The criteria was based on hardware mitigation support for Meltdown and Spectre patches. Because at the time those vulnerabilities could be exploited by executing malicious javascript in a browser to steal passwords
"could be" is doing a lot of work here. AFAIK there has never been a PoC or active exploit which actually exfiltrates sensitive data from a browser using these vulnerabilities. Anyways, browsers have long since implemented software mitigations.
IIRC the real criteria for W11 support has to do with TPMs. Microsoft really wants to have secure boot on all Windows systems.
Meanwhile, advertising on the Edge start page and the top of Chrome search is the number one source of practical, working malware attacks. But those things make the browser companies money.
I no longer think big tech security people are serious.
Nobody in tech seems to be serious except for the people driving the adtech and surveillance models. Nothing else makes as much profit, and it financially justifies enshittifying every other aspect of every other piece of hardware or software.
Legislate protections of user data, and start nuking brokers and data collectors from orbit, and everything gets better. Until then, the only space that isn't continually and totally enshittified is open source, and/or markets and products new enough that quality still matters.
Our choices are end adtech, or suffer.
Does the world wide web still work? If so, the change was fine.
See also the removal of the client certificate bit from Let's Encrypt certificates. Let's Encrypt issues certificates for web servers. What are you doing using one on a client? You should either do your own thing, or have an actual contract with Let's Encrypt for them to support whatever you're doing. Otherwise you have no right to complain about that.
https://www.tomshardware.com/software/windows/microsoft-upda...