8 ms·

Microsoft said that the secure boot and TPM requirements will not be enforced by the OS now but will by time Windows 11 hits RTM (which is why the Windows 11 in

• swiley 5y ago
  Personal computing is completely dead except for enthusiasts. We've completed our regression to the late 70s.
  • nijave 5y ago
    What does this even mean? Secure boot has little impact on anything except reducing the complexity of Windows (since it doesn't need as many boot configurations)
    • zozbot234 5y ago
      Reducing the complexity how? Their Legacy boot code is already written, and legacy BIOSes aren't going to change either. That code basically comes for free to MS.
      • nijave 5y ago
        Maintaining old code has a cost. Any changes Microsoft wants to make need to be compatible with the old code unless they remove it Things like tests/validation on new hardware is also costly. Microsoft (used to?) have an absolutely massive fleet of physical hardware to test Windows on
    • swiley 5y ago
      I guess if the firmware allows users to install their own CA it's ok. I wouldn't be surprised if that feature was neglected by the OEMs or intentionally removed with windows 12.
      • zozbot234 5y ago
        To their credit, Microsoft has signed a secure boot "shim" that allows the user to do that, with explicit prompting. It's being used in the boot flow of many Linux distributions.
        • userbinator 5y ago
          In other words, it was Microsoft who effectively "gave permission" for Linux to run. One OS company has control over whether they allow competitor's OSs, on hardware that the company doesn't even produce. That should be an absolutely horrifying thing to anyone who believes in software freedom.
          • foobar33333 5y ago
            You can disable secure boot and add your own keys in the firmware config page. Who knows how long that will last though.
            • cesarb 5y ago
              > You can disable secure boot and add your own keys in the firmware config page. You can disable secure boot or add your own keys because Microsoft required all manufacturers to allow it. If it wasn't mandated by Microsoft, some manufacturers would not allow it. And for ARM devices, Microsoft required the opposite (https://softwarefreedom.org/blog/2012/jan/12/microsoft-confirms-UEFI-fears-locks-down-ARM/ https://softwarefreedom.org/blog/2012/jan/12/microsoft-confi...). So yes, the only reason we can run non-Microsoft operating systems on our computers is because Microsoft "gave permission".
    • wildrhythms 5y ago
      I understand the risk and want to forego secure boot. What's wrong with that?
      • philistine 5y ago
        I'm on the Mac side, and I wanted to reinstall macOS. I messed up the hard drive wipe and ended up breaking the chain of trust. That meant Apple could no longer guarantee the correctness of my install, and no longer allowed my laptop to decrypt my data to reach the login screen directly. I had to input the password for my login at an earlier step during boot, which comes with a litany of small caveats. I'm sure Microsoft hopes to achieve something similar here at some point: secure boot would give them enough trust to decrypt an install upon boot all the way to the login screen.
        • zozbot234 5y ago
          At least you could recover by simply typing a login password. A similar screwup on a Windows box might require you to resort to BitLocker recovery keys, which add a fair bit of complexity and some users might not have these at all.
      • Datagenerator 5y ago
        Nothing wrong with freedom. Not running the master of all telemetry OS increases the possibility to read and study what you want without feeding the data hungry sensors Microsoft has set in stone for you. These datasets are brought to market with your consent (see the thousands of EULA pages you accepted directly and indirectly).
    • swiley 5y ago
      Also, turning off secure boot doesn't change the boot process on Microsoft's side, they have to ask the firmware after booting if it was disabled. Sorry for replying twice but I'm almost always stuck on noprocrast so I can't usually edit my comments.
    • selfhoster11 5y ago
      It makes Linux more complicated to deploy, for one. And if they ever change their mind and don't allow it on x86 any more, Linux is basically exiled from the PC OEM market.
      • easton 5y ago
        It shouldn't, as Microsoft made sure that the major distros (Ubuntu, RHEL, Fedora, CentOS, maybe Debian?) have access to a signing key that is trusted by the major OEMs. And you can trust your own keys, per the Microsoft guidelines that require that x86 machines allow their secure boot to be disabled. https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/uefi-requirements-that-apply-to-all-windows-platforms#security-requirements https://docs.microsoft.com/en-us/windows-hardware/drivers/br...
        • dataflow 5y ago
          > per the Microsoft guidelines that require that x86 machines allow their secure boot to be disabled. Yeah but then you can't boot into Windows? Who is actually going to go into the firmware settings to switch settings on and off for every single boot to the other OS?
          • blibble 5y ago
            you can boot debian/redhat/... out of the box without disabling it, as the shim used as part of the boot process has been signed by MS if you want to sign your own kernels: the shim will also let you do that relatively easily ("machine owner keys") if you want to own your entire boot process you can replace the platform key and sub-keys with your own, and then trust whoever you want (even adding MS' keys if you wish, so Windows can boot in secure mode)
            • kelnos 5y ago
              I'm pretty sure we don't want to be in a world where we can only use one of a few Microsoft-approved Linux distros without it being a pain the the ass to deal with.
    • bserge 5y ago
      Sorry, but 7 was way more stable than 8-10 and it didn't even support SecureBoot.
      • dlp211 5y ago
        As much as you want this to be true, it simply isn't.
        • formerly_proven 5y ago
          Any "Windows x was more stable than Windows y" (including the legally mandated "No, it wasn't" replies) is mostly rooted in what drivers the person used and if the hardware had issues, and has less to do with Windows.
  • pjmlp 5y ago
    What do you expect when people buy Apple laptops to do GNU/Linux work instead of improving the ecosystem of Linux OEMs? Or are now rushing to give money to Microsoft and use WSL? Well, that is how things eventually turn out to be.
  • jk7tarYZAQNpTQa 5y ago
    > Personal computing is completely dead except for enthusiasts So you're saying only enthusiasts have smartphones?
• zozbot234 5y ago
  What's even the point of enforcing these requirements when the OS seems to be running quite fine otherwise? Users who are running without SB or a compliant TPM will simply stay on Windows 10, and maybe stay on it past the official EOL date.
  • temac 5y ago
    That's an early build, maybe Windows 11 RTM will actually always use a TPM (1.2 is advertised as minimally supported though). As for secure boot, I don't see how that could be anything else than policy (that can have an impact on a security model and so on associated security measures, granted, but not having secure boot should technically not prevent booting / installation unless it is enforced by an explicit artificial limitation). But they could at least remove legacy boot support, in which case it just won't work without UEFI.
  • omegalulw 5y ago
    I suppose they don't want to support legacy hardware. If they let it install, people will complain when something breaks.
    • opencl 5y ago
      If the other requirements they've posted are accurate then the CPU list alone will eliminate anything more than about 3 years old.
  • wubbert 5y ago
    They're doing this to force people to buy new hardware and a new Windows licence. If they let you upgrade from Windows 10 for free, they don't make any money. They've already gotten people used to free updates, so they can't charge money for Windows 11 upgrades directly. Most people buy pre-built computers, so a Windows 11 licence will be included by default for most, so they will make more money.
    • kawsper 5y ago
      > They're doing this to force people to buy new hardware Forcing people to buy new hardware while there's a global chip shortage is going to be interesting.
• arsome 5y ago
  Is Windows 11 likely to perform some sort of attestation for this? Or are we likely to see something like the way the old Windows cracks used to work - a hacked up version of Grub or another bootloader able to patch the necessary firmware and BIOS information before chainloading Windows.
  • userbinator 5y ago
    Unless it's doing some sort of remote-code-download-and-execute(!) based on the attestation results, it will always be possible to crack everything locally. All the checks just need to be patched out, and finding them all is the hard part, but it is theoretically possible as long as you still have full control over the hardware. But such a setup will be very fragile to automatic updates (which are already difficult enough to turn off completely as it is), and with this whole "update mentality" I wouldn't be surprised if they eventually leave in certain security holes and use those as an additional force to coerce people to take their updates --- along with everything else the users didn't want.
    • blibble 5y ago
      how would you patch them out? the disk will be encrypted with a key stored in the TPM that will only be supplied to a signed OS, so you can't alter the contents on disk if you've booted in secure mode you can't interfere with the boot process and the OS won't let you patch it online if they pull it off correctly there's not much you can do they can even detect the effects of exploits using remote attestation if a machine has had its environment compromised it won't be able to get updates/watch youtube/play games/... (using old software/firmware with known exploits can be similarly blocked, until you upgrade)
      • arsome 5y ago
        You're talking about a fantasy world that doesn't exist where Microsoft has gone to extreme precautions like you see on mobile devices and game consoles where there are constant attempts to steal the ownership from users. In the actual world they don't even enforce disk encryption right now and correct me if I'm wrong, but currently having your BitLocker "recovery code" is enough to decrypt the disk on another machine and changing that would be a massive issue for many data recovery processes. Unless they plan to do massive changes to the system this is very likely to not be a problem and cracking is likely to still be quite possible.