Comments by "eDoc2020" (@eDoc2020) on "Mental Outlaw" channel.

@realtimberstalker The monitor is communicating its size, it's part of the base EDID spec which has been used since the nineties. Ever notice how Windows 10 chooses different default scaling factors on different density displays? Having said all that, I very much doubt MS would enforce a minimum screen size. At most they'd just throw up a warning.
4
Cloudflare usually needs to be your domain's main DNS server. So to switch to something else you need to update your records in the top-level domain servers which will take hours to propagate. It's not really practical to do automatically.
3
@wiger_ That's true and initially I thought this would be the ping time. But ping time also includes the return time. 67ms to send the request and 67ms to receive the reply.
2
Because then they would also be used for mining
2
The most difficult part is probably indexing. For a good index you literally need to go through every webpage on the Internet.
2
@realtimberstalker It operates based on pixel density. Windows will choose 125% on a 15 inch 1080p laptop and 150% on a 14 inch. Same number of pixels, different screen size.
2
Even with disk encryption like that somebody could install a modified bootloader which steals your password. Given enough skill/resources physical access can break any digital security.
2
One of the main ones is that Win64 lacks the NTVDM, which is needed to run DOS and Win16 programs on Windows. A lesser one is that if you already have 32-bit installed you can't do an in-place upgrade to 64-bit, you'd need to do a clean install.
2
More importantly, there's also a new MTA-STS standard which turns STARTTLS from opportunistic to mandatory for supported servers.
2
I'm 99% sure it would, Raspbian is based on Debian which shipped an affected version. Fortunately the patch is already out. Update and it will be fixed. And of course it's only a real problem if you had SSH enabled and exposed to the public Internet. If you didn't enable port forwarding on your router nobody will have had a chance to access the bug.
2
I work at a local computer store and I can confirm that some OEMs enabling BDE by default has caused data recovery difficulties several times in the past few years. I can only imagine this becoming worse.
2
If light can only travel the world 7.5 times in one second that still means you'd have 133ms ping time to the other side of the planet in the best case scenario.
1
@grimslade0 130ms is the best case in the worst case scenario. In practice packets will travel physically suboptimal paths. I just did a test and got over 230ms ping to Australia. This is more than enough to make websites seem slow. Best case you have 2 RTTs to establish a TCP connection, more to setup SSL/TLS, and only then can you start downloading. And then loading things like images and stylesheets will be more of the same delays. And TCP with high latency takes a while to reach full speed and packet drops become more impactful.
1
If you have an affected system it's a huge problem. Just update and you'll be fine.
1
I think so. But on the other hand it's (AFAIK) basically guessing a random number. It might take 8 hours on average but if an attacker is lucky they'll get it on the first time.
1
Until this past Saturday (a week after this video's release) I was one of the mad lads still daily driving Windows 7, but for a very specific reason: I'm lazy. I installed it when I first set up the computer and didn't feel much need to change it while it still worked fine. Btw I'm a fan of free software and have never used IE as a primary web browser at home. I also have GNU/Linux on a good number of my computers and as a whole prefer it over Windows.
1
Apps checking the OS version string on Windows has never made sense to me. I don't know of an easy way for an app to even determine the name of the release put on the other hand getting the version number in computer-readable form is stupidly easy.
1
I don't see how disk encryption is at all related.
1
I'm saying fixing a lock won't stop anyone from breaking the glass. We're talking about two completely unrelated vulnerabilities. Disk encryption doesn't prevent kernel exploits and patching kernel vulnerabilities doesn't prevent offline attacks.
1
@evanknight8572 Absolutely nothing. If you just did a regular desktop install you probably don't have the SSH server installed, or at the very least not enabled. The client package (which is installed as part of the standard toolsuite) will have an update because of how the development cycle works but will not have the vulnerability itself.
1
Does that really work? I was worrying because I have some exposed SSH servers but they all have password login disabled.
1
@nothingnothing1799 It's also easy for a compromised client to send over passwords. And even worse the server always gets sent the full password. If the server is temporarily compromised but then patched the password gets stolen.
1
I'm most concerned about the driver signing key being released. The logical thing to do is to revoke it so it can't be used maliciously. NVIDIA could release new versions with a new key. But then what about all their old products where they won't release updated versions?
1
Wasn't the i740 Intel's first dedicated GPU?
1
Yes, this. If you take visual hashes of multiple video streams then assuming not everybody gets the same ads you can filter out the different parts.
1
It means the recovery key is not needed as long as the drive remains in the same computer and you don't change any TPM or Secure Boot settings in BIOS.
1
I would guess these are static ads like the "Try Microsoft Edge" seen if you change the default browser. If I'm wrong and it's actually sending data to the cloud, the inbuilt Windows Firewall is able to block the traffic. I'm honestly surprised MS hasn't locked down Windows Firewall to prevent blocking of Microsoft services.
1
If somebody isn't running Javascript why does it matter what version they have? AFAIK almost everything new in over ten years has been new JS APIs.
1
@hanro50 I haven't seen a browser popup an error dialog for Javascript since IE 5. I hadn't heard of fetch before but can't it be tested for by something like if("fetch" in window){useFetch()} else{useXHR()} ?
1
Version number parsing is useless for most purposes as user agent strings aren't standardized and different users may have different features enabled or disabled depending on their installation. Nowadays (and for over 15 years) you've been able to test for specific features which is more reliable than parsing strings.
1
@fish3977 Running OpenSSH 6.7 here, immune to this problem. Fortunately port 22 is not directly accessible. On the other hand, I have a system which has OpenSSH 9.2 directly exposed (although at least not on 22). I'll need to update this ASAP.
1
@LubosMudrak Google started that stupidity over ten years ago. If a webapp is new enough to parse version strings as two digits instead of one it's also new enough that the stupid rapid incrementing version numbers were around.
1