Born's Tech and Windows World

It's worth noting that AMD had worked with Microsoft on Zen-specific optimizations in the past, too. Ahead of the Zen 2 launch, they touted improvements of up to 15% from Windows scheduler changes for CPU topology awareness [1]. And with Zen 5 having higher cross-CCD communication latency than the previous generations [2], it probably gets an even harsher penalty from poor scheduling. While the less-than-stellar reviews for the 9950X are already out, AMD's recent strategy of staggering releases for desktop parts (first the regular, then the X3D SKUs) can improve this generation's perception, assuming there are meaningful performance gains they can reach in software for Zen 5 prior to the X3D release. [1] https://borncity.com/win/2019/06/30/windows-10-v1903-optimization-for-… [2] https://chipsandcheese.com/2024/08/14/amds-ryzen-9950x-zen-5-on-deskto…

When I hear 7zip I associate it with security vulnerabilities. I remember reading a couple of articles last year that said 7zip was maintained and distributed by a single person with not-stellar security practices, and most mirrors online are hosting old, insecure versions. Therefore I wouldn't recommend it to anyone that doesn't "know what they're doing" wrt security. source: https://borncity.com/win/2018/02/21/security-risk-avoid-7-zip/

I have been following this shit show since the beginning. It was definitely not a responsible disclosure, but given the track record of Austrian and German justice with white hat hackers, I guess it is somewhat understandable. The hacker took it upon himself to inform every customer of the weak security of their data. After the third update where the startup outlined their steps to fix the situation, the hacker added an addendum to their website with a link to the full incident report (in English). You can still find it on the web archive: https://web.archive.org/web/20251008231051/https://security.localmind.… Direct link to the incident report (in English): https://anonfile.co/CZqiAMqc3sYyvHZ/file The hacker accuses them of vibe coding their entire infrastructure and thus not understanding what they have created. And if only half of the content of the incident report is true, I am inclined to believe him. If you look at the founders and employees on LinkedIn, not even the CTO seems to have any IT-experience. Which in itself wouldn't be that big of a problem but they explicitly marketed their product as extremely secure and local. Seems very hypocritical to me to then not even give a second thought about securing your own infrastructure. All in all with how they handle it, the startup seems to be just trying to save their image without really working on the flaws in their security, but here is hoping that I am wrong for the sake of their customers. Some more links to…

It's hit and miss. They have one of the largest cyber security operations worldwide and regularly track and dismantle criminal operations. There's some great people working there. Then there's Azure. Which is used by large organizations and you would expect it to have the utmost care when it comes to security. But it often does badly, in several instances it allowed different tenants to access information from one another, something unheard of on AWS. For example: https://www.securityweek.com/microsoft-patches-azure-cross-tenant-data… or https://www.theregister.com/2024/06/05/tenable_azure_flaw/ or https://borncity.com/win/2023/08/03/microsoft-as-a-security-risk-azure… There are so many cross tenant vulnerabilities that there could be some overlap in those URLs, and it's a bit late at night for me to read those carefully, but you get the idea. They do get the most flak about Windows, which used to be a non networked, single user OS.

Last month, my friend's HP Laserjet Pro printer started flashing "SUPPLY PROBLEM" error message and wouldn't print anything. Apparently, all he did was update the firmware after a message popped up on the printer urging him to do so. Well, that firmware update included new DRM checks for non-HP toners. The printer would just refuse to work with 3rd party toner cartridges. I had to help him and had to find an old firmware and downgrade to an older one which didn't contain the DRM. The firmware didn't come from HP's website because they deleted all old versions so I downloaded the version off someone's Google Drive. Who knows if that FW contains something malicious. Also, I had to install Windows because old firmware update is a Windows program. You're SOL if you use macOS or Linux. This incident didn't make my friend go and buy $200+ worth of original toners like HP intended. All it did was make him anxious of updating anything and of using HP products and has wasted a lot of his and my time. He said he won't buy another HP printer again. If you want to learn more, search for "HP supply problem" with your fav search engine. Or see this link on HP support forums [1]. And don't update your printer's firmware if it's working fine... because who knows when they'll disable FW downgrade option and you'll be stuck with a DRMed printer. Edit: Just in case you found this comment through a search engine or this has affected you, I recommend downloading FW from this page [2]. It…

Mine doesn't have the allow downgrades option I think. But this worked for me: > "Unplug printer’s power cord from the back of the printer Press and HOLD the power button Plug power cord back in (keep holding power button) The HP logo will appear then the screen will go blank Hold power button for 10 seconds and then release it Press HOME BUTTON ONCE (top left) Press RETURN/BACK ARROW ONCE (bottom left) Press HOME BUTTON TWICE That should bring up the control screen NOTE: On my printer I couldn’t see the home or back buttons lit up but if you press to the left of the display area the buttons still work. Press MFG (Top Left) Press NEXT (Top Right) The screen idled with some weird looking grid design and status bar so I pressed the Power button and it went to the main printer screen on the display." Source: https://borncity.com/win/2018/09/19/blocks-hp-firmware-update-third-pa… And for the love of God don't let your printer out to the Internet any more, they may push a malicious update and disable this workaround in the future (or might have done it already in newer firmware?).

> Every step towards "encrypt all the things" increases the cost of that interception. That's not the case at all, and a very dangerous idea. Some steps drive increased centralization. Increased centralization makes interception and filtering easier. The better solution is to push domain authentication to after the secure channel is established. That doesn't protect against active MITM snoopers, but neither does TLS ESNI. Worse, TLS ESNI will drive people to use centralized DNS-over-TLS service providers. Mozilla+Cloudflare's "free" DNS service barely made it out of the gate before it was hijacked by the Great Firewall (not even simply blocked). See https://borncity.com/win/2018/05/30/cloudflare-dns-service-1-1-1-1-hac… and https://blog.cloudflare.com/bgp-leaks-and-crypto-currencies/ Of course, with DNS-over-TLS you would know (maybe) that there was a MITM. But that's no different than DNSSEC. And there's nothing you could do about it, anyhow. Securing DNS, and specifically keeping DNS queries private, is NOT a solved problem. Indeed, it's not even a solvable problem because of the nature of DNS--the need to centrally coordinate registration of human readable identifiers. The only real "solution" is anonymization via techniques like onion routing (e.g. Tor), which anonymizes the requester, not the responder. Advocates will tell you that TLS ESNI improves requester anonymity by aggregating users behind "trusted" intermediate resolvers, but that's largely…

It's even worse now https://borncity.com/win/2023/03/11/windows-10-11-mock-folders-as-uac-…

The founders of the Miniaturwunderland Hamburg were in the media describing how they push back against smartphones and media in their family life: https://www.ardmediathek.de/video/ndr-talk-show/miniatur-wunderland-gr… Strange coincidence: shortly after they were hacked https://www.borncity.com/blog/2025/11/12/miniatur-wunderland-kreditkar…

After this https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker… Microsoft patched out support for self encrypting drives.

They are doing it, far more than you'd expect. "Thanks to the GDPR, users in Europe who download the Outlook for Windows app, will be greeted with a modal pop-up dialog that displays a user agreement and requires its users to consent. The breathtaking aspect of this is that the dialog starts right out stating: “We and 772 third parties process data to: store and/or access information on your device, develop and improve products, personalize ads and content, measure ads and content, derive audience insights, obtain precise geolocation data, and identify users through device scanning.” https://borncity.com/win/2024/01/18/new-outlook-app-monitoring-and-sur…

> You can buy $10 legit keys These keys may activate just fine, but they are not "legit" in any case. Most turn out to be acquired in illicit ways (MSDN licenses, ...), and a couple years ago here in Germany this led to massive amounts of criminal cases [1]. [1] https://www.borncity.com/blog/2021/03/05/betrug-mit-office-windows-liz…

I don't think that's fair, especially since they have already dropped it. Dropping it doesn't change the duplicity that existed for almost 2 decades. Hadn't heard of this one before. Do you have sources? https://borncity.com/win/2022/03/22/firefox-installer-weist-dem-browse… https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf

This is old news, right? They kicked me off back in 2020 with all the other synology users: https://borncity.com/win/2020/08/28/amazon-kappt-synology-nas-backups-… From the migration guide they sent to synology users via email back then: For other files: 1. If you haven't already, download the Amazon Cloud Drive app. Or, you can use the web version by visiting: https://www.amazon.com/clouddrive. Check to see if your content includes encrypted files or special file formats. If your files are encrypted, you'll need to save the content in a different format. ... 2. Upload your unencrypted content to Amazon Drive, using the app or website. (Again, this was back in 2020...)

Not the first of such stories either: https://borncity.com/win/2020/08/16/microsoft-kontensperrungen-und-die… This is why I explicitly make on-site backups of anything that's in the cloud and don't store my passwords with Apple. If they suddenly decided I had CSAM for some reason, I'd be locked out of everything.

To be clear the parent post and mine were discussing self encrypting drives. Drives which handle the encryption and decryption on drive instead of relying on your CPU. This is what is insecure. https://www.tomshardware.com/news/crucial-samsung-ssd-encryption-bypas… https://ciso.uw.edu/2018/11/16/bitlocker-ineffective-on-self-encryptin… https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker… Self encrypting drives are have been insecure for years.

You can enable experimental support for TLS 1.3 on Internet Explorer for Windows 10 (not for older Windows) in the advanced options tab. You should also disable third party add-ons and enable enhanced protected mode. If you also disable jscript.dll[1] you will get all the benefits of the IE shell that was posted here without having to download anything. [1] https://borncity.com/win/2020/01/18/warning-0-day-vulnerability-in-int…

"Users of Windows Vista can download the updates (Monthly Rollup or Security Online) of Windows Server 2008 from the Update Catalog and install them manually." https://borncity.com/win/2019/05/15/critical-update-for-windows-xp-up-… But this is definitely confusing. MS explicitly offers patches for Win 7, Server 2008, Server 2003, and XP, but there's no "Vista" link visible. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE… https://support.microsoft.com/en-us/help/4500705/customer-guidance-for…

I can only give German articles about this topic: > https://www.golem.de/news/datenschutz-windows-10-koennte-arbeitnehmer-… > https://www.heise.de/ix/meldung/Datenschutz-Windows-10-koennte-Arbeitn… > http://www.borncity.com/blog/2016/10/31/windows-10-und-das-datenschutz… > https://www.gi.de/aktuelles/zur-diskussion/detailansicht/article/unter…

> Modern SSD controllers encrypt all data by default. Contrary story from 2018/9: > The security researchers explain that they were able to modify the firmware of the drives in a required way, because they could use a debugging interface to bypass the password validation routine in SSD drives. It does require physical access to a (internal or external) SSD. But the researchers were able to decrypt hardware-encrypted data without a password. The researchers write that they will not release any details in the form of a proof of concept (PoC) for exploit. * https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker… > Microsoft is aware of reports of vulnerabilities in the hardware encryption of certain self-encrypting drives (SEDs). Customers concerned about this issue should consider using the software only encryption provided by BitLocker Drive Encryption™. On Windows computers with self-encrypting drives, BitLocker Drive Encryption™ manages encryption and will use hardware encryption by default. Administrators who want to force software encryption on computers with self-encrypting drives can accomplish this by deploying a Group Policy to override the default behavior. Windows will consult Group Policy to enforce software encryption only at the time of enabling BitLocker. * https://msrc.microsoft.com/update-guide/en-us/vulnerability/ADV180028 > Although Windows ships with its own full volume encryption tool called BitLocker, SSDs that claimed to…

It is a little more problematic than that: The Gematik GmbH is in part managed (owned?) by the German ministry of health [0] and some health organizations like the Association of Statutory Health Insurance Agencies. That says something about the 'risks' the Gematik takes (Hint: none). Similar story: Earlier this year some health card readers, certified by the Gematik had a bug. They wouldn't read certain cards that supposedly were electrostatically charged. The solution was a grounding device connected to the USB port of the card reader. [1] This thingy cost the doctor's practices another 100 bucks even though this clearly is a design flaw by the manufacturer. They can do pretty much what they want at this point and the physicians and hospitals just have to cough up the dough. [0] https://de.m.wikipedia.org/wiki/Gematik [1] https://www.borncity.com/blog/2022/01/16/problem-mit-statischer-auflad…

> I looked at the USB 3 spec and couldn't find any guarantee that there was any number of devices you could plug into hubs and have it work. It's a controller and/or BIOS limitation[1][2]. The complication is that while USB devices can be addressed using 7 bits = 127 devices total, each device usually creates more than one endpoint, and each endpoint consumes controller and system memory resources. The BIOS allocates the memory, and the amount is apparently hardcoded (guess a setting would be too difficult). If you have many USB 3 devices with a lot of endpoints, that memory runs out quickly. In addition, each endpoint reserves some bandwidth, so the uplink needs to be able to provide that bandwidth. [1]: https://community.intel.com/t5/Embedded-Intel-Core-Processors/Hardware… [2]: https://borncity.com/win/2019/09/06/windows-10-not-enough-usb-controll…

> It seems like microsoft should have just said that fixing this isn’t a priority right now, instead of saying it couldn’t be done. The problem is that if performance isn't a priority, and then you finish all of your features and ship your 1.0, it begs the question: when exactly are you going to make it fast? Never. That's when. Once you've shipped something, people get assigned to other projects, or new features. Worse, you're now locked in to bad architectures that too much code depends on for changes to be easily made. Casey makes the point that the Windows Console IO API is inherently bad, and using it guarantees an unfixable bottleneck. I've seen this attitude in Microsoft's software everywhere I look. They simply flat out ignore performance as a feature, and almost never come back to fix it. Easily less than 1% of the time, no matter how important it is. Even when people make a lot of public noise about some performance issue (like in this case), it quickly turns out that it is now unfixable because of the endemic apathy towards optimisation throughout that organisation. E.g.: Windows Updates. I have gigabit internet and a high-end SSD, yet it takes something like an hour to apply patches! https://borncity.com/win/2018/06/01/windows-server-2016-slow-updates/ That to me is simply unfathomably bad programming. How hard is it to download a file and copy it to a folder? The simpler code here would be orders of magnitude faster than whatever craziness they're doing.…

> Especially, as Windows updates, given basically infinite combination of hardware (often broken) and software (broken even more often) are super rock solid. Apart from breaking SSDs [0] less than two weeks ago. And deleting your certificates in November [3]. And breaking Kerberos in November [4]. And moving your files to another user in February [1]. And breaking their own reset feature in February [2]. All of those are massively disruptive and breaking changes. And all of them have Windows Update to blame (especially the moving files bug) - not some buggy underlying hardware that Microsoft had to work around. [0] https://borncity.com/win/2020/12/18/windows-10-20h2-chkdsk-damages-fil… [1] https://www.howtogeek.com/658194/windows-10s-new-update-is-deleting-pe… [2] https://www.zdnet.com/article/microsoft-pulls-security-update-after-re… [3] https://docs.microsoft.com/en-us/windows/release-information/status-wi… [4] https://docs.microsoft.com/en-us/windows/release-information/status-wi…