Steve Gibson did a pretty good job explaining this for normal folk (like me) on his podcast IMO.

Episode #374 https://www.grc.com/securitynow.htm