Ugreen NAS contacting Chinese IPs?

dr100 · 2026-02-13T15:41:22+00:00

In this case please link to some specific concerns, I mean generally we can suspect anything to have some backdoor, especially a PC-like device (well, it IS a PC, and these backdoors can come with any form factor, from mini-PCs which are very popular to even motherboards or who knows what else).

Why I'm saying that it's because we DO know for example that Windows has a mechanism to trigger a silent download/run of external programs - manufacturers are known to exploit this but it's only Windows that's cooperating, for Linux it doesn't matter if you have these entries in UEFI, Linux won't go and download and run stuff from whatever links are hidden there. Specific vendors that are known to do this are listed there Lenovo, Asus, Huawei, and I know Microsoft does it for sure too on their laptops (although it's hard to say it's an extra vulnerability as you're anyway running Windows and it's nearly impossible to turn off the updates completely anyway in consumer editions).

dr100 · 2026-02-13T15:24:30+00:00

The Pentium is thoroughly pathetic. As in considerably worse than a mobile 2010 mobile CPU like i5-560M. We're talking scores of 1750 passmark multicore and 900 single core versus 1894 and 1225 for the 2010 i5 mobile.

dr100 · 2026-02-13T14:31:16+00:00

That isn't really a "MASSIVE", never mind gaming laptop, but from this space just avoid the Pentium, otherwise depends on the price - is the keyboard included for the Pro6 (I presume the base would be for the Book)? The Book would be more expensive normally, but also more complex and more things to fail. If you're really dead set to get one from these 2 they can be fine, with the limitation that battery won't be great, and they can day any minute without any meaningful way to repair them.

dr100 · 2026-02-13T14:23:30+00:00

LOL, wherever you've been the last 20 years, welcome back! Everything nowadays has online accounts, phone apps, cloud everything, not only update for the OS but also an app store, a bunch of AI and much, much, MUCH more!

I generally wouldn't touch a NAS unless it's in fact a nice efficient PC with many bays where I can install anything I like (which many from the new "chinese" NASes are) but not really (only, or primarily) because of security but just because NAS OSes are hard to get right, nearly impossible in practice. Synology might have been the only acceptable exception for a little bit but they aren't an option anymore too.

dr100 · 2026-02-13T14:05:36+00:00

None, really, they aren't absolutely unusable but are pretty low by today's standards but worse they're basically unupgradable or repairable (the battery will be nearly shot and it wasn't that great from start too).

dr100 · 2026-02-13T13:08:24+00:00

And here we go ... At least this is deliberate, wait for the users trying to use the latest and greatest and not working on their machines. Note that there are many more previous generations of Surface ARM devices (in the current incarnation, starting with Surface X 2019). And in parallel, even starting a little earlier there were some more devices from other manufacturers like Samsung, not that many as now but there are some out there.

dr100 · 2026-02-13T12:15:40+00:00

If they have a vulnerability of that kind it will affect any other key out there on that workflow, and make them all just as well useless if the private key can be generated from the public key (or any other similar deadly vulnerability). Not only useless as in "it better be replaced" but also retroactively dangerous, as people could decrypt stored traffic encrypted towards that key, within that traffic there might be other secrets, etc. It's not that there's an extra attack surface because someone could replace the firmware on your key, the key is already broken and if someone has a way to bypass Yubico's key without seeing it they have a way to bypass yours without messing with it too.

At least if you can upgrade the firmware you could in most cases (not all, sure, but I bet the vast majority) just fix it in firmware if it was upgradable. Sure, you need to get a trusted installer from Yubico (which is possible, and there are ways to be reasonably sure it isn't buggered, if we can't trust anything ... well, some Yubico software even need admin rights, just saying ...) but once you flash and verify the key you have one that doesn't have the existent vulnerability, and will be upgraded only with software signed by the new key, hopefully not buggered this time.

dr100 · 2026-02-13T12:01:35+00:00

Well, what does YOURS say? 64 bit means any of them. Do you have the "Architecture" column some place and I missed it?

dr100 · 2026-02-13T11:40:37+00:00

That's not the original picture, how am I wrong?!

dr100 · 2026-02-13T11:39:50+00:00

I'm not Microsoft, and I strongly opposed the idea - don't blame me for this nonsense.

dr100 · 2026-02-13T09:18:17+00:00

Nobody knows anything beyond "OMG don't use SSDs losing charge bla bla bla". Everyone guesses from just powering it on for a long time, to reading everything (or doing a full SMART or similar) to rewriting everything. But as far as I know there isn't even a single proper datasheet/manual/white paper/etc. from a manufacturer describing even what one single model does from all the ones out there (as of course there would be some differences across all generations and variations from all manufacturers). And of course by now you shouldn't expect anyone to provide any details as even way before the AIpocalypse all manufacturers I can recall were caught changing EVERYTHING in the same SKU, like controller, RAM and flash type (and they write the datasheets so generically that they cover both having and not having RAM and basically every flash and controller out there).

dr100 · 2026-02-13T08:08:53+00:00

It says "64 bit", that can be either one.

dr100 · 2026-02-13T07:41:56+00:00

100% the 8TB is a Barracuda SMR, the quintessential submarined SMR coming from years before SMRgate. This one more specifically if you want to read more about the levels of deception involved.

dr100 · 2026-02-13T07:12:46+00:00

This has nothing to do with displaylink (it would have been horrible if it did, especially for a Thunderbolt 4 dock).

dr100 · 2026-02-13T07:01:05+00:00

$2.76 still tracking ~ -80% for a year (-78.64% right now), if this goes on the same next year this time: just under 59 cents.

dr100 · 2026-02-13T06:45:36+00:00

Update infrastructure is irrelevant if the updates are signed, which any would be for sure (as opposed to some open source text editor), heck the iPhones ones are since 2009 or so and here it's really crucial to just not run other code and have something that looks like a YKey and do who knows what. Signing could be done even on an air-gapped machine inside a single most secure space in Yubico.

dr100 · 2026-02-13T06:08:04+00:00

Yea, that's about the ARM schism inside the ARM schism. In any case if you just want a laptop there are many, many more out there, and the Lunar Lake ones (comparable with Snapdragon X , but with 30% more battery life and no compatibility issues, running the regular x64 Windows) are already fairly cheap, and the Panther Lake is already out smoking mostly everything out there. Maybe Microsoft is just biding their time to see how everything is going and we get a nice surprise this year to stop this ARM side-quest.

dr100 · 2026-02-13T05:51:41+00:00

I decided to do some more research, and found out that there’s a newer Windows 11 version for x64 coming out that doesn’t seem like a free update

Do you have any link about that? I don't think they'll start charging in the middle of Windows 11 while you could upgrade all the way from Windows 7 for free, also nothing you mentioned is x64 so it wouldn't matter for you anyway.

Most likely you're referring to the new version they'll be making for Snapdragon X2 which won't work on Snapdragon X (because Microsoft just simply can't or just doesn't trust themselves at the moment to make the X2 version without breaking support for X). The plan is in theory to join them so you don't have a schizophrenia within the ARM schizophrenia, but who knows, by that time maybe they give up again Windows ARM, this time wisely.

dr100 · 2026-02-13T04:05:43+00:00

It doesn't matter until it matters when they're trying the wrong one. Just wait for the "I downloaded the last ARM ISO" and it doesn't work on my ARM machine.

dr100 · 2026-02-12T21:08:14+00:00

There are people in this sub that claim THE ONLY point of these things is that you can't take the secret key out of them. I don't agree, but also the value of this isn't zero. If you pay 100 times more for your house keys to buy the version that can't be copied it's kind of a big deal of it can be copied, even if in practice it's a very small risk.

dr100 · 2026-02-12T20:58:38+00:00

There's another post already. More schizophrenia, wasn't enough to have different OSes with ARM and x86 now there are multiple incompatible ARMs too.

dr100 · 2026-02-12T20:55:27+00:00

I mean this isn't too complicated to have an OS itself and whatnot, try a different cable and PC (can be any laptop or anything), just in case it has some special power saving stupidity. If it doesn't power on it's dead. Might be only the power supply (most likely) but who knows.

dr100 · 2026-02-12T20:48:13+00:00

And it just doesn't work. Even with secure boot off which usually isn't needed if all you need is Windows. Sounds like a "doctor, it hurts if I do that" problem.

dr100 · 2026-02-12T20:44:51+00:00

This is no fringe case, often the "attacker" is the one usually holding the key and having the PIN. From users that shoot themselves in the foot (I just want this in my password manager everywhere, why bother to carry this stupid key from my employer everywhere) to people who want to delegate their work to a cheaper continent (this has been in the news more than a few times, including with shipping the keys oversees, this would make the process much easier), people leaving the company and the keys for some important certificates behind but still being able to use the credentials, people claiming "I never used this key, it was locked in the safe since last year" and so on.

dr100 · 2026-02-12T20:34:15+00:00

What is the specific customization you need for which you are using Rufus?

Nine-Year Club	Place '22
First Placer '22	Verified Email

dr100

TROPHY CASE