The Reason for Windows 11 | Hacker News Reader

The Reason for Windows 11

computerworld.com

42 pointsCrankyBear53 comments

Most Windows malware I see today runs with the rights of the logged-on user. Encrypting file servers (at least portions thereof), exfiltrating data, and spreading via email are all easily accomplished with the rights available to a normal user. Without a privilege escalation exploit the attacker probably can't install a driver or spread to other user sessions on the same machine, but everything accessible to the logged-on user is accessible to the malware.

Without a capabilities-based security model I don't see what good the "for security" changes in Windows 11 really bring to the table for end user security. Capabilities-based security would be a major breaking change for legacy software anyway. More than likely, would just result in IT departments granting all capabilities to all legacy software.

The Windows 11 "security" seems more about removing general purpose computing access for "tinkering" end users to enable more draconian DRM, walled-garden type business models, etc.

I kind of agree. Cynically I see Windows 11 as a big leap for Microsoft in terms of getting to their own ChromeOS. Mandatory online accounts, integrated Teams, very dark patterns to force Edge usage (with all the associated tracking), pushing One Drive hard... all to get a totally surveilled, locked-in user dependent on their cloud services who is a rich source of data for advertising and a target for monthly service charges.

Based on the initial reactions I have a feeling this move can backfire. I don't believe most people with obsoleted hardware will switch to Linux - they'll be using Windows 10 for as long as they can, but I think some portion of them will consider a switch, at least on private machines. There is a limit of abuse you can tolerate.

There is a limit of abuse you can tolerate.

This is the exact belief that lots of people had with regard to the Windows 7 -> 10 migration. Turns out, when people feel like they don't really have a choice, they will tolerate a lot of abuse. In fact, I'm not sure that there is a limit to the amount as long as the abusers make sure to boil the frog slowly.

I don't see it backfiring much to be honest. I see a lot of people keeping Windows 10 as long as possible... until Microsoft pushes an update to their machines with increasingly annoying messages until they accept - a strategy they have already deployed successfully.

Defaults always win and laptop vendors will advertise Windows 11 as more secure. What choice do people have?

If anything, this may push a few people to Apple. If you are going to give up all your privacy and pay for services, why not choose the company with the best hardware and integrated and polished UIs?

I don't know about the switch to Apple. First, there is the sticker shock, which is no small issue. Also, have you seen Windows users attempt to use a Mac? They enjoy it about as much as Mac users enjoy Windows.

I used to think that too until I saw a family member dump Windows for Mac. iPhones are a hell of a gateway drug.

> I don't see it backfiring much to be honest. I see a lot of people keeping Windows 10 as long as possible... until Microsoft pushes an update to their machines with increasingly annoying messages until they accept - a strategy they have already deployed successfully.

At least they can't trick people into accepting upgrades this time.

> very dark patterns to force Edge usage

vs aggressive opt-out Chrome installers bundled in multiple popular apps like CCLeaner? Or endless pop-outs as soon as someone ends up on an alphabet-owned website?

Seriously, settings and files shared among devices (like on iOS) is a pretty great feature for the average consumer. I understand that Pro users that had filesync since DropBox launched in 2007 don't see the added value.

I don't see how Google's bad behaviour with Chrome installers excuses Microsoft in any way. Arguably Microsoft is still worse since they intentionally obfuscate system settings so even informed users have difficulty changing their browser settings (which 'sententiously' reset to Edge every so often).

I agree that file sharing is a great feature. I use One Drive every day. However Dropbox is not running an advertising network embedded in their OS nor are they placing ads in the default file explorer in an OS to upsell users on services.

A guaranteed TPM on all major computing platforms is kind of a big deal, since it is our best chance at making bearer tokens secure against theft by malware.

Given how long MS supports Windows, this is exactly the right time for this requirement.

I expect this will end with a web API for remote attestation. Several standards for remote attestation are in the works[1].

Servers will be able to check that you are running a popular walled-garden operating system that does not allow sideloading before delivering content to you. That way they can know that you are not running an ad blocker, you aren't able store the video stream, etc. Something similar already exists with Widevine certification levels[2].

It won't matter that you have open source hardware and OS that can run any code, you won't be able to access most mainstream content with it. Devices allowing general computation will be useless to most people and thus be relegated to a small enthusiast niche.

I am disappointed by how little skepticism there is on this and how all tech media I've seen simply regurgitate the "TPM == 60% less malware, nothing nefarious going on here" claim.

[1] https://tools.ietf.org/wg/rats/

[2] https://technicaljayendra.com/widevine/#Widevine_Certificati...

I hate the tech industry so much now. Almost everything I love about computers is being taken away and replaced with pay-per-use subscription-based watered-down facsimiles of the cool stuff that general purpose computers can do.

>Apple requires new hardware so they can vertical integrate and save money

"This is great, Intel suxxxx"

>Microsoft requires a hardware upgrade for security

"This is bad news"

No idea what causes the human brain to rationalize corporate choices, but Apple gets apologies and praise. Microsoft/Google gets hate.

Maybe I'm a negative Nancy and negatively respond to everything, but I don't think I've ever seen people defend a Google or Microsoft choice. Brand loyalty is quite a psychology trick. I think we should praise Google and Microsoft for not hacking our brains.

Well "Think Different" certainly happened :/

These are probably different people praising and complaining. It could be that some people use Windows because of it's track record of backwards compatibility and this is an unwelcome change. It is not necessarily brand loyalty, it could simply be brand expectations.

Apple has always been somewhat of a walled garden. Google/Microsoft have not. So when they make moves to put up walls, people get upset. Meanwhile, apple gets a pass because "well, they already have security requirements that prevent me from doing stuff".

From looking at previous discussion on this here, in no way shape or form do they get a pass. Quite right too.

"Walled garden" is marketing speak for "walled prison".

to my mind, what sucks about Microsoft's 'hardware upgrade' is that it will drive the entire PC industry to build hardware that has a proprietary Microsoft lock on it. Secure Boot is not an open standard, it is a Microsoft owned and controlled lock. I have already run into enterprise grade machines that forced secure boot, making them useless in our organization. I haven't found any info on the 11 logo certification, but for 8.1 they required it and required that it not be able to be turned off. I'm all for increased security, but I'm also for general purpose computing. If I buy a machine with a particular instruction set, I should be able to some way execute any code I want on that computer. Same goes for Apple, though to be fair, it is possible to execute any code I want on an M1 Mac, I would just have to essentially reverse engineer the hell out of everything. And yes Apple should provide at least a basic level of documentation for targeting their hardware and they do not. I am a slightly more charitable to their position because they brought brand new capability to market-- Microsoft is just corralling the vendors into tacking their propriety firmware lock onto the same technology stack. If this was a chip manufacturer initiative, say AMD wants to bring new capabilities and security by only accepting signed OS builds I would be far more receptive to that position, so long as there was a reasonable, accessible and equitable path for getting your builds signed.

Google hacks our brains all the time with the youtube algorithm. Until Win10 you could say that Microsoft, like Apple now, makes its money directly on their products, but with Win10 and all the telemetry there, plus the fact that it is a free upgrade that is no longer the case.

Plenty of choices has been defended on behalf of Microsoft (frequently because people realize that they had to make those choices based on the absolute requirement of backwards compatibility), and plenty of people have defended Googles choices.

But the only company that you mentioned who do not hack our brains today is Apple.

80% of people simply use Windows and don't complain that much. The other 10%+ are simply brainwashed by Apple marketing. If somebody believes there is another fitting explanation, I'd like to hear it.

I'm against both, it's just harder to avoid the results of Microsoft's decisions.

because Microsoft's requirement seems to come out of nowhere for a piece of thing nobody knows or gives a shit about TPM wtf is that?

apple new OS still works on very old machine, even intel one, they know how to "transition"

something microsoft seems to suck at, they are stuck with their legacy bullshit after all

> apple new OS still works on very old machine

Very old Apple machine maybe.

> TPM wtf is that?

Something of great value in the area of security. Generally a good thing to have, and so also a good idea for MS to want.

> apple .. know how to "transition"

I've just sold my M1 Air, and an updated ThinkPad is out for delivery. That's after nearly two decades of being a Mac user (alongside Windows and Linux).

And it is because of the Apple transitions (well that, plus even the latest [fixed] keyboards are only half as good as a ThinkPad).

First the then-latest OS (about a year ago; I can't remember exactly) made all my 32 bit games and applications effectively unusable, so I started collecting 64 bit ones instead. At which point we got the M1 to put x64 on life support too.

That's two rounds of lost software in a couple of years.

(Before anyone says it, I know about Rosetta 2. My M1 Air did indeed run x64 software - faster in fact that my Intel machine did. But I also know from Rosetta 1 days [PowerPC/Intel] that decent support for the deprecated architecture is probably to be measured in low single digit years.)

Well, it's all about tradeoffs. I've also used Thinkpads, and yes, you might get a better keyboard and all the freedom in the world, but you also get a much, much worse trackpad, a not half as good screen, worse durability, worse battery, a terrible webcam, etc.... windows is not any better than MacOS by any metric, and Linux, well, good luck setting up your screens, gestures, suspends might work or not depending on distrubution.

Nothing is perfect... not even thinkpads... and the tradeoffs imho are not worth it.

It is indeed about trade-offs, you're right.

I've been running Macs (alongside Windows/Linux) since the first Intel ones many years ago, and have owned the M1 Mac too. They are great machines, but the general (often automatically accepted) assumption that Macs are better hardware is a little annoying (and I do mean general; this is not aimed at your comment).

* The ThinkPad does have a worse trackpad and battery. However the battery is replaceable, which compensates quite nicely.

* It doesn't have a worse webcam at all; it's a fairly common complaint that the Mac has a very basic webcam.

* Macs are durable, more so than almost all Windows laptops. Many ThinkPads do better in that regard, though - usually the chunky ones that I go for, so I accept there is a trade-off there as to get equivalent durability I sacrifice on the form factor.

* The trackpad is indeed worse (it is good enough, but still a trade-off).

* The screen isn't worse (assuming you choose a decent ThinkPad). It is dimmer, but conversely unlike the Mac I can use my matte ThinkPad display in direct sunlight.

* Windows (for me) is far more conducive to keyboard jockeys than Mac OS, and is far more accomodating for accessibility.

All of which means that personally I saw the M1 Mac as the compromise, in that I sacrificed the better keyboard, screen, expandability, webcam, durability, backwards compatibility, and accessibility, all to get a longer battery life. Not a price worth paying.

I don't disagree with the author, but Microsoft-defined and -controlled security is also a step forward into a bland world of locked-in devices controlled by a third party, not something you really own. And that's good as it will help people to think a bit about their priorities.

What was unthinkable two decades ago, today is quite easy: because of the paradigm change from desktop to web apps, switching to Linux is not a sacrifice but a feasible operation, with the difficulty level related to the kind of hardware you own - and fortunately most hardware obsoleted by Windows 11 is quite well supported by Linux.

Mandatory Microsoft accounts also mean a concrete, cross platform identity for advertising/tracking and an account to drive One Drive/Office/cloud services purchases (already heavily advertised throughout the OS in the case of One Drive).

My "ah ha" moment for why they're shitting up their OS with ads was when I discovered my uncle had managed to follow their prompts to the point of paying for One Drive, but had no idea what it was or how to use it (in fact, he was confused how some of his files were becoming "lost"). He just thought it was "something he needed".

[EDIT] which is to say, they're joining Google (ads inline with results—watch a non-geek use Google some time) and Amazon (just... the whole store) with a scamming-the-unsaavy business model.

I've had to set aside several hours to set up family members Windows laptops for that reason. It's crazy to have to jump through hoops to get an offline account, battle the OS to use their browser of choice (possibly reverted by future updates) and download random scripts from GitHub to remove advertising, confusing trialware and random games from the default install - and that's before you get to the laptop vendor software.

Buying a Windows laptop is a horrible decision.

I always recommend people to buy either a Windows desktop or a Mac laptop.

Yet everyone wants a "gaming laptop" for some reason. Possibly the worst option you could buy.

My first thought, upon hearing that Windows 11 was coming, was that they were finally doing something to take ARM-compatibility seriously, so they could compete with Apple's M1. I still haven't heard anything that indicates this will be the case though.

ARM64 support?

Maybe they're relying on Android app support on ARM devises to make up the short-fall in native Windows applications.

It certainly will increase the program category, and they can advertise Windows tablets as "Android Tablets++."

They introduced a new abi for arm that seems to be compatible with emulated x86_64. Maybe trying a WOW64 but for ARM?

Xbox gaming needs hardware level security to run in Windows. Big money. That's reason alone to do this.

Android support needed linux. This is part of the reason for WSL. That and lessening the need for enterprises to gain experience with bare metal linux to get access to the open source goodies.

Finally, mandating hardware security is a breaking upgrade in this case. Everyone expects these major changes to require a version bump. The confusion around windows 10 if there were two significant varieties would be incredibly fragmenting, not to mention, just frustrating.

Somewhere in there is the real reason.

It's much easier to state that HW is "Windows 11 ready" vs saying something like HW is "Windows 10 build 2110 ready"

Nope. I have an ultrabook from about 10 years back, that runs Win7. I used to have both Windows and Linux on it. But I have just recently converted it back to Windows only. With a mere 128 gig SSD, it is sufficiently large for any Windows work that needs doing (Very, very little, these days) and Win7 was the last version with any quality.

That allows me to remove Windows 10 completely from my newer Lenovo P53 laptop and allow Linux to spread over the whole 5TB of SSDs.

> because most of us will need to buy new PCs to make it work.

Stopped reading at the headline. Some hyperbole I tolerate, but this one has gone way too far.

The real reason for Windows 11 is that they could finally drop the Internet Explorer 11 GUI.

The what?

Since Windows 10 RTM they have, in subsequent releases, removed (not just deprecated):

- Hardware support, such as AGP or older CPUs including some Atoms

- Feature support such as Briefcases, SMB1, HomeGroup, PNRP, Windows To Go

- Applications shipped with the OS such as Games Explorer, Outlook Express, and other apps like Reader they even introduced with 10 and later discontinued completely.

But more importantly than all the above - they already did exactly this with the legacy Edge to Chromium based Edge conversion in 10. Very similarly the backend webview stuff based on Edge is still there but the legacy browser UI is inaccessible.

The article is probably spot on if there is a technical reason to blame instead of pure marketing. Things deprecrate and get removed completely without needing to rename the OS these days, things also get added, but not on the scale the hardware requirements change the security baseline imposes. It's easy to explain to a few folks with Atoms from the mid to late 2000s that the next Windows 10 update won't work but the number of users impacted by the hardware requirements for 11 is many orders of magnitude greater on top of being harder to explain. Calling it a new OS completely is the only feasible way to crack that transition explanation.

Windows 11 allows you to install IE11, just have to add it as an Apps & Feature -> Optional Feature.

Plus the Win32 WebBrowser control and similar still heavily rely on IE11's engine for the foreseeable future.

These instructions are accurate for 10 but on 11 it'd just be under "Apps" not "Apps and Features" anymore and the only option available in Optional Features now is "Internet Explorer Mode" which is a view mode in Edge and does not bring back iexplore.exe.

Microsoft.com seems to agree with the empirical result above: "Internet Explorer is disabled. Microsoft Edge is the recommended replacement and includes IE Mode which may be useful in certain scenarios." https://www.microsoft.com/en-us/windows/windows-11-specifica...

The backend for app compatibility isn't going anywhere though just the browser frontend.

macOs went to 11.

Mac OS (speaking as a two-decade Mac user) still needs a third party tool just to expand or snap windows properly. And its accessibility options are poor.

Security is a good reason.

It is a great reason but could be optional for less powerful setups and a must for new ones.

I can imagine the flak Microsoft would be getting for letting weaker machines unsecured.

well, it is already unsecured now by Windows 11 standards

and if it, you know, actually mitigated the most common threat vectors (that all run in userland and microsoft does next to nothing to effectively stop) like ransomware.

Reply on news.ycombinator.com