Win11 support

[DaMan]

Are we going to tell Win11 users to go pound sand if MS doesn't drop TPM requirement? Graf's so anti DRM he doesn't even have a Steam account so I'm sure he will be thrilled when they start tying licenses to TPM keys.

[wildweasel]

It is entirely too early to be speculating, if you ask me.

At least, very few people bought optional hardware TPM until yesterday, after seeing the Windows 11 requirements and subsequently panicking. Within hours of Microsoft Chief Product Officer Panos Panay's Windows 11 introduction, the entire stockpile of most manufacturers' readily available TPM modules were sold out by Windows 10 users trying to make certain they could run 11.

If you didn't get one of the few TPM modules available yesterday, don't worry—you almost certainly don't need one. OEM hardware TPM is generally considered the most hardened version, and it's soldered directly to the board in PCs intended for enterprise use. Less-hardened firmware TPM support is built right into modern AMD and Intel processors, and that will satisfy Windows 11's TPM requirement just fine.

(src: https://arstechnica.com/gadgets/2021/06 ... indows-11/)

Not to mention, that it's not like Microsoft haven't historically retracted requirements like this before, in the face of major outcry; not to mention, that just because Microsoft doesn't support something, doesn't mean the OS flat out will not run without it.

[Graf Zahl]

TPM has nothing to do with DRM (although it can also be used to implement that, of course) but to secure the OS against tampering by malware, especially for implementing Secure Boot or hard drive encryption.
There has also been a lot of FUD being spread in certain conspiracy minded circles about these things which hampered their adoption.

IMO forcing the issue is really the only way to go forward, or all those idiots with an 'opinion' out there would sabotage all the efforts to make computing a bit more secure again. The comment sections to all these articles do not read well, that's for sure.

The main reason to set the requirements this high is, as I understand it, that they can assure that 'certified' new hardware meets the specs they laid out, i.e. they can force their OEMs to provide future-proof hardware. I think the past has been a good indicator that these people would cut corners otherwise and undermine any effort to make good security the default.

[Cacodemon345]

TPM 2 isn't the problem. What is the problem is Microsoft forcing the CPU requirements on everyone, not just OEMs. As it stands you can't run Windows 11 on anything earlier than 8th Gen Intels or 2nd Gen Ryzens and even then a couple of Ryzen 2000 series CPUs has been excluded from the support list. The CPU requirements also means Microsoft is effectively blocking many of their Surface devices from upgrading to Windows 11.

The Secure Boot requirements already has many people on Reddit who dual-boot Windows and Linux angry. Users that use Coreboot firmware both for Windows and Linux won't be happy.

Not to mention, that it's not like Microsoft haven't historically retracted requirements like this before, in the face of major outcry; not to mention, that just because Microsoft doesn't support something, doesn't mean the OS flat out will not run without it.

They changed their Windows 11 Compatibility Cookbook page to specify TPM 2.0 as an requirement. I think this will wind up the way of Windows Vista. I don't think they will be changing the requirements to appease people with PCs older than 3 years. Then again they made a concession with Windows 10 system requirements so it's still a possibility but unlikely.

P.S. I did hear Surface Pro 2 was marked as upgradable to Windows 11 on the Microsoft Store but I am not sure if that will hold true for the final release.

[dpJudas]

Actually, Windows Vista was the other way around where they let hardware vendors sell under-powered machines as Vista compatible. Of course it didn't help that they also rushed the release at the same time so that the thing was slow even on high end machines.

[Gez]

Are we going to tell Win11 users to go pound sand if MS doesn't drop TPM requirement? Graf's so anti DRM he doesn't even have a Steam account so I'm sure he will be thrilled when they start tying licenses to TPM keys.

Is it still possible to run Win 10 applications on Win 11? If so, this is a non-issue and the point is moot.

It's only if they go to some walled garden model where each app needs to have a special MS-issued authentication key that Win 11 users will be told to go pound sand.

[Cacodemon345]

Microsoft won't go to a walled-garden model because it would kill Windows 11.

[Rachael]

GZDoom will work fine on Windows 11 - if you can manage to get the OS working to begin with.

[Enjay]

According to the MS app that can check for you (MS PC Health Check), my PC cannot run Win 11. It's not a new machine, but it still has enough horsepower to run modern games (Cyberpunk 2077, for example, runs very nicely with most options on max). So I guess I won't be upgrading for several years.

[Rachael]

Yeah this is a crapshoot. I am not totally sure that Microsoft is going to keep the requirements up that high - it would make much more sense to enforce that on OEM and PC builders than it would on end-users, I don't know why they are going this way. My PC is fully capable of running Windows 11 but the PC Health thing has bitched about the TPM 2.0 thing for me, too.

I think I actually can run it because of my motherboard though, but I have to find the setting to enable it in the firmware.

You can of course simply extract the install.esd to a blank partition and do the BCDBoot thing (or just rufus the thing to a flash drive) and it will still work, but, that makes getting the semi-annual major Windows Updates (the service packs/kernel upgrades) a lot more difficult because they no doubt will check for the minimum install requirements.

[Rachael]

IMO forcing the issue is really the only way to go forward, or all those idiots with an 'opinion' out there would sabotage all the efforts to make computing a bit more secure again. The comment sections to all these articles do not read well, that's for sure.

The main reason to set the requirements this high is, as I understand it, that they can assure that 'certified' new hardware meets the specs they laid out, i.e. they can force their OEMs to provide future-proof hardware. I think the past has been a good indicator that these people would cut corners otherwise and undermine any effort to make good security the default.

Ham-fisting it like this never goes well. If you think cutting corners was bad before, wait until you try and force something like this. A better approach simply will be "we will cease supporting systems that do not have TPM 2.0 in the future, end of story, no negotiation." But actively blocking install on said systems will not end well, at all. It should have just been relegated to the policy "if it works it works and we don't care after that point, but don't come crying to us when you get malware."

I have a feeling that this new policy of blocking the install is more to enhance the marketing strategy of pushing the idea "Windows 11 is the most secure OS ever" - but it's going to backfire because people will find ways around that, and it will not be pretty. I don't think the requirement has any real purpose besides marketing.

Just imagine the massive embarrassment when news outlets start reporting on ransomware infecting "secure" Windows 11 systems en masse - no matter how secure you make your operating system, when the problem is PIBKAC anything can go wrong.

[leileilol]

Yeah i'm not in a panic either. I still feel it's OEM guidelines than anything else at this point. They'll probably also be some sort of non-TPM/non-UEFI workaround to boot Win11 afterward anyway (the long-awaited return of bootdisks??), should it actually come through. If Microsoft's going to pull a GWX with 11, they'll risk bricking a lot of possibly vital systems, is this hard requirement is what it is...

[Rachael]

Well - if you can boot Mac OS on a BIOS-laden computer even though Mac OS is a strictly UEFI-booting system - you can bypass pretty much any hardware boot lock.

One thing I've explained before is - BIOS and UEFI are just simply programs - that happen to load from a chip on the motherboard when the computer boots up. Which means that both systems can be loaded from a disk, as they are themselves operating systems anyhow.

[Cacodemon345]

@Racheal, look for PTT if on an Intel or fTPM if on an AMD motherboard in the firmware setup. On MSI motherboards it will reside inside the Security section but I don't know about anything else.

[Rachael]

@Racheal, look for PTT if on an Intel or fTPM if on an AMD motherboard in the firmware setup. On MSI motherboards it will reside inside the Security section but I don't know about anything else.

That was surprisingly simple to find, thank you. My motherboard is indeed MSI. My CPU doesn't have it built-in but as long as it's on the motherboard it doesn't matter, it's just a chip anyway.

---

I am surprised, however, that it is disabled by default.