5 ms·

I suspect that the real reason for this change is to ensure that Windows gets updated even if the laptop is sleeping, and that this is a change that enterprise

I suspect that the real reason for this change is to ensure that Windows gets updated even if the laptop is sleeping, and that this is a change that enterprise customers have asked for. In the past where a computer would be connected to the corporate network all the time you could usually get Wake-on-LAN to work so you could boot computers at night to apply updates and ensure that users weren't waiting around forever. With laptops and people working remotely you need a new way to ensure that the bulk of the updates happen when they won't interfere with users trying to work - this is the solution. Microsoft may well tout additional potential benefits, but that's more about selling it to consumers so they don't complain about changes as much. And, of course, some manufacturers do a better job than others at implementing this. --I haven't had a problem with any of my Lenovo laptops or even the Surface laptop. Dell, on the other hand, doesn't seem to implement it well at all.

haspok 2y ago
My company laptop has sleep _disabled_, and all the caches, cookies, browsing history etc. are cleared when I log off or shut down. I guess this is due to security reasons. No updates while "sleeping" in my case.
- soco 2y ago
  Is there a security reason to disable sleep mode? Or just part of the user hassle some enterprise departments sell as "security"?
  - JonChesterfield 2y ago
    It's probably better to have a switched off laptop stolen than a suspended one
  - mananaysiempre 2y ago
    Cellebrite is built around that reason: USB/Thunderbolt stack vulnerabilities, etc., that allow the full-disk encryption key to be extracted out of the RAM of a running system. I believe iOS is capable of flushing most cleartext data on suspend until the passcode is reentered, so suspend should be as good as shutdown; I don’t know if macOS can do it. On desktop Linux it’s theoretically possible with systemd-homed, but in practice that needs desktop-environment support that’s as far as I know does not exist, so shutting down is more secure. I can’t remember anything about Android either way except for some features for disabling the USB port in some alternative firmware. On Windows with a typical TPM-only setup, powering off is probably just as bad as suspending, because just powering the machine back on is enough for it to helpfully unlock everything. If you do need to enter a BitLocker passphrase at boot, then you’re in the same situation as typical desktop Linux, so powering off is more secure.
    - newdee 2y ago
      On macOS you can use pmset with the DestroyFVKeyOnStandby option to ensure that FDE key is purged from RAM on sleep.
znpy 2y ago
> a change that enterprise customers have asked for "enterprise customers" have proper security policies and tooling to enforce them in place. My employer has a "small" utility that periodically checks for version of installed software and will warn me if I don't install the necessary updates. If I don't install updates for more then x days I'm cut off every network access to the corporate network, and I must first install the updates and then ask my manager to let me back in the corporate network (again, there's automated tooling for that). So this push for "always on" bullshit is not what enterprises asked for. Microsoft wants mac/ios/android-like experience, but just can't deliver such thing due to hardware fragmentation. I never understood why microsoft doesn't go full apple and only allows certain top-tier features on surface laptops or other hardware they own from top to bottom. If you're serious about software you can't underrate the role of hardware: Apple has clearly got this incredibly right, and it's a fundamental part of their value proposition.
- krelas 2y ago
  While I don’t disagree with you, if Microsoft started gating premium Windows features to their own hardware, both the US and EU would serve them the antitrust suit to end all antitrust suits.
  - znpy 2y ago
    Apple does that, gating the entire experience to their own hardware and I don't see much fuss. I guess Microsoft should go full-apple and allow microsoft windows ONLY on microsoft hardware?
- BlueTemplar 2y ago
  Yeah, including for Cortana to keep listening while on suspend (to audio, but also nearby networks... any data she can get her hands on).
prmoustache 2y ago
> I suspect that the real reason for this change is to ensure that Windows gets updated even if the laptop is sleeping, and that this is a change that enterprise customers have asked for. But you don't want that to happen when your laptop is in your backpack. It is bonkers that Microsoft and manufacturers both would remove the ability for the users to decide it is not a good idea to have an OS running. It effectively forces anyone to shutdown completely their laptops.

haspok 2y ago

My company laptop has sleep _disabled_, and all the caches, cookies, browsing history etc. are cleared when I log off or shut down. I guess this is due to security reasons. No updates while "sleeping" in my case.

soco 2y ago
Is there a security reason to disable sleep mode? Or just part of the user hassle some enterprise departments sell as "security"?
- JonChesterfield 2y ago
  It's probably better to have a switched off laptop stolen than a suspended one
- mananaysiempre 2y ago
  Cellebrite is built around that reason: USB/Thunderbolt stack vulnerabilities, etc., that allow the full-disk encryption key to be extracted out of the RAM of a running system. I believe iOS is capable of flushing most cleartext data on suspend until the passcode is reentered, so suspend should be as good as shutdown; I don’t know if macOS can do it. On desktop Linux it’s theoretically possible with systemd-homed, but in practice that needs desktop-environment support that’s as far as I know does not exist, so shutting down is more secure. I can’t remember anything about Android either way except for some features for disabling the USB port in some alternative firmware. On Windows with a typical TPM-only setup, powering off is probably just as bad as suspending, because just powering the machine back on is enough for it to helpfully unlock everything. If you do need to enter a BitLocker passphrase at boot, then you’re in the same situation as typical desktop Linux, so powering off is more secure.
  - newdee 2y ago
    On macOS you can use pmset with the DestroyFVKeyOnStandby option to ensure that FDE key is purged from RAM on sleep.

znpy 2y ago

> a change that enterprise customers have asked for "enterprise customers" have proper security policies and tooling to enforce them in place. My employer has a "small" utility that periodically checks for version of installed software and will warn me if I don't install the necessary updates. If I don't install updates for more then x days I'm cut off every network access to the corporate network, and I must first install the updates and then ask my manager to let me back in the corporate network (again, there's automated tooling for that). So this push for "always on" bullshit is not what enterprises asked for. Microsoft wants mac/ios/android-like experience, but just can't deliver such thing due to hardware fragmentation. I never understood why microsoft doesn't go full apple and only allows certain top-tier features on surface laptops or other hardware they own from top to bottom. If you're serious about software you can't underrate the role of hardware: Apple has clearly got this incredibly right, and it's a fundamental part of their value proposition.

krelas 2y ago
While I don’t disagree with you, if Microsoft started gating premium Windows features to their own hardware, both the US and EU would serve them the antitrust suit to end all antitrust suits.
- znpy 2y ago
  Apple does that, gating the entire experience to their own hardware and I don't see much fuss. I guess Microsoft should go full-apple and allow microsoft windows ONLY on microsoft hardware?
BlueTemplar 2y ago
Yeah, including for Cortana to keep listening while on suspend (to audio, but also nearby networks... any data she can get her hands on).

prmoustache 2y ago

> I suspect that the real reason for this change is to ensure that Windows gets updated even if the laptop is sleeping, and that this is a change that enterprise customers have asked for. But you don't want that to happen when your laptop is in your backpack. It is bonkers that Microsoft and manufacturers both would remove the ability for the users to decide it is not a good idea to have an OS running. It effectively forces anyone to shutdown completely their laptops.