jtchang

Why are there any management interfaces exposed to the Internet at all?

This is a fantastic write up on the security incident. Almost any incident like this will have unknowns. It's good to make it explicit. I especially liked the part of what would have been leaked if the attacker was successful. Maybe they could include what type of hash was used.

The VP of engineering at tailscale did post a response here:

https://www.reddit.com/r/Tailscale/comments/1xeoj1l/recent_t...

This is going to pop a lot of wordpress sites.

Can you link to that comment ? That's pretty wild.

So tossing out an idea:

What if all manufacturers had to classify their product into internet connected i.e. smart or not. We mandate that manufacturer has to support updates for minimum 5 years or firmware source goes public. Have them put firmware source in escrow as well as have a way to update it.

If a manufacturer wants to reduce their liability then they have to release something to make it semi publicly supportable. With AI agents these days patching the firmware might one day be trivial.

Put some penalities with teeth behind this and maybe manufacturers will think twice before making everything smart.

Southwest airlines had a culture of turning around fast at the gate. So maybe no explicit policy but culture can drive unintended consequences and decisions.

Article mentions the passwords were hashed with sha256 plus a salt. For a long password more than say 12 characters this would take a very long time to brute force. My guess is a lot of these were dictionary attacks ?

Confused as to the actual root cause. Don't all hard drives provide SMART diagnostics these days? Was it really bad sectors?

Fantastic write up. It's mind blowing how much complexity there is to keep flights going day in and day out.

My guess is all airline NOCs operate 24/7 as flights happen around the clock. Also planes typically don't have much downtime as that loses money so everything has to be a continuous operation.

Cool looking at the pictures of the dashboards. It's nutty to think how much has to be tracked when doing airplane maintenance.

Correct me if I am wrong but I thought the primary appeal of LoRa was range? Also isn't the primary factor in making long range radio go through things is the frequency? So 2.4ghz is the same frequency as consumer wifi right and thus would propagate about the same right?

It doesn't seem like this would be that useful except that the protocol is LoRa so you can have higher bandwidth between two devices if they happen to be close enough together.

How does the app read the variable if it can't be read after you input it? Or do they mean you can't view it after providing the variable value to the UI?

I remember reading slashdot but what is their system? Is there a separate set of mods that moderate the moderators?

How is this mode not a standard part of their disaster recovery plan? Especially in sf and the bay area they need to assume an earthquake is going to take out a lot of infrastructure. Did they not take into account this would happen?

Fundamentally is there anything you can't write in rust and must write in C? With AI languages should mostly be transposable even though right now they are not.

Great video on how the public is getting screwed on energy deals.

Basically large tech companies have the deep pockets to push up prices at electricity auctions. But why bid in public when you can do those deals in private. That's the first problem. All that needs to be out in the open.

What really irks me is that the market is so manipulated that we can't do anything about it. Think about NEM 3.0 vs 2.0. Putting data centers in their own rate class does make sense as the first step.

A number of years back I got bored during covid and decided to reverse engineer as much of the Wyze Cam V2 camera I could and make some custom firmware for it. Right now that lives at https://github.com/openmiko/openmiko

That said it's really hard to make long term supportable open source camera software/firmware. And when picking cameras it is even harder because the market as it stands now does not let you have it all. You need to pick what facets you really care about.

Also keep in mind even the above code is not really opensource all the way: I still had to load the driver binaries. Not sure that source will ever be released. The kernel is also old as heck.

What I do feel good about though is saving these old cameras from the dumpster if Wyze ever stops supporting them. The firmware works for simple cases: just load it up and you can start curl'ing frames. I used it in scripts to put together timelapse videos with ffmpeg. No need to screw around with authentication, phones apps, email, etc.

So basically you trust something because you have a long chain of assurances that you trusted it before? Kinda like certificate pinning.

Is the send function considered non-blocking?

Visiting the site it is easy to see why they got demoted. It's all fluff and no substance. Almost all the links I clicked through could have been generated by a LLM.

Lots of ads. I might be old school but I still hold quality to something like anandtech back in the day. Something that a real human spent time on because they were genuinely interested in the topic and decided to write about it. The bar is so low these days not sure if there even is a bar.

This site is suppose to be a men's lifestyle magazine but it barely has any content that isn't just filler and fluff.

I love it. Could definitely see more features where you can see the results of the jury questions.

It's so dumb to assign it a CVSS score of 10.

Unless you are blindly accepting parquet formatted files this really doesn't seem that bad.

A vulnerability in parsing images, xml, json, html, css would be way more detrimental.

I can't think of many services that accept parquet files directly. And of those usually you are calling it directly via a backend service.

Thank you for providing this.

He mentions right after that "empathy is good but you need to think it through and not just be programmed like a robot".

That quote is clearly taken out of context and is specifically chosen as click/rage bait.

Like all things, nuance and context is always key.

Funny how this popped up as I was just talking to a friend about some of the challenges I've had with logging. Would definitely be interested in contributing to a project like this. Hit me up (email in profile).

This is using elixir right?

Is the documentation for AI chat bots or for humans?

The PR is now closed but seems like we should be striving to do better.

Such a great story. Something like this could have only been pulled off in that era.

Are you saying you think the Canadian government should pay more toward fertility and less toward LGBTQ procedures such as gender reassignment? I wonder how much money the latter costs. Seems like it wouldn't be as big a cost vs fertility treatments being covered.

What switches enterprise or consumer tend to support this LLDP? My guess is maybe almost none on the consumer side. I.e. Netgear, to link. Cisco probably does. How about ubiquti?

Long term this is good for the software ecosystem as a whole. Especially open source options like proxmox. I think Broadcom is making a strategic business mistake not willing to negotiate in good faith. However this is the true cost of using closed source solutions. The more this happens the more it gets factored into business decisions.