows 11 26H2 is the newest version of Microsoft’s desktop OS, yet some of its most important files, including kernel32.dll, user32.dll, and ntoskrnl.exe, are named as if they were written for MS-DOS. They follow an old naming rule called 8.3, and Windows keeps it around for compatibility.

Raymond Chen, who has worked on Windows for more than 30 years, once explained why Microsoft prefers a format whose flaws are well documented instead of a new one that could break something else.

On my PC running Windows 11 26H2, File Explorer’s rounded corners and Fluent icons cover up a System32 folder full of names that would look right at home on a floppy disk from 1990.

What is an 8.3 filename, and why did MS-DOS use it?

For those unaware, 8.3 is the file-naming rule MS-DOS used (yes, it’s that old). A name can have up to eight characters before the dot and up to three after it (the extension), so the longest possible 8.3 name is 12 characters, including the dot. Microsoft’s file system specification also says an 8.3 name can only use ASCII characters, can’t contain spaces, and can’t have more than one period.

Several of the oldest files in System32 follow this rule, while newer components like the Windows Security service don’t come close.

Filename	Name + extension	Fits 8.3?
kernel32.dll	8 + 3	Yes
ntoskrnl.exe	8 + 3	Yes
user32.dll	6 + 3	Yes
hal.dll	3 + 3	Yes
SecurityHealthService.exe	21 + 3	No

 

MS-DOS showed these names in uppercase, so KERNEL32.DLL might look more familiar if you used a PC in the 90s. Windows manages file names as case-insensitive by default, so kernel32.dll and KERNEL32.DLL are basically the same file.

But why is the limit eight and three? Chen explained it back in a 2009 post on his Old New Thing blog. “It’s a holdover from CP/M,” he wrote. CP/M was an operating system Gary Kildall created for early microcomputers in 1974, and MS-DOS worked hard to stay compatible with it, file names included.

Interestingly, even Chen doesn’t know why CP/M picked those numbers. He notes that two reserved bytes in the CP/M directory format could have stretched names to 10.3, and guesses eight was just a convenient number.

Of course, 8.3 is only a naming habit on Windows 11. NTFS, the default file system, supports long file names of up to 255 characters, and Windows has managed long names since the mid-90s.

Why Windows keeps 8.3 names for its oldest system files, according to Raymond Chen

In an even earlier 2007 post, Chen was brainstorming possible reasons, not Microsoft’s official ones.

The most obvious reason is that a DLL’s name can’t change once programs link to it, as those programs look for the file by name. If Microsoft renamed user32.dll tomorrow, decades of Windows apps would go looking for a file that no longer exists. Yes, it’s a compatibility thing!

Windows 95 also didn’t require the system drive to support long file names, partly because companies using roaming profiles may have depended on servers that couldn’t handle them, so every Windows 95 system file had to fit 8.3. Chen believes Windows NT allowed a short-names-only FAT system drive as late as Windows 2000, and long names became mandatory only with Windows XP.

Even after XP, long names came with some extra luggage. Windows can generate a short alias for every long name, so if setup copies shellstyle.dll into a folder that already has shellstuff.dll, the new file will likely end up as SHELLS~2.DLL. Some programs hard-code these aliases, and Chen says plenty of apps assume Program Files is present at C:\PROGRA~1.

Out of curiosity, I ran dir /x on the C drive of my 26H2 PC, and Program Files still shows up as PROGRA~1. Microsoft’s NTFS documentation explains why, as short names are disabled by default on newly formatted volumes but stay enabled on the system volume for app compatibility.

The risk is one DLL going by two names. Windows loader handles a DLL’s short and long names as two different modules, so a process can end up with two copies in memory, each with its own global variables. Chen compares it to a childhood trip to Disneyland, where he and his brother waited at one Autopia exit while his parents waited at the other, with neither side knowing there were two. That might’ve been traumatic!

Chen’s last reason is the one I find most convincing. “All the problems with 8.3 names are well-understood and under control,” he wrote, adding that a switch to long names would only bring about a whole new set of problems in a system that already works.

In my opinion, the argument is justified even more in 2026. Microsoft is rewriting decades-old dialogs in WinUI 3, and even the new Properties dialog has to account for third-party apps that add their own tabs to the old one. Renaming kernel32.dll would break far more than a few tabs, and it wouldn’t make a PC faster or more secure.

Ironically, ReFS, the file system many expect to replace NTFS someday, drops support for short names, and if an old application goes looking for an 8.3 file on a ReFS drive, it simply crashes, proving exactly why Microsoft hasn’t touched the System32 names on NTFS.

So, the next time ntoskrnl.exe shows up in a blue screen crash report, know that its name follows a rule Windows inherited from a 1974 operating system, and Microsoft has good reasons to keep it that way. Chen made a similar point about old UI back in 2003, noting that companies with thousands of employees hate interface changes because retraining costs millions. Would you trade a tidier System32 for apps that refuse to open? Neither would I.

The post Microsoft explains why Windows 11 still uses MS-DOS file names, and why it can’t change them appeared first on Windows Latest

The Free Software Foundation "has never supported Raspberry Pi," writes their deputy directory Sean O'Brien, "as it depends on nonfree software for the boot process, leaving an important part of the computer outside the user's control." But they're now decrying "an even more intrusive restriction on user freedom" — the binary-blob bootloader changes that limit your ability to upgrade RAM: The restriction is not new: the relevant checks were introduced in the device firmware around 2024. However, these hardware handcuffs have only recently received wider attention. Though a user can desolder the original memory and install electrically compatible RAM, the nonfree firmware may refuse to recognize the additional memory, or simply decide not to boot the computer at all. Even replacement RAM of the same capacity can be rejected. This is worse than Raspberry Pi's longstanding dependence on nonfree firmware in an important way. It is not only nonfree software, but it is Digital Restrictions Management (DRM), used in this case to prevent the owner of the computer from making a modification that the hardware is otherwise capable of supporting. That distinction matters. Soldered RAM is difficult for most people to replace since it is a physical characteristic of the hardware. In the case of Raspberry Pi boards, users have demonstrated that the hardware itself can be modified successfully.... Raspberry Pi justifies the use of DRM on the basis of being able to identify altered computers. There may be legitimate reasons for wanting to identify such altered computers. Unscrupulous sellers have reportedly replaced memory on lower-capacity boards and resold them as more expensive models, sometimes using unreliable or defective components. But preventing fraud and maintaining quality does not require taking control away from users. A Raspberry Pi could record its original factory configuration in a cryptographically verifiable form. Raspberry Pi could use free software that warns the user when the installed RAM differs from original factory configuration. Raspberry Pi could provide tools allowing buyers to verify what hardware originally shipped with a board. None of those measures requires a software-enforced limit on what an owner may do with the computer... If compatible hardware can be installed successfully, the manufacturer should not create restrictions to prevent the owner from using it. Restrictions on hardware upgrades are deeply troubling from an organization like Raspberry Pi that has stated their commitment to longevity as a guiding principle. Free software is ultimately about who controls the computer. The user should control it, not the manufacturer that sold it.... The people who own these computers must also have the freedom to modify, repair, and upgrade them, without restrictions imposed by nonfree software limiting their potential. Hackaday recently argued the restriction was "no big deal." noting there's ways to bypass the restriction" The bootloader is stored in the SPI flash chip, which can be reflashed using the built-in mask ROM over USB and rpiboot, and you are not prevented from flashing older versions of the bootloader, so far... If you have the skills to upgrade your RAM, you most certainly have the skills to downgrade the Raspberry Pi bootloader... My advice: don't lament Raspberry Pi RAM upgrades, especially given they're only slightly harder to perform now. Very few hackers ever performed them, the main audience for them turned out to be dodgy hardware resellers online... Think of the users that will no longer be fooled by a shady seller on Amazon, especially now that the perverse incentives for board mods and reusing harvested RAM chips are at their highest.

Read more of this story at Slashdot.

MapQuest creates a new layer (that can be toggled on and off), Gizmodo reports: After promising not to comply with the Trump administration's "Lake America" gimmick, the platform announced a new "Surveillance Layer" that displays the locations of automated license plate readers (ALPRs), including those from Flock Safety. Per MapQuest, its new tool will identify the locations of known outdoor surveillance cameras and plate readers from Motorola Solutions (Vigilant), Genetec, Axis Communications, Axon, Leonardo (ELSAG), Neology, Rekor, PlateSmart, Ubicquia, Verkada, and others. While the company didn't specify how it sources its data, it appears to be similar to the data amassed by DeFlock, which maintains a user-submitted map of ALPR camera locations. MapQuest may be sourcing the information from DeFlock and the OpenStreetMap project. Engadget notes that MapQuest also recently added "useful, long-overdue features like Android Auto support and public transit directions."

Read more of this story at Slashdot.

Linux maintainers "have ruled that people no longer have to declare their LLM usage," reports XDA Developers, "as Torvalds himself calls a ban on AI 'utterly stupid.'" The first part of this story comes via a message sent to the Linux mailing list. It announces one of the major changes decided during the Maintainers Summit on October 8, 2026, in Prague, Czechia, where submissions to the kernel no longer need to use the "Assisted-by" tag... meaning that people can submit AI-generated code without needing to declare it as such. In some correspondence regarding concern about this new disclosure removal, the creator of Linux, Linus Torvalds, made his thoughts known... [Torvalds] compares an AI ban to getting rid of text editors, as doing so would prove that someone could write a good commit message without making any mistakes. He then rounds off his argument by asking, "Do you not see how UTTERLY STUPID those kinds of rules would be?" and stating that he simply expects the people working on the Linux kernel to "understand what they are doing." Here's the last line of Torvalds' post. "Quite honestly, in my experience, the people I respect and call intelligent are not the ones that shy away from using new and interesting tools." In a related story, Torvalds says he's used AI to help him understand patches that were hard to follow. And this week Torvalds even posted an LLM-assisted patch, reports Tom's Hardware: The development branch purports to fix an old issue with massive cache contention when many CPUs are reading the same file — a scenario potentially encountered when using shared libraries, databases, and web servers. Several developers had already made attempts over the years at fixing the issue, all with varied results, none quite ideal as an all-encompassing solution... He's now posted his solution in a development branch, and claims that he's seen a 23x performance improvement in a dedicated synthetic benchmark, though he notes that actual real-world impact will be far less significant, as "no real load" will witness those figures. Torvalds used Anthropic's Claude Code, reports The New Stack, and "said the assistant wrote the implementation, tests, and initial documentation, and reviewed the code under his direction. He ran the benchmarks himself, despite having previously criticized developers for claiming AI writes 99% of their code." Tuesday Torvalds submitted a 10-patch series. "Reviewers have since identified a race condition and raised concerns about memory reclamation," adds The New Stack. "Torvalds has handed further development to Kiryl Shutsemau, a Linux kernel developer who previously worked on the same bottleneck."

Read more of this story at Slashdot.

"Cloudflare has acquired Deno, the company behind the [server-side] JavaScript and TypeScript runtime created by Ryan Dahl, the inventor of Node.js," Forbes reported last week. But Deno "has no future at Cloudflare, which will maintain the runtime for another year before ending its development," writes The Register. "That's OK with Dahl. 'I am now of the opinion that if you're choosing Node.js for building servers, you're doing it wrong,' Dahl told The Register." It all started with his team's work on the platform Deno Deploy, "We wanted to make running applications as straightforward as possible," Dahl wrote on the official Deno blog. "But building and operating Deploy also showed us how much complexity remained underneath that developer experience. I wanted to simplify that layer, too." This led to celld. Building on the Cloudflare Workers programming model, celld lets developers build distributed applications from the start while making the system simple to operate. What excites me greatly is that the scaling is built into the programming model, rather than infrastructure each app has to assemble itself.... We want to make this programming model the default way to build servers, whether you run on Cloudflare's network or your own infrastructure. Joining also means choosing where to focus our effort... Deno will remain open source, and we welcome others who want to continue its development. Deno Deploy will continue operating for six months before shutting down. We will provide migration support for paying customers moving to Cloudflare Workers. [Deno's JSR package registry for JavaScript and TypeScript] will continue operating, with its infrastructure moving to Cloudflare. Forbes argues that this acquisition of Deno "turns a long-standing objection to Cloudflare Workers, the claim that applications built on it cannot easily leave, into a selling point." For CIOs evaluating serverless and edge platforms, portability now has a concrete answer... Released in August, [celld] is a single Rust binary that runs Workers and Durable Objects across many machines, with object storage as its only external dependency. Operators run multiple celld instances against one storage bucket, and the software handles placement, routing and persistence. Dahl and Belder will now lead an effort to merge celld into workerd and make self-hosting a supported way to run Workers applications. With this, customers can build an application on Cloudflare's network and move it to a private data center without rewriting it. "With Deno, we improved the experience of writing JavaScript," Dahl argues on the Cloudflare blog, "but we didn't fundamentally change what developers had to assemble around the runtime. The bigger problems are around networked applications: distributing computation, coordinating state, data storage in general, and autoscaling to meet demand..." Could the programming model make partitioning across machines part of the design from the start? The solution clicked into focus when I read about Cloudflare's Durable Objects. It provided a very powerful abstraction: the distributed singleton with a SQLite database. Each Durable Object is like a small, individually addressable server with its own relational database. Its JavaScript execution is single-threaded (which is easy to reason about), it handles WebSockets, and its local SQLite database can be accessed synchronously. By building a chat application using one Durable Object per channel, you have sharded your data and WebSocket connections, and thus made your application scalable... What excites me is the leverage this model gives developers: compute, relational databases, queues, and real-time communication primitives designed for applications distributed across machines. Now Dahl and 12 of his Deno colleagues "will work to build out Cloudflare's Workers platform," explains The Register, "expanding it for potential open-source use. He feels this approach is the way to go." "Right now, every other server is really operating at the Linux VM layer. That is not what Cloudflare Workers are," he said... The ever-fickle Dahl first debuted Deno in 2018 as a rewrite of Node. The name 'Deno' is an anagram of Node, and it was Dahl's attempt to fix everything he felt he got wrong with Node — built-in fetch, a permission model, native TypeScript support et al. Sequoia backed Dahl's company for $21 million in 2022, and as of August, Deno amassed 400,000 monthly users. Nonetheless, Node's gravity proved too heavy for Deno to achieve escape velocity. "What we found over years of working on Deno is that you can't really deviate from Node.js very much," Dahl told The Register. "As we continued to try to get adoption for Deno, we found we had to essentially backpedal on some of the original promises and become more Node compatible over time, and that left us as a kind of an alternative Node.js implementation." Going forward, Cloudflare will supply Deno with bug fixes and security patches for the next year, while Dahl looks for a new home for the MIT-licensed open source project. Dahl's worked could bring "yet another revolutionary turn for server-side JavaScript," the article argues, "offering a runtime that would require only 300 KB of memory per instance, rather than the hundreds of megabytes now required for Node/Deno. Such savings could quickly add up for a cloud provider, especially one serving the voracious agentic market." And as Dahl wrote on the Deno blog, "The need for better abstractions is especially acute with AI. Durable Objects bring together capabilities that are particularly useful for agent harnesses: inexpensive, serverless execution, persistent state, WebSockets, and a high-level JavaScript interface. This is what I'm most excited to explore and why celld focuses on Durable Objects."

Read more of this story at Slashdot.