Q: I have heard that NGSCB will force people to run only Microsoft-approved software.
 
A: This is simply not true. The nexus-aware security chip (the SSC) and other features are not involved in the boot process of the OS or in its decision to load an application that does not use the nexus. Because the nexus is not involved in the boot process, it cannot block an OS, or drivers, or any nexus-unaware PC application from running. Only the user decides what nexus-aware applications get to run. Anyone can write an application to take advantage of new APIs that call to the nexus and related components without notifying Microsoft or getting Microsoft?s approval.
 
It will be possible, of course, to write applications that require access to one or more nexus-aware services in order to run. Such applications could implement access policies, enforced by a nexus-aware application, which would allow the application to run only if it has received some type of cryptographically signed license or certificate. However, the nexus and NCAs isolate applications from each other, so it is not possible for an individual nexus-aware application to prevent another from running.

Q: How can anyone be sure that the nexus and related components do exactly what you claim they do?
 
A: We have attempted to make the NGSCB trusted computing base (TCB) of the OS enhancements from Microsoft as small as possible, as the TCB ultimately enforces policies (and could bypass them). We will make widely available for review the source code of the critical piece of enabling software, the nexus, so that it can be evaluated and validated by others.

Q: Will I still be able to play MP3s on my PC?
 
A: You will. NGSCB will bring additional capabilities to the PC but will not interfere with the operation of any program that runs on current PCs. The nexus and nexus computing agents are designed never to impose themselves on processes that do not request their services; nexus-related features must be explicitly requested by a program. So the MP3 player you have today should still work on a next-generation PC tomorrow.

Q: Can Linux, FreeBSD, or another open source OS run on hardware developed for the NGSCB architecture?
 
A: Virtually anything that runs on a Windows-based machine today will still run on a NGSCB machine (there are some esoteric exceptions*; if you currently have a machine that runs both Linux and Windows, you would be able to have that same functionality on an NGSCB machine).

Q: Some people have claimed that running the Windows OS with the nexus will enable Microsoft or other parties to detect and remotely delete unlicensed software from my PC. Is this true?
 
A: This is not true. Running the Windows OS with the nexus will not include mechanisms that delete or disable any content or file that currently runs. In fact, the NGSCB architecture is built on the premise that no policy will be imposed that is not approved by the user. Microsoft is firmly opposed to putting "policing functions" into nexus-aware PCs and we do not intend to do so. A machine?s owner?whether an individual or enterprise?has sole discretion to determine what programs run on the nexus-aware system. Programs that run under nexus-aware systems, just like programs that run under Windows, will do whatever they are allowed to do, based on the security settings on the user's machine. NGSCB not only respects existing user controls, it strengthens them.
 
As stated earlier, the function of the nexus, NCAs, and related components, is to make digitally signed statements about code identity and to hide secrets from other nexus-aware applications and regular Windows kernel- and user-mode spaces. Enhancements to the Windows OS introduced as part of NGSCB do not have any features that make it easier for an application to detect or delete files.