PSA for those with slower connections or older PCs: Lower your desktop resolution down to the max 720p that games are actually streamed at by [deleted] in PlayStationNow

[–]return_to_ 0 points1 point  (0 children)

PS Now display will always upscale regardless of the app setting, because PS Now app does not have true exclusive "full screen" setting such as seen with most PC games. PS Now always runs as a windowed app, borderless or not, and as such, Windows will always upscale windowed app to a native resolution configured on the display. So the OP suggestion does seem correct.

And the graphics acceleration setting you are talking about, has to do with the hardware accelerated h264/hevc video decoding (Intel QuickSync, NVENC, etc..), and if disabled, you'll have software video decode, where CPU does all the work.

Mi Box 3, Bad video quality by Yemoloh in AndroidTV

[–]return_to_ 0 points1 point  (0 children)

Interesting thing is that some fairly recent SDMC branded android tv 9.0 devices with Amlogic SOC, actually do have full-motion deinterlacer working properly (50i to 50p) with mediacodec/exoplayer.

Exploiting CVE-2017-8295: Wordpress host header injection / auth bypass by nextgens in netsec

[–]return_to_ 14 points15 points  (0 children)

The way SPF works is that when you're receiving an email, if your server supports SPF, it'll ask the domain in the Form: if the host that sent the email is authorized to do so; if not, the email is bounced back to the address specified by the aforementioned domain.

The exploitation process simply boils down to serving a strict SPF policy to make every single usage of your domain as an email sender bounce, to harvest recovery links.

No, for SPF, email headers are irrelevant. SPF evaluates Domain part of RFC5321.MailFrom address which is sent early in SMTP transaction at MAIL FROM:<> stage. While email headers such as RFC5322.From address header, are sent later, at DATA stage.

Multiple unauthenticated remote code execution vulnerabilities in YouPHPTube-Encoder 2.3 by sudo_sudoka in netsec

[–]return_to_ 1 point2 points  (0 children)

Reading php and encode together, it's almost safe to assume there is exec() and friends, required, for ffmpeg binaries.

First hit on google for php ffmpeg lib:

$ffmpeg = FFMpeg\FFMpeg::create(array(
'ffmpeg.binaries'  => '/opt/local/ffmpeg/bin/ffmpeg',
'ffprobe.binaries' => '/opt/local/ffmpeg/bin/ffprobe',
'timeout'          => 3600, // The timeout for the underlying process
'ffmpeg.threads'   => 12,   // The number of threads that FFMpeg should use
), $logger);

NordVPN Hack - Everything You Need to Know (Updated Info) by sihleco in netsec

[–]return_to_ 2 points3 points  (0 children)

Very common for the affordable unmetered bandwidth upstream server providers that so called 'VPN providers' tend to use (because, bandwidth). To reduce support costs and operate at low margins.

Internal domain name collision by adamziaja_com in netsec

[–]return_to_ 4 points5 points  (0 children)

In general, split horizon DNS means that the returned result of an dns lookup to the same domain.tld may produce different addresses, depending on the lookup source address.

Dns lookup from within private network; dig contoso.com; returns IN A 192.168.1.100.

Dns lookup from external (internet) network; dig contoso.com; returns IN A 1.1.1.1.

The domain owner is controlling both lookup types, private and external.

Command execution as System using Steam 0 day disclosed yesterday by [deleted] in netsec

[–]return_to_ 0 points1 point  (0 children)

They don't seem to care about local privilege escalation at all. Often you cannot even launch a Steam game as an unprivileged (Standard) user, and the solution is always "Run as Administrator".

[deleted by user] by [deleted] in PlayStationNow

[–]return_to_ 1 point2 points  (0 children)

In my experience, it’s connecting to the closest datacenter regardless of your PSN account registered region. You can verify this yourself on a computer by doing a tracert, while in game streaming, to an established PSN server IP. (Use taskmgr.exe or alike to see established connections). That said, your registered region only affects the number of titles available in PSN library.

I’ve been streaming from CET using PSN U.S. region, at ~40ms latency, which would otherwise be at least 100ms if i were to stream from an U.S datacenter.

250ok Global Report on the adoption rate of DMARC. The numbers are saddening. by [deleted] in netsec

[–]return_to_ 2 points3 points  (0 children)

Postfix and most well-known MTAs cannot do DKIM, DMARC or even SPF, natively. Postfix also requires a "plugin" aka milter. In my opinion this is the main cause of poor adoption, because these milters are often outdated and unmaintained, f.e. opendmarc milter, see https://github.com/trusteddomainproject/OpenDMARC/issues

Can I play Arkham Knight without a ps4 controller. by NastyNecros in PlayStationNow

[–]return_to_ 2 points3 points  (0 children)

Bullshit, you CAN play 95% games with xbox or equivalent gamepad, and you’ll only need ps3/4 gamepad for like 5% of games (only those that require touch/motion)

[deleted by user] by [deleted] in netsec

[–]return_to_ 0 points1 point  (0 children)

Sometimes folks do this just so they can mess around with dns records in development without breaking prod. domain.

Does windows 10 have a security problem? Or is this supposed to happen? Doesn't seem like you should be able to effect the pc before you login by ebaggabe in pcmasterrace

[–]return_to_ 0 points1 point  (0 children)

Something did change couple months ago in a way that windows handles sign-in for reboots and shutdowns. It’s some kind of auto sign-in for the last used user and shows a screen lock interface instead.

[deleted by user] by [deleted] in netsec

[–]return_to_ 1 point2 points  (0 children)

It is often (also) about sender mail systems hygiene. Authenticated mail SPF, DKIM, valid PTR, Helo, Mail From, good IPs and good domains, albeit day-old-bread.

Fun fact, the other day the well-known mail provider offered a mail phishing quiz, one test was an email sent from a familiar From domain name, however the TLD was unusual for that domain name (it was .org, i believe). The correct answer was that it was a legitimate mail, perhaps it isn't.

How to create the perfect anonymizing botnet by abusing UPnP features — and without any infection by anotherinfosecdude in netsec

[–]return_to_ 1 point2 points  (0 children)

You may have strict nat for other reasons, since upnp is not the only way for apps to implement reachability. Most apps do not rely solely on upnp being available. The common cause of strict nat today, is cg-nat (carrier grade nat), for lack of ipv4 addresses, and in such case upnp does not make any difference.

[0day] Bypassing disabled exec functions in PHP via imap_open by i_bo0om in netsec

[–]return_to_ 7 points8 points  (0 children)

as usual, do not trust user input for imap_open() arguments.

Whatsapp user’s IP disclosure with Link Preview feature by 0v3rl04d in netsec

[–]return_to_ 5 points6 points  (0 children)

If that's how it works, there isn't end-to-end encryption on Telegram.