8 ms·

If you run Windows on your computer, it's not your computer, and you have to comply with whatever Microsoft says or does. In this case, Windows 10 will continu

If you run Windows on your computer, it's not your computer, and you have to comply with whatever Microsoft says or does. In this case, Windows 10 will continue to run on your computer perfectly fine. Microsoft are not changing anything about Windows 10, or the way people use Windows 10, or removing any Windows 10 'ownership' that people have right now. The complaints are that Windows 11 has additional requirements (a modern CPU with a TMP 2.0 chip), and that older computers don't have that. Essentially people are sad that they can't upgrade because their computers don't meet the minimum spec. TMP (https://en.wikipedia.org/wiki/Trusted_Platform_Module https://en.wikipedia.org/wiki/Trusted_Platform_Module) is a bit controversial, but you can run Windows without it. Just not Windows 11.

raxxorrax 5y ago
They enforce secure boot. Many vendors only have the MS CA implemented to check OS integrity. So you would have to get your OS certified by Microsoft...
- josteink 5y ago
  Almost all mainstream Linux distros can OOB do UEFI secure boot through a MS-signed shim, or Grub signed by Canonical or Fedora (which is a trusted cert by the MS cert). Secure boot does not prevent a user from installing Linux. That’s just FUD.
  - raxxorrax 5y ago
    I don't think making people aware of the logistic problems of having to sign you OS at Microsoft in most practical cases is FUD. Secure boot or TPM can make sense for the cloud, since you might want to check if the provider changed your OS. MS used ransomware to justify secure boot. That is FUD. Boot and Bios trojans have become extremely rare and it doesn't provide enough protection anyway. This is for vendor lock in and nothing else.
  - zo1 5y ago
    It may be FUD, but people's concerns are valid. This is clearly another stepping-stone in the direction of removing control of the hardware/computer away from the user (under the guise of Trust, Safety, Privacy and Security). We just don't yet see the bigger, long term end state. But if you ask me, "they" essentially want an un-tamperable and un-recordable pipe between hosted server and the monitor that emits electrons to your eyeballs.
- usr1106 5y ago
  >Many vendors only have the MS CA implemented to check OS integrity Secure boot was introduced for Windows 8, ages ago. Microsoft and PC vendors promised that on all Intel PCs the user can install their own certificates. I have not heard that this would have changed. So the problem affects only ARM PCs, which aren't particularly common. As a Linux user I use secure boot. On some machines with big distros that have shims signed by Microsoft. On others with Arch or Yocto with my own keys.
  - raxxorrax 5y ago
    Wouldn't your own keys stop working with mechanism like remote attestation? From a security standpoint secure boot is hard to justify to be honest. When did you encounter the last boot or bias trojan? Sure, large distros are signed by Microsoft. Do I want that? They also complained that it takes quite a long time.... Where is the benefit for the user?
    - usr1106 5y ago
      Who uses remote attestation for what purpose? I have never used it. Secure boot is simple and lightweight. Should I just wait until some damage happens? I agree it's not the most critical measure. I have at least one machine where it doesn't work and many where initramfs remains unchecked. Have not lost my sleep yet.
- buran77 5y ago
  They enforce Secure Boot on Windows 11. It was always a requirement on Windows 8 and 10 but never actually enforced. There's nothing to stop you from using Windows 10 or Linux on your hardware unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11.
  - tpxl 5y ago
    > unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11. They didn't force OEMs, but some devices can only run Windows 8.1 with no ability to turn Secure boot off. > ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system.
- noxer 5y ago
  Can people stop already. Its NOT true. Windows 11 runs perfectly fine without. There is no enforcement at all. All the hardware checks are in the setup/installer which is not needed its just one way to install the OS and ofc it can be circumvented easily if someone really wants the installer/update experience for some reason. Same for TPM. Not even TPM 1.2 is enforced and that was a requirement for windows 10 already. For lazy people with win10 already installed use https://github.com/ArkaneDev/WinPass11 https://github.com/ArkaneDev/WinPass11
  - EVa5I7bHFq9mnYK 5y ago
    I looked at the code - it downloads a .reg file from the web and modifies your registry with the content of that .reg file in admin mode. At the moment that .reg file modifies the registry to allow bypassing TPM checks, but at any future time the author can replace that .reg file with something malicious. I wouldn't download that program.
    - noxer 5y ago
      I'm aware of that. It also loads a DLL from windows10 installer. I assume it intentional so the files can be updated if MS would add more checks. It's open source for a reason.
marctrem 5y ago
There are also privacy implications related to using a TPM. https://www.cs.auckland.ac.nz/courses/compsci725s2c/archive/termpapers/skim.pdf https://www.cs.auckland.ac.nz/courses/compsci725s2c/archive/...
suby 5y ago
> In this case, Windows 10 will continue to run on your computer perfectly fine. Microsoft are not changing anything about Windows 10, or the way people use Windows 10, or removing any Windows 10 'ownership' that people have right now. This isn't exactly comforting or acceptable. Windows 10 will stop receiving security updates in what, 5 years? I have a desktop computer from 2014 that I use daily, there is absolutely nothing wrong with it. The amount of (unnecessary) ewaste Microsoft will create by going through with this decision is staggering.
- sundvor 5y ago
  Ditto. Build high end computers and they'll last a decade or longer, at least since ~2011.
  - typh00n 5y ago
    Yes. Me and my father are daily driving PCs from 2007, because they are fine for what we do.
- buran77 5y ago
  MS is between a rock and a hard place when it comes to security and legacy support but I still think they approached this the wrong way. Windows is both the most popular PC OS and a huge target because of that legacy baggage they're been carrying around for years. On the other hand every other device on the market now (mobile phone, tablets, everything Apple) are almost completely locked down from the user's perspective so MS probably feels they are safe in joining the rest of the world in tying the user's hands. I understand the move towards better security but they should also consider extending Windows 10 support beyond the current end of 2025 deadline, given the harsh requirements for upgrade. You could buy a brand new MS device today and see it turn into an unsupported paperweight in just 4 years. The security pros for Secure Boot shouldn't come at the cost of millions of useless and unsupported PCs so early in their (historically long) lifecycle.
  - propertymagnate 5y ago
    That's not security for the consumer, that's security for their business model and being able to force the consumer in to a walled garden.
KronisLV 5y ago
Although things might be different with Windows 10 and 11, people have had plenty of bad experiences with the previous versions. For example, if we change the version number, we get a slightly different picture: "...Windows 7 will continue to run on your computer perfectly fine. Microsoft are not changing anything about Windows 7, or the way people use Windows 7, or removing any Windows 7 'ownership' that people have right now." Remember Windows 7 having constant nag screens in it to upgrade? Remember Microsoft pushing their godawful Metro design, alongside a lack of a proper Start menu, before that was patched out? Remember people discovering that their OSes had forcefully upgraded after leaving their computers unattended for a while? Given all of that, a bit of distrust is to be expected.
pmlnr 5y ago
> Microsoft are not changing anything about Windows 10 You haven't been doing this long enough if you believe that.
flohofwoe 5y ago
> In this case, Windows 10 will continue to run on your computer perfectly fine. Has it been confirmed anywhere that Win10 installations won't be automatically updated to Win11? Given the automatic nature of Win10 updates I'd expect that I'm waking up one morning, and be greeted by Win11 on my gaming PC (and since Win11 is just a marketing name for what's normally a Win10 feature update, this is most likely to happen, at least for Win10 Home users).
- vbezhenar 5y ago
  I might be wrong but I don't think that Win10 even updates itself to new releases. I stayed on Win10 of 2017 year for 3 years. Of course it was receiving updates and there was option for major update, but it never forced me to do so.
  - josefx 5y ago
    The rollout of Windows 10 itself contradicts that. Silently switching from opt in to opt out prompts, so people trained over months to click away the Windows 10 adware spam would suddenly find themselves with a Windows 10 installation.
- kyriakos 5y ago
  Obviously an unsupported pc will not auto update to Windows 11.
  - saati 5y ago
    But they did exactly this before, upgrading unsupported win7 machines to an unusable win10.
  - flohofwoe 5y ago
    Yeah obviously, but I have a supported PC and don't want to update to Win11 either :)

raxxorrax 5y ago

They enforce secure boot. Many vendors only have the MS CA implemented to check OS integrity. So you would have to get your OS certified by Microsoft...

josteink 5y ago
Almost all mainstream Linux distros can OOB do UEFI secure boot through a MS-signed shim, or Grub signed by Canonical or Fedora (which is a trusted cert by the MS cert). Secure boot does not prevent a user from installing Linux. That’s just FUD.
- raxxorrax 5y ago
  I don't think making people aware of the logistic problems of having to sign you OS at Microsoft in most practical cases is FUD. Secure boot or TPM can make sense for the cloud, since you might want to check if the provider changed your OS. MS used ransomware to justify secure boot. That is FUD. Boot and Bios trojans have become extremely rare and it doesn't provide enough protection anyway. This is for vendor lock in and nothing else.
- zo1 5y ago
  It may be FUD, but people's concerns are valid. This is clearly another stepping-stone in the direction of removing control of the hardware/computer away from the user (under the guise of Trust, Safety, Privacy and Security). We just don't yet see the bigger, long term end state. But if you ask me, "they" essentially want an un-tamperable and un-recordable pipe between hosted server and the monitor that emits electrons to your eyeballs.
usr1106 5y ago
>Many vendors only have the MS CA implemented to check OS integrity Secure boot was introduced for Windows 8, ages ago. Microsoft and PC vendors promised that on all Intel PCs the user can install their own certificates. I have not heard that this would have changed. So the problem affects only ARM PCs, which aren't particularly common. As a Linux user I use secure boot. On some machines with big distros that have shims signed by Microsoft. On others with Arch or Yocto with my own keys.
- raxxorrax 5y ago
  Wouldn't your own keys stop working with mechanism like remote attestation? From a security standpoint secure boot is hard to justify to be honest. When did you encounter the last boot or bias trojan? Sure, large distros are signed by Microsoft. Do I want that? They also complained that it takes quite a long time.... Where is the benefit for the user?
  - usr1106 5y ago
    Who uses remote attestation for what purpose? I have never used it. Secure boot is simple and lightweight. Should I just wait until some damage happens? I agree it's not the most critical measure. I have at least one machine where it doesn't work and many where initramfs remains unchecked. Have not lost my sleep yet.
buran77 5y ago
They enforce Secure Boot on Windows 11. It was always a requirement on Windows 8 and 10 but never actually enforced. There's nothing to stop you from using Windows 10 or Linux on your hardware unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11.
- tpxl 5y ago
  > unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11. They didn't force OEMs, but some devices can only run Windows 8.1 with no ability to turn Secure boot off. > ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system.
noxer 5y ago
Can people stop already. Its NOT true. Windows 11 runs perfectly fine without. There is no enforcement at all. All the hardware checks are in the setup/installer which is not needed its just one way to install the OS and ofc it can be circumvented easily if someone really wants the installer/update experience for some reason. Same for TPM. Not even TPM 1.2 is enforced and that was a requirement for windows 10 already. For lazy people with win10 already installed use https://github.com/ArkaneDev/WinPass11 https://github.com/ArkaneDev/WinPass11
- EVa5I7bHFq9mnYK 5y ago
  I looked at the code - it downloads a .reg file from the web and modifies your registry with the content of that .reg file in admin mode. At the moment that .reg file modifies the registry to allow bypassing TPM checks, but at any future time the author can replace that .reg file with something malicious. I wouldn't download that program.
  - noxer 5y ago
    I'm aware of that. It also loads a DLL from windows10 installer. I assume it intentional so the files can be updated if MS would add more checks. It's open source for a reason.

marctrem 5y ago

There are also privacy implications related to using a TPM. https://www.cs.auckland.ac.nz/courses/compsci725s2c/archive/termpapers/skim.pdf https://www.cs.auckland.ac.nz/courses/compsci725s2c/archive/...

suby 5y ago

> In this case, Windows 10 will continue to run on your computer perfectly fine. Microsoft are not changing anything about Windows 10, or the way people use Windows 10, or removing any Windows 10 'ownership' that people have right now. This isn't exactly comforting or acceptable. Windows 10 will stop receiving security updates in what, 5 years? I have a desktop computer from 2014 that I use daily, there is absolutely nothing wrong with it. The amount of (unnecessary) ewaste Microsoft will create by going through with this decision is staggering.

sundvor 5y ago
Ditto. Build high end computers and they'll last a decade or longer, at least since ~2011.
- typh00n 5y ago
  Yes. Me and my father are daily driving PCs from 2007, because they are fine for what we do.
buran77 5y ago
MS is between a rock and a hard place when it comes to security and legacy support but I still think they approached this the wrong way. Windows is both the most popular PC OS and a huge target because of that legacy baggage they're been carrying around for years. On the other hand every other device on the market now (mobile phone, tablets, everything Apple) are almost completely locked down from the user's perspective so MS probably feels they are safe in joining the rest of the world in tying the user's hands. I understand the move towards better security but they should also consider extending Windows 10 support beyond the current end of 2025 deadline, given the harsh requirements for upgrade. You could buy a brand new MS device today and see it turn into an unsupported paperweight in just 4 years. The security pros for Secure Boot shouldn't come at the cost of millions of useless and unsupported PCs so early in their (historically long) lifecycle.
- propertymagnate 5y ago
  That's not security for the consumer, that's security for their business model and being able to force the consumer in to a walled garden.

KronisLV 5y ago

Although things might be different with Windows 10 and 11, people have had plenty of bad experiences with the previous versions. For example, if we change the version number, we get a slightly different picture: "...Windows 7 will continue to run on your computer perfectly fine. Microsoft are not changing anything about Windows 7, or the way people use Windows 7, or removing any Windows 7 'ownership' that people have right now." Remember Windows 7 having constant nag screens in it to upgrade? Remember Microsoft pushing their godawful Metro design, alongside a lack of a proper Start menu, before that was patched out? Remember people discovering that their OSes had forcefully upgraded after leaving their computers unattended for a while? Given all of that, a bit of distrust is to be expected.

pmlnr 5y ago

> Microsoft are not changing anything about Windows 10 You haven't been doing this long enough if you believe that.

flohofwoe 5y ago

> In this case, Windows 10 will continue to run on your computer perfectly fine. Has it been confirmed anywhere that Win10 installations won't be automatically updated to Win11? Given the automatic nature of Win10 updates I'd expect that I'm waking up one morning, and be greeted by Win11 on my gaming PC (and since Win11 is just a marketing name for what's normally a Win10 feature update, this is most likely to happen, at least for Win10 Home users).

vbezhenar 5y ago
I might be wrong but I don't think that Win10 even updates itself to new releases. I stayed on Win10 of 2017 year for 3 years. Of course it was receiving updates and there was option for major update, but it never forced me to do so.
- josefx 5y ago
  The rollout of Windows 10 itself contradicts that. Silently switching from opt in to opt out prompts, so people trained over months to click away the Windows 10 adware spam would suddenly find themselves with a Windows 10 installation.
kyriakos 5y ago
Obviously an unsupported pc will not auto update to Windows 11.
- saati 5y ago
  But they did exactly this before, upgrading unsupported win7 machines to an unusable win10.
- flohofwoe 5y ago
  Yeah obviously, but I have a supported PC and don't want to update to Win11 either :)