Hacker News Reader

Comment by techrat | Hacker News Reader

That CPU list was missing CPUs that were still being sold in new builds even less than 3 years ago. That's quite the severe cut off point.

My older box, an i7 4790k, is still quite the performer. It, however, has no secure boot capabilities. No TPM socket on the motherboard, even.

View on HN

> i7 4790k

This is what I run. It doesn't have firmware TPM according to Intel (https://ark.intel.com/content/www/us/en/ark/products/80807/i...), but the regular version does.

TPM >=1.2 is a hard requirement for Win11, and if your mobo doesn't have a socket for it, you're out in the cold.

So much for future-proofing.

On the other hand, 4 more years is a lot, and they'll probably continue to release security updates for a year or two past 10's EOL (like they have with Windows 7).

Man, even checking their official website makes me want to pull my hair out. Nowhere do they concretely mention either TPM or after some research what should be called TPP for intel. I can only guess that maybe they hide it behind yet another name (maybe Intel® Trusted Execution Technology ?) but the information on this is basically impossible to find on the internet at this point.

Uh... can you tell me eli5 what does TPM do that w11 needs it so bad? It it for DRM ?

Yes. It's to ensure Microsoft always have full control over the code running on your device, so eventually Microsoft can require all Windows apps to come from its store, and you won't be able to do anything about it; because the hardware TPM module will reject any attempts to modify it.

you mean in the same vein as the huge epic apple trial? nah. sideloading and app installing will be allowed due to fear of government action. the tpm can ensure system files are not malware infected tho

Just "upgraded" to a i7-6700 last year since I buy my computers used because I am cheap.

Is there any justification for the cutoff? It might be possible to just patch out the cpuid check and have the OS run.

If it's boot attestation someone will do it. This is probably to force enterprise vendors to move to devices that better support enterprise management, but yes, it drags us kicking and screaming along with it, at nontrivial personal expense.

There isn't any justification for the 6th to 7th to 8th gen of intel core, at all. They're the same CPUs, just faster/more cores.

According to Microsoft's security director, it's ARBITRARY.

https://twitter.com/dwizzzleMSFT/status/1408539533465985024

"Seems like you are assuming there is a specific security feature that defines 8th gen as the CPU floor. The floor is set for a range of quality, performance, support, and reliability reasons to ensure a great experience."

Oof. I'm starting to think there's a bit of old Intel CPU stock they want to make unsaleable.

If there's going to be a cutoff based on performance, having it almost unconnected to actual performance is pretty exasperating.

That sounds quite unreasonable. "You don't deserve to "experience" Windows 11, unless you can afford the newest computers. And if you can't, we won't let you have it. Because maybe it won't work perfectly. Even though you got your computer 4 years ago."

What else other than Intel’s marketing materials use “xth gen” notation? That itself suggests it’s a marketing ploy.

When they decide they don't want you as a customer any more woudn't you prefer it to be arbitrary rather than targeted specifically in your direction?

Especially considering that there are plenty of slower clocked Celerons on the list.

Not true. 7th gen gained Mode Based Execution Control which greatly decreases the overhead of VBS. 7th gen also gained SMM Security Mitigations 1.0 and some UEFI hardening.

TPM 2.0 is required. For DRM I assume.

Ryzen 1000 CPUs are still sold NIB on Amazon. It’s not even 3 years old, a lot of CPUs are basically current and plenty fast.

The list of supported Windows 10 CPUs doesn't even list my current CPU (Xeon E5-1680v2). I'm excited for the release but they've really bungled their messaging and scared people.

I have that CPU and I have secure boot. Pretty sure that's a motherboard feature

I think they're somewhat separate things.

I have an i7-3930k on some Asus MB and it has Secure Boot but no TPM. There's a header for it, but it's empty.

My understanding is that the SB keys are known and verified by the BIOS, not by the TPM.

The TPM is a mechanism to verify that the BIOS (among other things) hasn't changed from a known state. If it hasn't, the TPM will then release some key, for example to automatically decrypt the root partition at boot. I've also seen it used as a store for SSH keys.

This is how the default setup of BitLocker works. On my machine, I have to switch BitLocker to password mode, or type in the key at each boot.

Reply on news.ycombinator.com