This is a most excellent place for technology news and articles.
Only for the IOT version which is for devices like ATMs, but it kinda torpedoes their argument that a TPM is hard requirement for windows 11.
You're right, fixed that headline now.
~~I've run~~ I run the IoT version of 10 on everything - laptop, desktop, VM's, etc, it's great because it only does updates 2x/year, no feature updates by default.
Licensing is handled by the scripts from Microsoft. If you're a large enough business, it would be worth the cost of the Enterprise licensing just in reduced support issues.
Basically, it's Windows without the bloat, which seems like a good thing. I can use whatever apps I want for photo viewer, etc, and no garbage on the system.
(...) is a requirement for windows 11 consumer devices. :)
If anything, it should be optional for personal use, and mandatory for enterprise. Not that they would come to this conclusion either way, granted that half of the workforce is busy putting ads into the start menu, and the other half are probably not doing any work whatsoever
If you don't have TPM how can they do browser attestation and ensure you have no ad blocking software?
Rats. Leaving TPM off in the BIOS is how I've been avoiding it nagging me to upgrade from 10.
This is for IoT.
16 GB just for an IOT OS is fucking bloated IMO.
It's obviously not intended to run on an Arduino or something.
Um.... then what is it intended for? ATMs and POS terminals don't really strike me as IoT devices.
I still have a laptop running a (old) full kde desktop in 192 MB of Ram from a 12GB disk with lots of space to spare.
It's been quite a while, but on an older system years ago I recall it slightly nagging me about how the computer wasn't W11-enabled.
I've been curious about people who have been disabling the TPM. Where are you storing your disk encryption keys?
I'm not using disk encryption. It's a desktop and if it's every stolen I've got bigger problems.
Also, I presume that disk encryption makes it so you can't just pop the drive in an adapter and pull stuff off it, which I sometimes need to do with old, retired drives.
veracrypt is a thing, encrypting drives does not need TPM.
Just boot using the good old Master Boot Record for a clean solution (The Veracrypt documentation gives a good overview). Veracrypt works with EFI too, but the EFI partition itself cannot be encrypted. You can even create a hidden OS, if you are forced to give out your password, theres still plausible deniability.
Thanks for the Veracrypt reminder. Adding that to my stuff to setup and document list.
Sometimes Bitlocker really pisses me off.
You can run bitlocker without TPM using a usb flash drive instead. I think you can also store the key in your mind as a password.
Yes, but when they're on USB the keys are much more accessible. You can just plug it in and dump them.
If you're only using a password, the keys are stored in an unencrypted part of the drive, which can again easily be dumped.
Once you've dumped the keys, you can brute-force the passphrase offline.
I found it was pretty easy to get rid of the nag. I installed a different OS. For my development stuff that needs windows and I can't run with wine (very few tools) - I have a VM running a windows version with 0 Internet access. Fuck that company sideways.
All well and good for Enterprise folks I guess, but what about home users?
What about home users?
I run Win10 LTSC as default for desktops, VM's, laptops. It's great - 2x/year security updates, nothing else.
No bloat, no BS.
Good for the people sailing the seas too. Yarrr!
let's go GenTwo!!
This one big question around the T in TPM, has anyone found a satisfying answer yet?
T is for "trusted". So far it was easy.
But who is supposed to trust whom?
The only case I found plausible so far is, that M$ can now decide whether or not they want to trust your PC (against you, the user).
I'm sure this is a meme, but the trust is proving the OS is not tampered with.
Like, if malware was able to inject a malicious windows update URL into the OS, and inject a malicious certificate that gets the OS to trust the malicious updates by the malicious URL.
The signature of the OS would then differ from what the TPM/CPU recorded during OS boot and what the TPM/CPU has hashed during running. This would indicate that the OS has been tampered with.
So the trust in TPM is that the TPM and CPU are working together correctly (which is certified during manufacturing), so that the TPM can then attest that the OS (or software or whatever) hasn't been tampered with.
So yeh, it's MS (or whatever software company) trusting that the software it is interacting with is running as it is intended
Honestly, the user is the biggest security risk in the first place. People run all kinds of malware and put their passwords into phishing sites all the time. One thing a TPM is used for is secure boot, which prevents malware from inserting its own bootloader to take over the OS.
the user is the biggest security risk
Of course LOL
The user of a hammer is the only one who can destroy the hammer. Humans on the planet's surface are the only ones who can destroy the planet... we should definitely separate the human user from his rights and freedom, shouldn't we?
Interesting direction to go...
But who is supposed to trust whom?
12 years old and still relevant:
https://www.youtube.com/watch?v=s7WDbnHlc1E
Here is an alternative Piped link(s):
https://www.piped.video/watch?v=s7WDbnHlc1E
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
The last time I tried to install Windows 11 on a VM (Nutanix AHV), I had to fiddle with a virtual TPM and lost the live migration feature as a result.
Dos this mean I can install the LTSC version, not need the TPM and have a working, live migrate-able machine?
Something to test next week…
There’s a registry key (sorry I’m on mobile right now) that you can actually add during a clean setup of current non-LTSC versions that remove the requirement for vTPM and SecureBoot. That install should easily be able to be live migrated. We were doing that when first playing with Windows 11
Don't worry, I got you
Here's a link to the tutorial for doing exactly this.
As a bonus it also talks about how using Rufus you can remove the requirements by default when you create the install stick.
Btw. release here.
Thank you
I tried to find a link a couple weeks ago and I came up short
Me too. Guess it wasn't there then.
It already wasn't a requirement when flashing the iso with Rufus.
Thanks I hate it.
So they are lowering the specs because people has found a way to avoid upgrading?
They are lowering the specs for this one version that's only available to license to Enterprise users because it's meant for Enterprise level IoT use cases, not as a typical desktop.
That was just a way to stop people from booting Linux. It didn't work. Microsoft sucks.
