Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Retiring Windows 10 and Microsoft's move towards a surveillance state

scottrlarson.com

Post reply on HN
Print view View original

481–490 of 514 posts

Re: Retiring Windows 10 and Microsoft's move towards a surveillance state

#481

Post by linhns »

npteljes wrote: post #452
gethly wrote: post #264

I have been using windows since version 95. I even liked the Millennium version, that was most hated before Vista. I tried Linux several times, but Windows just always worked and Linux usually had always some issues(mostly drivers, lack of good programs and no gaming). But now, after more than two decades, I am certain Windows 10 is my last Windows. Nothing lasts for ever, not even Microsoft's domination on personal…

Stop daydreaming and just make the jump. The possibility of things being different down the road, and the fantasy you acting on it properly just serves to make you feel better, without needing actual action, or commitment on your part. Do something now, and get a taste of the real thing. My way of switching over was to set up my system as a dual-boot, and then to set up my Linux in a way that enabled as much of my ne…

KDE is the best DE for Windows to Linux user. Personally going from Windows -> Linux -> Mac then GNOME feels much better for me.

Re: Retiring Windows 10 and Microsoft's move towards a surveillance state

#482

Post by rightbyte »

fujigawa wrote: post #410
trinsic2 wrote: post #400

Earlier quoted context omitted.

Normally I would agree that security measures are needed in many, but not all cases, but only if they are in complete control of the user and cannot by altered by any one organization. For-profit companies cannot be in control of these mechanisms. We have seen how they can be abused with the latest decision by Google to limit side-loading to people who identify themselves. So your take is really a misdirection from h…

> For-profit companies cannot be in control of these mechanisms. But they are not in control of Secure Boot. Microsoft runs a root CA that is pre-installed on most PCs. It could have been Verisign or someone else, but MS made sense at the time, likely because they had additional code signing expertise. You are free to delete these keys and/or install your own. If there wasn't preexisting infrastructure, Secure Boot w…

> But they are not in control of Secure Boot.

> Microsoft runs a root CA that is pre-installed on most PCs.

How can you write those two statements on two adjacent rows? In practice that makes MS a gatekeeper.

Re: Retiring Windows 10 and Microsoft's move towards a surveillance state

#483

Post by WorldMaker »

rightbyte wrote: post #480
WorldMaker wrote: post #389

Earlier quoted context omitted.

TPM wasn't the only reason older CPUs were dropped. The biggest reasons where the line in the sand Microsoft chose would not be supported in Windows 11 was Spectre/Meltdown [0] mitigation. Windows 10 added a bunch of intentional slowdowns to mitigate that disaster and people incorrectly blamed Windows 10 for being slow and not the CPUs and their CVEs. Windows 11 seems to have wanted a clean slate without needing to h…

My understanding is that Spectre etc. only is a problem if the user choses to run hostile code on their computer.

I think "chooses to" is doing a lot of work there in your understanding. Spectre exploits were found in the wild even in JS code submitted to ad networks. I suppose a user could choose to uBlock all ad JS and never visit webpages they don't trust. Those are choices, sort of.

But also that's a bit victim blaming isn't it? Do you want to explain to your grandfather or partner or child "Oh sorry, you had a password stolen because you chose to visit Google.com on a day where Google let an ad buyer attach Spectre exploit malware"? (Google could also chose to not let ads attach JS at all, but that's a very different problem.)

Computers have millions of places they get code from to run. Is "your CPU has a data leaking bug in it" the user's problem or the OS's problem? When there's a mitigation the OS can manage? When security-in-depth is an option?

I installed Bazzite on my own old Desktop not supported by Windows 11. One of the first things the Linux kernel spits out on boot if I have the boot console up is about running with Spectre mitigations. The Linux kernel also thinks it is important to mitigate (as Windows 10 did, but Windows 11 doesn't include and so doesn't support this old Desktop).

Re: Retiring Windows 10 and Microsoft's move towards a surveillance state

#484

Post by yusaydat »

WorldMaker wrote: post #389
breakingcups wrote: post #304

Earlier quoted context omitted.

There's a reason Microsoft is aggressively deprecating "older" CPU's that work perfectly fine. Heck, I have one laptop with Windows 11 that worked great, but won't update from 22h2 to 24h2 because CPU support was dropped between versions, leaving me with only the glib suggestion from the Windows Update UI to "Buy a new device". Ironically, installing Windows 10 and activating ESU would lead to longer hardware life. O…

TPM wasn't the only reason older CPUs were dropped. The biggest reasons where the line in the sand Microsoft chose would not be supported in Windows 11 was Spectre/Meltdown [0] mitigation. Windows 10 added a bunch of intentional slowdowns to mitigate that disaster and people incorrectly blamed Windows 10 for being slow and not the CPUs and their CVEs. Windows 11 seems to have wanted a clean slate without needing to h…

Windows 11 has full spectre/meltdown mitigations by default. That Wikipedia article doesn't mention Windows 11 at all.

Re: Retiring Windows 10 and Microsoft's move towards a surveillance state

#486

Post by AnthonyMouse »

KAMSPioneer wrote: post #450
AnthonyMouse wrote: post #423

Earlier quoted context omitted.

> When Secure Boot is disabled, the TPM notices that and refuses to release the key, that's how you know to reënable Secure Boot or throw away your device. But the attacker isn't trying to get the key from the TPM right now, they're trying to get the credentials from the user. It's the same thing that happens with full disk encryption and no TPM. They can't read what's on the device without the secret but they can al…

So this attack is to steal my Windows password or Windows Hello credentials, but doesn't get my encryption key...? That's...not ideal, but I think you'll see it's an improvement over unencrypted disks (again, TPMs are for people who can't be bothered to set a strong password). And again this presupposes that you can disable Secure Boot, boot a malicious OS from another drive, fool the user into entering their passwor…

> And again this presupposes that you can disable Secure Boot, boot a malicious OS from another drive, fool the user into entering their password, automatically reboot, enable Secure Boot, boot into the legit OS, then come back later and have the ability to boot the OS yourself and log in as the user (because again, you don't have the decryption key, you have the user's login credentials).

But that's the same thing that happens with full disk encryption. They come get physical access to the machine but don't have the decryption key yet so they compromise the unencrypted part of the machine which is what prompts you for it, have that capture the key when you enter it, and now they have the key when they come back to use it.

If anything allowing the short password is even worse, because if you leave your machine in suspend you expect it to prompt for your unlock password but not the full disk encryption key when you come back, so the latter would be suspicious but the former doesn't let them unlock the disk, and now you're using the short password for both.

> You are also presupposing what the TPM is bound to. I don't use Windows, but using systemd-cryptsetup I could configure a TPM to bind to the drives in the system; in this way, it will refuse to boot my legit OS while your malicious disk is installed (well, it will demand a recovery key). Again, setting off alarm bells, and if I discover the disk with my recorded credentials before you can physically access it, I can just destroy it.

Except that it doesn't need to be installed once you're at that point. By then it has already captured your credentials and stored them or sent them to the attacker over the network, so it can disable that device right before it goes to boot into the original operating system.

Also notice that the original premise was to make it easy for ordinary users and now the workaround is to install Linux and change a setting that will confuse people as soon as they leave their own USB stick plugged into their computer.

Re: Retiring Windows 10 and Microsoft's move towards a surveillance state

#487

Post by mixmastamyk »

gethly wrote: post #264

I have been using windows since version 95. I even liked the Millennium version, that was most hated before Vista. I tried Linux several times, but Windows just always worked and Linux usually had always some issues(mostly drivers, lack of good programs and no gaming). But now, after more than two decades, I am certain Windows 10 is my last Windows. Nothing lasts for ever, not even Microsoft's domination on personal…

I'd put Linux on a second machine and start learning. Forcing yourself to use it for a few days a week, etc. Needs to become a habit. Need to find solutions to all the expected issues. Can use an old machine if you need.

You don't want the migration to be harder than it should be, and doing everything at once is way too hard.

Re: Retiring Windows 10 and Microsoft's move towards a surveillance state

#488

Post by mixmastamyk »

Havoc wrote: post #390
BatteryMountain wrote: post #245

The best path forward for home users and small business for non-technical users: Install Fedora with KDE. Install Firefox, Thunderbird and Chrome. Install uBlock Origin, Privacy Badger. Install LibreOffice & bookmark Google Docs. Install multimedia support, h264/h265, VLC/mpv/ffmpeg, enable DRM in browser. Install Steam if applicable. If they have a printer, connect it and show them how to print a page. Configure & t…

FYI last guidance is saw said privacy badger provides no additional benefit if already using ublock

Ublock doesn't rewrite search engine tracking links, PB does.

Re: Retiring Windows 10 and Microsoft's move towards a surveillance state

#489

Post by mixmastamyk »

spaghetti_king wrote: post #436
m463 wrote: post #153

I should mention that ubuntu phones home a lot. I like the fact that it has done a lot for the linux ecosystem, but there are a few things: - it has a privacy policy - it forces updates - their hardwired package ubuntu-advantage-tools cannot be uninstalled without breaking the os - motd has telemetry and nags - can't disable snaps - whoopsie uploads crashes to canonical now, this is different from windows because the…

I'm curious what you recommend? I've used Ubuntu mostly because of it's larger community and assumed it was less painful then others but am open to switching. I have to say the endless amount of distros and small differences between them has always been daunting and something I think holds some non-technical people back.

Mint/Cinnamon is based on Ubuntu and better. No snaps and probably less telemetry. I've got opensnitch and haven't noticed anything sent to Mint.

Re: Retiring Windows 10 and Microsoft's move towards a surveillance state

#490

Post by mixmastamyk »

mixmastamyk wrote: post #130
apple4ever wrote: post #9

I think it's a good plan, though there might be some pain. I have a bog standard AMD graphics card that does not work in Linux. I've tried multiple distributions and version in those distributions and both the Linux and AMD drivers. It just randomly flashes. Where do I go to get help? Who knows?

This happened with a new AMD chipset with a Framework. One firmware update improved it and then kernel 6.8? I think fixed it. Was about perfect, then kernel 6.13 AMD driver broke it again. ;-)

I've since learned that 6.13+ has a different brightness scale. Adjust to that and things should work well.
Post reply on HN