5 ms·

>Instead, they made some arbitrary reason to deprecate "old" hardware The criteria was based on hardware mitigation support for Meltdown and Spectre patches. B

>Instead, they made some arbitrary reason to deprecate "old" hardware The criteria was based on hardware mitigation support for Meltdown and Spectre patches. Because at the time those vulnerabilities could be exploited by executing malicious javascript in a browser to steal passwords

CamperBob2 1y ago
Yeah, and I could be hit by a meteor the next time I step outside, or something that fell off a passing Boeing. The odds are about the same.
- ocdtrekkie 1y ago
  The theoretical security people have gone off the deep end. The idiots in charge of browsers have decided the entire internet should break every 47 days in case someone might get a private key to a certificate, even though that's basically never been the source of a security compromise ever. Meanwhile, advertising on the Edge start page and the top of Chrome search is the number one source of practical, working malware attacks. But those things make the browser companies money. I no longer think big tech security people are serious.
  - brians 1y ago
    Well, yes, but it’s much brighter over here beneath the streetlight.
  - observationist 1y ago
    It's justification for surveillance and adtech on the software side, and planned obsolescence on the hardware side. There's no disincentive that prioritizes sustainability, (actual) security, or function on the user side. The user is just a net input of data. The money comes from brokers (marketing firms and advertisers indirectly) and advertising buys. The product is the user data. The customers are companies and occasionally individuals acting as middlemen. Devices are increasingly tools to acquire data, with features being driven to the bare minimum a user will accept and still use. Nobody in tech seems to be serious except for the people driving the adtech and surveillance models. Nothing else makes as much profit, and it financially justifies enshittifying every other aspect of every other piece of hardware or software. Legislate protections of user data, and start nuking brokers and data collectors from orbit, and everything gets better. Until then, the only space that isn't continually and totally enshittified is open source, and/or markets and products new enough that quality still matters. Our choices are end adtech, or suffer.
  - immibis 1y ago
    The world wide web is one particular network. If you decide to copy stuff from the world wide web and use it for your own purposes, and the world wide web changes and your stuff breaks, that's on you. Does the world wide web still work? If so, the change was fine. See also the removal of the client certificate bit from Let's Encrypt certificates. Let's Encrypt issues certificates for web servers. What are you doing using one on a client? You should either do your own thing, or have an actual contract with Let's Encrypt for them to support whatever you're doing. Otherwise you have no right to complain about that.
silotis 1y ago
> Because at the time those vulnerabilities could be exploited by executing malicious javascript in a browser to steal passwords "could be" is doing a lot of work here. AFAIK there has never been a PoC or active exploit which actually exfiltrates sensitive data from a browser using these vulnerabilities. Anyways, browsers have long since implemented software mitigations. IIRC the real criteria for W11 support has to do with TPMs. Microsoft really wants to have secure boot on all Windows systems.
- nine_k 1y ago
  Spook.js was demonstrated to steal passwords from another tab by running innocent-looking JS via the Spectre vulnerability. https://www.spookjs.com/ https://www.spookjs.com/
  - deleted 1y ago
    [deleted]
Paianni 1y ago
Pretty much all CPUs from Bulldozer and Sandy Bridge onwards got microcode mitigations through 2018 and 2019. Just about everything older is definitely obsolete from an efficiency standpoint.
TiredOfLife 1y ago
BS. Microsoft provides a fully supported version of Windows 11 that doesn't have tpm requirement and works on all intel cpus starting from core i.
- CursedSilicon 1y ago
  Factually incorrect. Anything older than Sandy Bridge no longer works due to the lack of POPCNT instructions https://www.tomshardware.com/software/windows/microsoft-updates-windows-11-24h2-requirements-cpu-must-support-sse42-or-the-os-will-not-boot https://www.tomshardware.com/software/windows/microsoft-upda...
  - TiredOfLife 1y ago
    Factually incorrect. Nehalem first core i has support for sse4.2 and popcn

CamperBob2 1y ago

Yeah, and I could be hit by a meteor the next time I step outside, or something that fell off a passing Boeing. The odds are about the same.

ocdtrekkie 1y ago
The theoretical security people have gone off the deep end. The idiots in charge of browsers have decided the entire internet should break every 47 days in case someone might get a private key to a certificate, even though that's basically never been the source of a security compromise ever. Meanwhile, advertising on the Edge start page and the top of Chrome search is the number one source of practical, working malware attacks. But those things make the browser companies money. I no longer think big tech security people are serious.
- brians 1y ago
  Well, yes, but it’s much brighter over here beneath the streetlight.
- observationist 1y ago
  It's justification for surveillance and adtech on the software side, and planned obsolescence on the hardware side. There's no disincentive that prioritizes sustainability, (actual) security, or function on the user side. The user is just a net input of data. The money comes from brokers (marketing firms and advertisers indirectly) and advertising buys. The product is the user data. The customers are companies and occasionally individuals acting as middlemen. Devices are increasingly tools to acquire data, with features being driven to the bare minimum a user will accept and still use. Nobody in tech seems to be serious except for the people driving the adtech and surveillance models. Nothing else makes as much profit, and it financially justifies enshittifying every other aspect of every other piece of hardware or software. Legislate protections of user data, and start nuking brokers and data collectors from orbit, and everything gets better. Until then, the only space that isn't continually and totally enshittified is open source, and/or markets and products new enough that quality still matters. Our choices are end adtech, or suffer.
- immibis 1y ago
  The world wide web is one particular network. If you decide to copy stuff from the world wide web and use it for your own purposes, and the world wide web changes and your stuff breaks, that's on you. Does the world wide web still work? If so, the change was fine. See also the removal of the client certificate bit from Let's Encrypt certificates. Let's Encrypt issues certificates for web servers. What are you doing using one on a client? You should either do your own thing, or have an actual contract with Let's Encrypt for them to support whatever you're doing. Otherwise you have no right to complain about that.

silotis 1y ago

> Because at the time those vulnerabilities could be exploited by executing malicious javascript in a browser to steal passwords "could be" is doing a lot of work here. AFAIK there has never been a PoC or active exploit which actually exfiltrates sensitive data from a browser using these vulnerabilities. Anyways, browsers have long since implemented software mitigations. IIRC the real criteria for W11 support has to do with TPMs. Microsoft really wants to have secure boot on all Windows systems.

nine_k 1y ago
Spook.js was demonstrated to steal passwords from another tab by running innocent-looking JS via the Spectre vulnerability. https://www.spookjs.com/ https://www.spookjs.com/
- deleted 1y ago
  [deleted]

Paianni 1y ago

Pretty much all CPUs from Bulldozer and Sandy Bridge onwards got microcode mitigations through 2018 and 2019. Just about everything older is definitely obsolete from an efficiency standpoint.

TiredOfLife 1y ago

BS. Microsoft provides a fully supported version of Windows 11 that doesn't have tpm requirement and works on all intel cpus starting from core i.

CursedSilicon 1y ago
Factually incorrect. Anything older than Sandy Bridge no longer works due to the lack of POPCNT instructions https://www.tomshardware.com/software/windows/microsoft-updates-windows-11-24h2-requirements-cpu-must-support-sse42-or-the-os-will-not-boot https://www.tomshardware.com/software/windows/microsoft-upda...
- TiredOfLife 1y ago
  Factually incorrect. Nehalem first core i has support for sse4.2 and popcn