DefederateLemmyMl

Everybody gangsta until “A stop job is running for …”

That clarification of yours is massively important

I think my mistake was assuming I was on a security related community, where this would be understood, instead of PC masterrace.

Your initial comment sounds as if there is a PoC from Canada on how to circumvent the PIN for the Bitlocker keys.

It’s a meme joke, referencing this: https://knowyourmeme.com/memes/she-goes-to-another-school

the only way they could put microSLOP at fault for that would be if they could find that microSLOP was backing up encryption keys in the recovery environment / boot files somewhere

Seems unlikely. The WRE is like 32MiB in size, and most of that consists of static binaries. Not much info is saved there, except for some log files. If the bitlocker keys were there, they would have already been found by someone else.

Second thing is, No, TPM+PIN does not help, the issue is still exploitable regardless, I asked myself this question, can it still work in a TPM+PIN environment ? Yes it does, I’m just not publishing the PoC, I think what’s out there is already bad enough.

The PoC for that goes to another school, in Canada.

Edit:

Downvoters don’t understand the nature of this exploit.

Without PIN, the windows recovery software has full access to the encryption keys in the pre-boot environment. So to crack bitlocker in this case, a hacker only needs to find a bug in the WRE to get at the keys. => That’s the Yellowkey exploit.

With a PIN, no Windows or Microsoft program has access to the bitlocker encryption keys until the PIN is provided, and it can’t be brute forced because the TPM protects against that. To exploit that, would require a attack on the TPM hardware itself, which would be absolutely massive if he could pull this off through software only and of a completely different nature than the Yellowkey exploit. It also wouldn’t have anything to do with Microsoft software, because it wouldn’t be in the loop for this.

To use an analogy: Yellowkey is like beating a bank employee (the WRE) who knows the combination to the safe with a wrench until he gives you the combination. In an attack with a PIN, the bank employee doesn’t know the combination himself, so you can beat him with a wrench as much as you like, he’s not going to give you anything useful.

Extraordinary claims require extraordinary evidence, and he has provided none. Furthermore, he has a bone to pick with Microsoft over a denied bug bounty, so he clearly has a motif to undermine trust in Microsoft products like bitlocker. All this, and knowing the typical hacker personality, leads me to believe that this is pure bluff. If he had something, he would show it.

Especially since memory training on DDR5 can take upwards of a minute.

Just FYI: most bioses have a setting to save the memory training, so it doesn’t have to be re-done each boot. On an Asus board it’s called “Memory Context Restore”.

Cronjob? I’m not a systemd evangelist or anyting, but certbot literally has a timer included in the package that you just have to enable to make it run twice a day: systemctl enable certbot.timer

Removed by mod

Removed by mod

deleted by creator

Removed by mod

No.

The laws can absolutely be written such that companies are required to suspend service to any suspected child without requiring ID to use the service.

The laws shouldn’t focus on “harming children” so much, but on “harming humans”.

The big tech companies should be held responsible for the actual damage they are inflicting upon society, and their methods to artificially inflate “engagement” (or whatever the hell they call it) should be held to scrutiny. Whether or not the damage is inflicted upon an underage person or an adult, is merely a distraction.

Those assholes would love it if we all had to identify ourselves and prove our age, if it means they get to keep inflicting their shit upon us.

Removed by mod

what’s the point in even using a VPN, if you have to identify yourself just to use it?

Having to identify doesn’t mean they can see inside the tunnel or that your VPN IP can be traced back to you.

Not when the output is a pipe.

Would be nice to see the gaming industry pivot back to making innovative games within the constraints of hardware, instead of just expecting customers to throw ever more powerful (and power consuming) hardware at it.

Why would I throw it away, when I can give it to someone who needs it more, or sell it?

Because selling is always a hassle, dealing with choosing beggars and scammers, and it may not be worth much anymore for general use.

For example, my old PC is a i7 4770k… it can’t run Windows 11 or play remotely recent games. I don’t know anyone who could use this thing, so to save a few watts I took out the GPU, put it in eco mode and have been using it as my Linux server.

My NUC uses 6-7W idle.

I have played around with some mini PC’s (minisforum and beelink brand), they’re neat but they turned out to be not very reliable, two have already died prematurely, and unfortunately they are not end-user serviceable. Lack of storage expansion options is an issue as well, if you don’t just want to stack a bunch of external USB drives on top of each other.

It’s possible those are still using Xwayland

You can use xlsclients to check.

wmctrl and xdotool don’t do anything for me with native Wayland windows. It only seems to work for applications that use Xwayland.

So while I can use it to resize and position xterm or urxvt windows, it does not work with foot or kitty or firefox windows.

No. Those are X11 only.

I had a bunch of wmctrl window placement scripts that I had to rewrite in kwin’s (awful) scripting language when I switched to wayland.

It’s even more confusing because in my native language (Dutch), we have those words too ( gnoe and gnoom ), and we do pronounce the g.

Of course, no Dutch speaker would ever miss the opportunity to pronounce a g :)