Light

Episode #978 Quiz

The rise and fall of code.microsoft.com
Date: 2024-06-11 | Length: 2 hrs | Episode page at twit.tv

About this episode

Microsoft’s Recall changes now default snapshot saving off, require Windows Hello enrollment, proof of presence, just-in-time decryption, encrypted index storage, and Secured-core/Pluton hardware. Google and Apple also push persistent credential storage and passkeys. Microsoft’s code.microsoft.com dangling-subdomain honeypot collected exploit intelligence, while Linux CVE overproduction and code-signing HSM mandates complicate security workflows.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific change did Microsoft announce for Recall’s default behavior before the June 18 preview release of Copilot+ PCs?

Question 1

According to the episode, what specific change did Microsoft announce for Recall’s default behavior before the June 18 preview release of Copilot+ PCs?

Recall will be removed from the Copilot+ preview entirely Recall will be off by default unless the user proactively enables it Recall will be on by default unless the user disables it after setup Recall will only run after the user manually launches it each time

Question 2: What did Microsoft add as a requirement before a user can enable or use Recall on Copilot+ PCs, according to the episode?

Question 2

What did Microsoft add as a requirement before a user can enable or use Recall on Copilot+ PCs, according to the episode?

A TPM 2.0 module and BitLocker recovery escrow Windows Hello enrollment and proof of presence A Microsoft 365 enterprise license and Intune enrollment A separate Recall recovery code printed during onboarding

Question 3: Why did Microsoft turn code.microsoft.com into a honeypot, according to the episode?

Question 3

Why did Microsoft turn code.microsoft.com into a honeypot, according to the episode?

To serve as a long-term backup for Microsoft’s public code repositories To provide a public sandbox for customer vulnerability testing To collect threat intelligence from attackers targeting Microsoft To host Visual Studio documentation after an internal migration

Question 4: What did the episode say about the Linux Kernel Project’s new CVE practice that drew criticism?

Question 4

What did the episode say about the Linux Kernel Project’s new CVE practice that drew criticism?

It was limiting CVEs to only user-space vulnerabilities and ignoring kernel bugs It was refusing to issue CVEs for kernel issues until NVD enrichment was complete It was outsourcing all CVE decisions to commercial vulnerability scanners It was issuing CVEs for essentially every bug fix, including many trivial ones

Question 5: What did the listener’s report reveal about real-world Passkeys support across sites and devices?

Question 5

What did the listener’s report reveal about real-world Passkeys support across sites and devices?

Every major site now supports unlimited Passkeys with consistent naming All browsers expose identical Passkey management menus and policies Some sites allow only a single Passkey, and key naming/support varies widely Hardware keys are universally unsupported, so only phone-based Passkeys work

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.