3 ms·

> If you watch the video I linked I have in fact. It's a nice talk about security in Windows 11, but I haven't seen anything in it answering these issues. He s

> If you watch the video I linked I have in fact. It's a nice talk about security in Windows 11, but I haven't seen anything in it answering these issues. He says absolutely nothing about DCH and doesn't give any explanation for the minimum hardware requirements. The closest I recall was he was mentioned of integrating Pluton on chip and making its firmware directly updatable, but I don't believe for example that the 7820HQ and the 7700HQ are any different with regards to Pluton. > I'm not sure what you're getting at. DCH drivers were already the default for current-gen hardware _before_ W11 even came out, W11 just made it a requirement. No, they didn't even make DCH a requirement; Windows 11 runs with standard drivers too. [1] And, again, DCH doesn't imply anything about hardware security mitigations, which was purportedly their reason for this. > Note that you're still referencing a blog post from 2021. W11 22H2 enables core isolation by default for new installations, and HVCI is enabled by default when using the Windows Enterprise security baseline. Because the situation is fundamentally the same since 2021. Core isolation support is not a distinguishing feature between (say) the 7700HQ and 7820HQ, as far as I know. And the Windows Enterprise security baseline seems kind of irrelevant for the millions of average consumer devices out there. A company that cares about consumers or the environment is telling consumers across the planet to turn perfectly good devices into electronic trash now because they might add something that helps security years later? I'm going to let my comments rest here; people draw their own conclusions. [1] https://www.reddit.com/r/Windows11/comments/pr4kmr/why_is_windows_11_still_force_installing_the/hdgp8z0/ https://www.reddit.com/r/Windows11/comments/pr4kmr/why_is_wi...

Hawxy 3y ago
> He says absolutely nothing about DCH and doesn't give any explanation for the minimum hardware requirements The hardware security baseline is one of the first topics he covers as part of Windows 11 security strategy, with mention given to features that require hardware support and how they intend to enable these by default going forward as not doing so was a failure of the Windows 10 strategy. He even mentions "virtualization extensions" aka HVCI-related features which would be non-performant to enable by default in older hardware. How exactly would a strategy of enabled-by-default work if the hardware wasn't there to support it? You seem to be looking for some hard "gotcha" statement to refute your argument instead of considering all of the information available in front of you. > No, they didn't even make DCH a requirement; By setting the minimium CPU requirement to systems that use DCH drivers, they effectively did. > Core isolation support is not a distinguishing feature between (say) the 7700HQ and 7820HQ, as far as I know. That's not the issue here. The 7700HQ lacks Trusted Execution support (aka TPM), whilst it's included in the 7820HQ, thus it does not meet the minimum requirements. > electronic trash now because they might add something that helps security years later? No, it's giving people the heads up that Windows 11 security strategy requires these features and gives people & companies time to adapt. For example, motherboards now ship with TPM 2.0 enabled by default, so as Windows 11 rolls out more features that require it (some aspects of Windows Hello already do), users aren't stuck with a system that needs a BIOS update or are unable to use the new features. Windows 12 will very likely make these requirements hard-enforced rather than soft-enforced and thus it'll make the 11-to-12 upgrade a smoother experience.
- TeMPOraL 3y ago
  Is it time to bring up the old "TPM is a good thing for you only if you're holding the keys - which almost nobody on the non-enterprise level is, so it's actually bad for you" discussion? > How exactly would a strategy of enabled-by-default work if the hardware wasn't there to support it? You seem to be looking for some hard "gotcha" statement to refute your argument instead of considering all of the information available in front of you. I'd say the core issue here is of priorities. Microsoft may be treating aggressive enabled-by-default approach to security as a good thing. A lot of other people don't. If you don't, then the high-level summary of the issue is, essentially, "By making some relatively recent hardware features a requirement for Win11 in the name of sekhurity, while also aggressively pushing users to upgrade and actively preventing them from continuing to use Win10, they're forcing people to destroy perfectly good machines for bullshit reasons". I'm having hard time seeing fault in this view.
ablob 3y ago
DCH Drivers apparently consist of the following things [https://learn.microsoft.com/en-us/windows-hardware/drivers/develop/dch-principles-best-practices https://learn.microsoft.com/en-us/windows-hardware/drivers/d...]: Declarative: Install the driver by using only declarative INF directives. Don't include co-installers or RegisterDll functions. Componentized: Edition-specific, OEM-specific, and optional customizations to the driver are separate from the base driver package. As a result, the base driver, which provides only core device functionality, can be targeted, flighted, and serviced independently from the customizations. Hardware-support-app: Any user interface (UI) component associated with a Windows Driver must be packaged as a Hardware Support App (HSA) or preinstalled on the OEM device. The D and C parts of the description appear to be what you're looking for here. No special hooks or modifications of the system paired with independent modules.
Hawxy 3y ago
Just to follow up if anyone reads this far down, an interview with David Weston from Windows 11s release also validates what I've said in this comment chain: https://www.techrepublic.com/article/windows-11-understanding-the-system-requirements-and-the-security-benefits/ https://www.techrepublic.com/article/windows-11-understandin...

Hawxy 3y ago

> He says absolutely nothing about DCH and doesn't give any explanation for the minimum hardware requirements The hardware security baseline is one of the first topics he covers as part of Windows 11 security strategy, with mention given to features that require hardware support and how they intend to enable these by default going forward as not doing so was a failure of the Windows 10 strategy. He even mentions "virtualization extensions" aka HVCI-related features which would be non-performant to enable by default in older hardware. How exactly would a strategy of enabled-by-default work if the hardware wasn't there to support it? You seem to be looking for some hard "gotcha" statement to refute your argument instead of considering all of the information available in front of you. > No, they didn't even make DCH a requirement; By setting the minimium CPU requirement to systems that use DCH drivers, they effectively did. > Core isolation support is not a distinguishing feature between (say) the 7700HQ and 7820HQ, as far as I know. That's not the issue here. The 7700HQ lacks Trusted Execution support (aka TPM), whilst it's included in the 7820HQ, thus it does not meet the minimum requirements. > electronic trash now because they might add something that helps security years later? No, it's giving people the heads up that Windows 11 security strategy requires these features and gives people & companies time to adapt. For example, motherboards now ship with TPM 2.0 enabled by default, so as Windows 11 rolls out more features that require it (some aspects of Windows Hello already do), users aren't stuck with a system that needs a BIOS update or are unable to use the new features. Windows 12 will very likely make these requirements hard-enforced rather than soft-enforced and thus it'll make the 11-to-12 upgrade a smoother experience.

TeMPOraL 3y ago
Is it time to bring up the old "TPM is a good thing for you only if you're holding the keys - which almost nobody on the non-enterprise level is, so it's actually bad for you" discussion? > How exactly would a strategy of enabled-by-default work if the hardware wasn't there to support it? You seem to be looking for some hard "gotcha" statement to refute your argument instead of considering all of the information available in front of you. I'd say the core issue here is of priorities. Microsoft may be treating aggressive enabled-by-default approach to security as a good thing. A lot of other people don't. If you don't, then the high-level summary of the issue is, essentially, "By making some relatively recent hardware features a requirement for Win11 in the name of sekhurity, while also aggressively pushing users to upgrade and actively preventing them from continuing to use Win10, they're forcing people to destroy perfectly good machines for bullshit reasons". I'm having hard time seeing fault in this view.

ablob 3y ago

DCH Drivers apparently consist of the following things [https://learn.microsoft.com/en-us/windows-hardware/drivers/develop/dch-principles-best-practices https://learn.microsoft.com/en-us/windows-hardware/drivers/d...]: Declarative: Install the driver by using only declarative INF directives. Don't include co-installers or RegisterDll functions. Componentized: Edition-specific, OEM-specific, and optional customizations to the driver are separate from the base driver package. As a result, the base driver, which provides only core device functionality, can be targeted, flighted, and serviced independently from the customizations. Hardware-support-app: Any user interface (UI) component associated with a Windows Driver must be packaged as a Hardware Support App (HSA) or preinstalled on the OEM device. The D and C parts of the description appear to be what you're looking for here. No special hooks or modifications of the system paired with independent modules.

Hawxy 3y ago

Just to follow up if anyone reads this far down, an interview with David Weston from Windows 11s release also validates what I've said in this comment chain: https://www.techrepublic.com/article/windows-11-understanding-the-system-requirements-and-the-security-benefits/ https://www.techrepublic.com/article/windows-11-understandin...