I read it as the author is / was going through the vulnerability disclosure process with Microsoft and they're annoyed for unclear reasons and decided to publicly disclose, rather than being an insider.
I've watched genius-level IQ people get fired time and again because they don't know how to work with others at a basic kindergarten level.
The secret here seems to be that Microsoft caches the key somewhere even when it's supposed to be only in the TPM! That's a pretty big revelation IMO.
Not what happened here (I reserve my judgment wrt the promised TPM+PIN exploit).
In the default TPM-only mode of BitLocker, the secret is in fact in the TPM, which will (as instructed by Windows upon key creation) release it to the correct OS running on the correct computer. Notably not in the picture is any user-provided data: measured boot is the only protection. It is only the correct programming of the OS that makes it request an account password (completely unrelated to the disk-encryption cryptography) before letting the user poke at the disk, which the OS can at that point already decrypt.
Well, turns out the programming is such that if you ask politely it’ll just pop an Administrator(?) shell.
Yes this is the one I'm referring to.
I have noticed it myself, it has happened to me that my system rebooted to install updates and it did not pass through the blue TPM pin entry screen at that point. That was a big red flag for me. A normal reboot always does that, even a 'hot' reboot.
A good or corporate BIOS/etc. updater will do this to avoid requiring a recovery at the next boot
But the files on the disk must still be decrypted somehow. The key must be stored somewhere.
According to this: https://windowsforum.com/threads/pause-bitlocker-before-bios...
> BitLocker is now suspended, which means the drive remains encrypted, but Windows temporarily stores the unlock information so firmware changes won’t immediately trigger recovery.
In TPM-only mode, I only see the screen—which asks for an recovery key that serves an alternative to the TPM-borne secret, not for whatever you are calling the “TPM PIN” here—whenever I update the firmware or the bootloader (the latter from the other side of the dual-boot setup). Otherwise it boots straight to the login screen, which meshes with the measured-boot-only theory of operation I’ve described above. There’s nothing nefarious in this part, even if I think it exposes an unwisely large attack surface (e.g. the USB stack). I suspect you simply reboot so rarely you’re never hitting the happy path.
This is not a standard option, I think it can only be set through a group policy.
I knew a contractor that developed a habit of not paying his workers for a short time. After people started walking off job sites with his tools and showing up at his house demanding to get paid, he magically found the money to pay them.
It’s pretty unsurprising how vindictive regular people rapidly become when they’ve been ripped off.
Most large companies — including Microsoft [1] — have an internal affairs call center where you can anonymously report issues of malfeasance — assuming that's what happened here.
[1] https://www.microsoft.com/en-us/legal/compliance/sbc/report-...
You might be a 100x rockstar developer. You might even be the best software engineer in the world.
But the vast majority of good software is built by teams of people. It doesn't matter how good you are if you can't play nice with others.
I'd rather have a team of "merely" good engineers than one "rockstar" creating a toxic work culture. Fuck that noise.
This generally means the person might not leave their cubicle much or give feedback frequent enough, but this doesn't mean they are not motivated to help others or share knowledge. One can approach and ask a question and get tons of help immediately.
How I know? That's me. I look like a cave dweller from a distance, but I'm not. The only difference I have is human interaction sometimes drains me a lot, so I just concentrate and work, yet everybody get their help immediately if they need them.
Also, no, I don't bite or belittle people. On the contrary.
Assuming the worst in others is bad. If I worked with you, I'd be looking for somewhere else the moment I found out how you think about me.
Remember. People don't leave bad jobs, but bad managers.
Yes if you put a someone who can't work on a team on a team and expect team work then that will not work. But that's obvious, so then don't do that. Expecting a homogeneous workforce isn't realistic or optimal.
Hard disagree.
Some of the best, most successful, and most impactful projects I've ever been on had no "rockstars" at all.
People who refer to themselves as rockstars is a huge red flag.
And I didn't say I'm not capable of being part of a team. Just that I need to have my own responsibilities within a team. I can't deal with micromanagement or excessive coordination like 'standups' every day.
The guy saying that he has been accused of "not being a team player" isn't literally quoting his management here. He's summarizing that his immediate supervisors don't like him because he's unwilling to enter in some patronage like relationship with them.
The fact that you gave the benefit of the doubt to some faceless employer here instead of an actual person recounting his experiences is really sad and maybe ought to be reason for you to rethink your biases to jump to the conclusion that this guy is a toxic loner. Sounds like you're projecting hard here from some other experience.
I can relate and empathize. And also provide this suggestion based on my own similar experience: if you can't provide evidence (e.g. doctor's diagnosis) that you are "special" or "not capable of that", then they don't have to care and will take steps to force you out. I wish you all the best.
And I can see others already blaming them for relying on the vulnerability for living expenses, but if we can hold the hyper-rationalization for a second, we shouldn't be against the person who expected an organization with more money than God to uphold a deal for relative peanuts, right?
Like yes we all get that large orgs make spending $5 very hard, many claps for being the in-group, but their frustration would be understandable.
It's like suggesting someone was relying on a lottery ticket to payout to survive.
Acknowledged how orgs work, separated blaming the org from sympathizing with their reaction, tried to separate the prudence of their actions from the sticky situation they'd still be left in by the orgs actions...
But it was for naught: people are really ingrained in a weird "might-makes-right" model of corporate operations. "Larry Ellison is a lawnmower" was supposed to be a jeremiad but now it's more like a guiding principle that we browbeat anyone for questioning.
You're assuming that there was a deal that wasn't upheld. I don't think we have enough information to assess that. This person's blog posts do read as being somewhat unstable. There's even someone in the comments seemingly genuinely trying to be helpful: "Just wondering if you’re BiPolar (like me) and see a different reality than what is real. Been there."
Someone with a vulnerability worth as much as a two bedroom apartment?
Or that entire holy trinity.
Had a job at MSFT once, but is now struggling to earn money at all and is posting heart breaking stuff on Twitter. https://x.com/WeirdQuadratic
Hope she finds a way out and a more stable and fun job in the future.
Me not hiring someone doesn't mean the skills aren't valuable.
This could be rewritten as “because they aren’t you”, which is true but not a meaningful or educational answer.
Sure. And that’s a meaningful answer to the question.
“people with values different from yours, presumably” is a condescending nonanswer.
If someone has this kind of exploit and can't get a bug bounty for it, and desperately needs the money, he can sell it for 100k+ in a shady black market
I've been pretty convinced this is SandboxEscaper for awhile now.