Hacker News Reader

Comment by onion2k | Hacker News Reader

If you run Windows on your computer, it's not your computer, and you have to comply with whatever Microsoft says or does.

In this case, Windows 10 will continue to run on your computer perfectly fine. Microsoft are not changing anything about Windows 10, or the way people use Windows 10, or removing any Windows 10 'ownership' that people have right now.

The complaints are that Windows 11 has additional requirements (a modern CPU with a TMP 2.0 chip), and that older computers don't have that. Essentially people are sad that they can't upgrade because their computers don't meet the minimum spec. TMP (https://en.wikipedia.org/wiki/Trusted_Platform_Module) is a bit controversial, but you can run Windows without it. Just not Windows 11.

View on HN

Although things might be different with Windows 10 and 11, people have had plenty of bad experiences with the previous versions.

For example, if we change the version number, we get a slightly different picture: "...Windows 7 will continue to run on your computer perfectly fine. Microsoft are not changing anything about Windows 7, or the way people use Windows 7, or removing any Windows 7 'ownership' that people have right now."

Remember Windows 7 having constant nag screens in it to upgrade? Remember Microsoft pushing their godawful Metro design, alongside a lack of a proper Start menu, before that was patched out? Remember people discovering that their OSes had forcefully upgraded after leaving their computers unattended for a while?

Given all of that, a bit of distrust is to be expected.

> In this case, Windows 10 will continue to run on your computer perfectly fine. Microsoft are not changing anything about Windows 10, or the way people use Windows 10, or removing any Windows 10 'ownership' that people have right now.

This isn't exactly comforting or acceptable. Windows 10 will stop receiving security updates in what, 5 years? I have a desktop computer from 2014 that I use daily, there is absolutely nothing wrong with it. The amount of (unnecessary) ewaste Microsoft will create by going through with this decision is staggering.

Ditto. Build high end computers and they'll last a decade or longer, at least since ~2011.

Yes. Me and my father are daily driving PCs from 2007, because they are fine for what we do.

MS is between a rock and a hard place when it comes to security and legacy support but I still think they approached this the wrong way. Windows is both the most popular PC OS and a huge target because of that legacy baggage they're been carrying around for years.

On the other hand every other device on the market now (mobile phone, tablets, everything Apple) are almost completely locked down from the user's perspective so MS probably feels they are safe in joining the rest of the world in tying the user's hands.

I understand the move towards better security but they should also consider extending Windows 10 support beyond the current end of 2025 deadline, given the harsh requirements for upgrade. You could buy a brand new MS device today and see it turn into an unsupported paperweight in just 4 years. The security pros for Secure Boot shouldn't come at the cost of millions of useless and unsupported PCs so early in their (historically long) lifecycle.

That's not security for the consumer, that's security for their business model and being able to force the consumer in to a walled garden.

I bet they'll allow Windows 11 upgrade for all computers, when Windows 10 will stop receiving updates. They just want to force manufacturers to make all motherboards with TPM 2.0. There's no technical reasons to forbid those upgrades, just political ones.

Not so sure, the future of the computer is being a client on a corporate controlled network. TPM is necessary to allow or ban clients on such network.

I'm probably not as technical as the average HN commenter so maybe you can fill me in...

I've had personal computers for years and none of them have been on corporate networks so I don't see how MS should care about me in that - and for actual businesses aren't their hardware turnaround times generally less than 5 years? Is this all worth it to shave off that 1%?

Corporate network = cloud.

Cloud account, cloud storage, cloud applications, cloud content, cloud security, cloud messaging, cloud meeting, cloud moderation.

Everything will be in the cloud and connected with a subscription, paid or with ads.

Your computer will only be client connected to those services, and just as users getting banned from different internet services by breaking the user agreement, you will be banned from your computer for breaking the user agreement. The distinction between the computer and the internet services will be very fuzzy because they will be intertwined.

Also read this https://news.ycombinator.com/item?id=28059074

Also known as embrace the timesharing terminal.

Microsoft insisted that Win10 was their last Windows OS; that it would be the current OS, and continue to receive updates, in perpetuity. I for one have relied on that declaration.

Doesn't that count as deceptive marketing? I mean, the timespan between Win10 and Win11 is comparable to the timespan between Win8 and Win10. Does Microsoft lack a corporate memory? Have they said anything about this discrepancy between their forward-looking announcements and their actual behaviour?

Do they think it doesn't matter what BS they spin to their prospective customers?

Your pc is 7 years old today and windows 10 will receive updates for another 4 years, that's 11 years, and you can keep using it after but without security updates (which I think Microsoft will eventually give in and extend them longer). 11 years (or possibly more is a good lifetime for a pc considering people now change cars more often than that)

> Your pc is 7 years old today and windows 10 will receive updates for another 4 years, that's 11 years, and you can keep using it after but without security updates (which I think Microsoft will eventually give in and extend them longer). 11 years (or possibly more is a good lifetime for a pc considering people now change cars more often than that)

To go through your points, people are still buying new computers today which Windows 11 will not support, so we're looking at a 5 year life cycle for that hardware if those users do not do something like switch to Linux, which we know most people will not.

Using a PC which is no longer receiving security updates is a terrible idea if it's connected to the internet. Continuing to use the device while it is connected to the internet is not a viable option.

Most importantly, even if my computer happens to be 11 years old at that time, if it still works, it still works. I 100% reject the idea that people should retire perfectly fine computers over unnecessary and arbitrary hardware requirements.

What really gets me upset about this whole situation is the marketing around Windows 10, and how it would be the last version of Windows ever.

> Microsoft are not changing anything about Windows 10

You haven't been doing this long enough if you believe that.

> In this case, Windows 10 will continue to run on your computer perfectly fine.

Has it been confirmed anywhere that Win10 installations won't be automatically updated to Win11? Given the automatic nature of Win10 updates I'd expect that I'm waking up one morning, and be greeted by Win11 on my gaming PC (and since Win11 is just a marketing name for what's normally a Win10 feature update, this is most likely to happen, at least for Win10 Home users).

I might be wrong but I don't think that Win10 even updates itself to new releases. I stayed on Win10 of 2017 year for 3 years. Of course it was receiving updates and there was option for major update, but it never forced me to do so.

The rollout of Windows 10 itself contradicts that. Silently switching from opt in to opt out prompts, so people trained over months to click away the Windows 10 adware spam would suddenly find themselves with a Windows 10 installation.

Obviously an unsupported pc will not auto update to Windows 11.

But they did exactly this before, upgrading unsupported win7 machines to an unusable win10.

Yeah obviously, but I have a supported PC and don't want to update to Win11 either :)

There are also privacy implications related to using a TPM.

https://www.cs.auckland.ac.nz/courses/compsci725s2c/archive/...

They enforce secure boot. Many vendors only have the MS CA implemented to check OS integrity. So you would have to get your OS certified by Microsoft...

Almost all mainstream Linux distros can OOB do UEFI secure boot through a MS-signed shim, or Grub signed by Canonical or Fedora (which is a trusted cert by the MS cert).

Secure boot does not prevent a user from installing Linux. That’s just FUD.

I don't think making people aware of the logistic problems of having to sign you OS at Microsoft in most practical cases is FUD.

Secure boot or TPM can make sense for the cloud, since you might want to check if the provider changed your OS. MS used ransomware to justify secure boot. That is FUD. Boot and Bios trojans have become extremely rare and it doesn't provide enough protection anyway.

This is for vendor lock in and nothing else.

It may be FUD, but people's concerns are valid. This is clearly another stepping-stone in the direction of removing control of the hardware/computer away from the user (under the guise of Trust, Safety, Privacy and Security). We just don't yet see the bigger, long term end state.

But if you ask me, "they" essentially want an un-tamperable and un-recordable pipe between hosted server and the monitor that emits electrons to your eyeballs.

>Many vendors only have the MS CA implemented to check OS integrity

Secure boot was introduced for Windows 8, ages ago. Microsoft and PC vendors promised that on all Intel PCs the user can install their own certificates. I have not heard that this would have changed. So the problem affects only ARM PCs, which aren't particularly common.

As a Linux user I use secure boot. On some machines with big distros that have shims signed by Microsoft. On others with Arch or Yocto with my own keys.

Wouldn't your own keys stop working with mechanism like remote attestation?

From a security standpoint secure boot is hard to justify to be honest. When did you encounter the last boot or bias trojan?

Sure, large distros are signed by Microsoft. Do I want that? They also complained that it takes quite a long time....

Where is the benefit for the user?

Who uses remote attestation for what purpose? I have never used it.

Secure boot is simple and lightweight. Should I just wait until some damage happens? I agree it's not the most critical measure. I have at least one machine where it doesn't work and many where initramfs remains unchecked. Have not lost my sleep yet.

They enforce Secure Boot on Windows 11. It was always a requirement on Windows 8 and 10 but never actually enforced.

There's nothing to stop you from using Windows 10 or Linux on your hardware unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11.

> unless MS goes all anti-competitive and forces OEMs to build hardware that only runs Windows 11.

They didn't force OEMs, but some devices can only run Windows 8.1 with no ability to turn Secure boot off.

> ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system.

Can people stop already. Its NOT true. Windows 11 runs perfectly fine without. There is no enforcement at all. All the hardware checks are in the setup/installer which is not needed its just one way to install the OS and ofc it can be circumvented easily if someone really wants the installer/update experience for some reason.

Same for TPM. Not even TPM 1.2 is enforced and that was a requirement for windows 10 already.

For lazy people with win10 already installed use https://github.com/ArkaneDev/WinPass11

I looked at the code - it downloads a .reg file from the web and modifies your registry with the content of that .reg file in admin mode. At the moment that .reg file modifies the registry to allow bypassing TPM checks, but at any future time the author can replace that .reg file with something malicious. I wouldn't download that program.

I'm aware of that. It also loads a DLL from windows10 installer. I assume it intentional so the files can be updated if MS would add more checks. It's open source for a reason.

Reply on news.ycombinator.com