Dave W. Plummer recounts his role as the primary author of Windows Product Activation on the operating-system side and explains how volume licensing worked for large corporate customers. To let offline corporate machines skip individual activation, volume media contained a special 10 MB, entropy-stripped binary blob he created (built from compressed/encrypted Microsoft Bob data) that WPA hashed and checked against a Volume License Key (VLK). A valid VLK had to pass independent product-key validation, and when paired with matching volume media the activation process was skipped; a retail CD without that embedded blob would not accept a VLK.
He describes how RTM went to manufacturing on 24 August 2001 and retail shipped 25 October 2001, yet about five weeks before launch the warez group Devils0wn posted a complete “Windows XP Pro Corporate” ISO together with the widely circulated FCKGW key. Pirates baked the key into images or marked CDs, and the most plausible source was an OEM or hardware partner (names like Dell or Intel surface in community speculation). Microsoft blacklisted the leaked PIDs in SP1 and tightened checks in SP2 and Windows Genuine Advantage to block updates for those installs; un-leaked VLKs continued to function. The account frames the problem as a design choice to enable offline enterprise installs and an operational failure when media plus key escaped. He ends by directing readers to his current project, Task Manager TMOG.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Google Pixel phones have been vulnerable to zero-click attacks that can compromise their security without user interaction. Researchers identified these exploits, highlighting a significant security concern for Pixel device users. (theregister.com)
Spain's government ordered the blocking of Archive.today and its mirrors without a court ruling, redirecting users to a government page accusing them of accessing illegal content. The move aims to combat copyright violations but raises concerns over censorship and online freedom. (reclaimthenet.org)
Google AI Studio is accused of faking data deletion, leading to questions about its data management practices. An automated system, VRP, reportedly banned a user within 60 seconds for reporting the issue. (medium.com)
Polymarket's rapid expansion has created vulnerabilities that fraudsters could exploit. Regulators have raised concerns about the platform's security and oversight practices. (wsj.com)
RSA-896, a challenge number, was factored on September 19, 2026, by Stephen A. Weis using Claude. The factorization reveals the prime factors p and q of the 896-bit RSA modulus. (saweis.net)
Twenty-five years after a proposed national ID system was rejected, the US has quietly moved toward a digital identity platform called Login.gov, which consolidates personal data without public debate. This system could eventually enable broad surveillance and access control across institutions without explicit legislation or public approval. (thedreydossier.substack.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.