Hacker News Reader

Comment by AndrewDucker | Hacker News Reader

I'd be worried about Microsoft's comment that unsupported copies might not get security updates...

I wonder how this will play out. It was my understanding that the whole forced updates on Windows 10, free upgrade from 7 / 8, etc were meant to cut down on the number of people running old, unpatched versions.

For what it's worth, I installed Win 11 on an unsupported computer (4th gen Xeon, no tpm) out of curiosity and I did get updates. Of course, that doesn't mean it will happen forever.

I'd assume long term they're going to do more with TPMs. Once they start pushing patches that require a TPM, unsupported configurations won't be able to receive that update.

My 10yo notebook (TPM 1.2) wound up with it via insider. Since updating, my security updates went from 1-3/wk to 1/mo.

Are you still on insider? Isn't that more related to the fact that it went from "beta" / preview to "ready"?

I used to be on the Win10 insider ring for a few months a while back, to try WSL2 and I seem to remember updates were more frequent. Otherwise, I seem to get one update per month for a regular win10 pro install.

I think I was kicked out because my T430 doesn't meet the requirements of Win 11 (that I was duped into installing).

I bypassed the checks and installed in a Virtualbox a month or so ago, and it's been updating just fine.

I don't see them seriously blocking non-conforming installs as it would essential rule out all virtual machines.

There are various 'passthrough' approaches to let a virtual machine have access to the hosts TPM. In the future, that may become mandatory.

I don't see the point in this at all. There's no way for software to authenticate what is and isn't a legitimate TPM, that's not how they work.

Look up "device attestation". It basically let's software verify its talking to a hardware TPM made by a whitelisted manufacturer rather than an emulated TPM.

All kinds of DRM schemes want to do that to be sure they can't be run in an emulator.

Device attestation just proves you have realtime access to a legitimate device, and only makes sense where the other end of the transaction is trusted. Locally running software is never trusted.

Its uses are mostly confined to authentication between corporate issued laptops and corporate VPN servers.

Reply on news.ycombinator.com