HNHacker News
TopNewBestAskShowJobs

kees99

1,024 karma · joined July 3, 2016

submissionscomments
kees99··on Critical Bluetooth vulnerability in Android
8086 has 256 IO addresses, and hardware of that era had fairly simple initialization, so completely naive way to find peripheral X was to 'probe' each and every possible IO address with something like:

  for i in range(256):
    poke(i,magic1)
    if peek(i) == magic2:
      found!
256 probes in all is not that bad, and real-world probing would only try a handful of commonly used addresses, making it even faster.

Phone SoCs on the other hand have many peripherals memory-mapped, (meaning there are millions/billions addresses to 'probe'), plus there are things like power sequencing, GPIO enable lines that need to be asserted, and clock-sources configured before peripheral would even respond at all. Oh, and that GPIO, or power controller, or clock source themselves might be accessible via an i2c chip speaking its own protocol, so you need to initialize those first, etc, etc.

All of this complexity could be described via linux "devicetree" subsystem, and devicetrees are in a usable state for some hardware (although DT itself is often a labyrinth to navigate). Thing is - factory software for most phones have been extremely slow to adopt DT, and even some that do use DT, don't do it in a particularly portable way.

kees99··on Critical Bluetooth vulnerability in Android
My understanding is that each android phone model is unique and requires unique OS update (unlike, say, BIOS- or UEFI-based x86 PCs, where exact same Windows/Linux/BSD/... image can be installed on any of them).

Having a "standard" OS interface for the phone, where there is just one OS image for a given OS version, and that image could be installed on any phone - now that would be the true alternative, which I would be delighted to vote for with my wallet.

kees99··on Persistant SSH Threats?
You have a point there, but it's far, far from being so clear-cut.

Privileged ports is a measure to guarantee that daemon listening there was started with root privileges. Which is a useful guarantee on a shared server, less so on a single-purpose or personal server.

Plus, if you have an sshd started at boot, and already listening on a pre-defined high port, there is very little chance another program could bind to the same port, save crashing and racing the daemon.

Finally, in ssh protocol, server authenticates itself to the client, so even if by some trickery a bogus ssh server would bind to the same port, it will either need to access /etc/ssh/ssh_host_*_key, which are enforced to be root-readable only, or risk being trivially detected by a client comparing presented public key to that saved from last login in the ~/.ssh/known_hosts.

There are also some DPI firewalls, or just port-based firewall that can block ssh traffic on a non-standard port, but assuming we are talking about your own server, that should be easy to rectify too.

kees99··on Persistant SSH Threats?
No idea why you are being downvoted, this is a solid advice. Masscan [1] claims to scan whole IPv4 Internet for a single port in 5 minutes. Moving to a random high port would increase scan time 64000-fold, to 7 months.

You'd still be advised to disable password-based auth and/or configure fail2ban, though.

[1] https://github.com/robertdavidgraham/masscan

kees99··on Tell HN: I grew Visa List to $5k per month in a year
@1hakr: Your no-javascript shame-screen is very funny and well-made, thumbs up. Too bad I can't see anything else on that site.
kees99··on LineageOS Android Distribution
> Most donated phones have an iCloud lock with no way to contact the previous owner to request an unlock

To be fair, newer Android phones have Factory Reset Protection[1], which is pretty much 1-to-1 clone of iCloud lock.

[1] https://support.google.com/nexus/answer/6172890

kees99··on DNS Wars
In a DNS-amplified DDoS attack, target (CF for example) would be on the receiving end (right-hand side of [1]), and blocking, while necessary, would not be terribly efficient there.

On the other hand, deprecating "ANY" requests as standard, once percolated into BIND and other resolvers, would cut the attack[2] on the amplification stage (middle of the picture of [1]).

[1] https://www.cloudflare.com/img/learning/ddos/dns-amplificati...

[2] or at least significantly decrease choice and depth of large amplification factor requests available to the attacker.

kees99··on DNS Wars
Cloudflare killed "ANY?" because it was a significant vector in DNS amplification attacks.

Ironically enough, avoiding the "expensive" query type resulted in potentially doubling the amount of DNS traffic from a typical dual-stack client ("A?" + "AAAA?" instead of single "ANY?")

EDIT: ...or warranted adding laggy heuristics that eventually settles into either, as Avamander points out below.

kees99··on Raspberry Pi 4 as a USB-C peripheral

  [R]ecent update to the Raspberry Pi 4 bootloader
  (...) enables data over the USB-C port
Am I reading this right that RPi4 has five usable USB ports, i.e. unlike earlier models, port on bottom left of the board can carry data along with power? This is awesome!
kees99··on NeverSSL
Indeed, "browser.urlbar.autoFill" option (enabled by default) would do that in Firefox.

There should be no forced https redirection if you fill in http:// prefix by hand though. At least for now, until example.com adds HSTS headers.

kees99··on NeverSSL
Some captive portals do TCP redirection, but no DNS redirection.

And for good reason. Once user has finished jumping through whatever hoops captive portal want them to jump, a new connection to the same server is likely to be attempted, and having a fake DNS response cached somewhere in libresolv or browser in the client is not the least bit conductive to that.

kees99··on Ripe NIC: 'In Five Weeks We'll Run Out of IPv4 Internet Addresses'
This, exactly.

I've spent way more time troubleshooting various obscure network problems that ended up being a typo in IP address/port number, than I'd be proud to admit.

kees99··on Google T5 scores 88.9 on SuperGLUE Benchmark, approaching human baseline
Same here, except it's comparing fly's flight trajectory to that of a banana is new to me.
kees99··on Flagstaff, Arizona, switched to LEDs without giving astronomers a headache
Red embers (~1000K eigen radiation) are hot, blue(-ish) ice (lit by 5500K daylight) is cold.

..go figure!

kees99··on Open-source apps removed from Google Play Store due to donation links
According to [0]:

  F-Droid is both a repository of verified
  free software Android apps as well as a
  whole "app store kit"
F-Droid also allows to source multiple repositories within one app. [1]

[0] https://f-droid.org/wiki/

[1] https://f-droid.org/wiki/page/Known_Repositories

kees99··on How China is Cashing in on Group Chats
Retail customer support is one such use-case. In the Netherlands, national railway company, many banks, telecoms, etc - all have webchat/twitter dm/whatsapp contact options prominently displayed either alongside phone numbers or replacing them altogether:

https://www.ns.nl/klantenservice/contact

https://www.ing.nl/particulier/klantenservice

https://www.robinmobile.nl/klantenservice

kees99··on ESP32/ESP8266 Wi-Fi Attacks
Vulnerabilities in Broadcom/Cypress wifi chips' firmware have been known for a while now:

https://blog.exodusintel.com/2017/07/26/broadpwn/

kees99··on Linux Pressure Stall Information (PSI) by Example
In-kernel resource-specific counters are great, but those are limited to 10/60/300 seconds averages.

For historic resource utilization, sar/sadc tool is still a go-to.

kees99··on Sourcehut welcomes Bitbucket refugees
Are you sure? Looks like static pre-generated page to me:

  $ curl -s https://sourcehut.org/|egrep 'meta.*gen'
  <meta name="generator" content="Hugo 0.57.2" />
[0] https://gohugo.io/
kees99··on The Raspberry Pi 4 needs a fan
There is more area than meets the eye - a large chunk of PCB itself is a "heatsink" thanks to sheer amount of metal in there.
kees99··on The Raspberry Pi 4 needs a fan
Indeed - there is enough aluminum/copper in the SoC's metal lid and PCB's inner (ground/power) layers, that the whole thing is effectively a 2-3 square-inch heat-sink. Eben himself has been talking about this technique around the time RPi3+ was released.

And your point here is completely understandable too - there is a kinda-heatsink there already. Just add a fan, and we're good.

My point is - seeing a large black hole where SoC goes (color corresponding to +20-ish degrees C by the chart) is utterly confusing, since SoC is the hottest point actually.

kees99··on The Raspberry Pi 4 needs a fan
Quote:

  the metal casing helps
  spread that heat around
It does, to a degree. But that is absolutely not what we are seeing in that IR picture. Shiny bare metal is a mirror at the wavelengths that thermal camera uses. So what you see on thermal image where wifi-module shield and CPU are is reflection of ambient (room) where this picture was taken. Try waving your hand around, you'll see it reflecting there too.

To measure real metal surface temperature by IR, you have to paint that metal (ideally, with black matte paint), or apply similarly-textured sticker.

kees99··on PCI Express on the Raspberry Pi 4

  It looks like an unreliable modification.
PCIe is surprisingly robust at short lengths. For example, [NanoPi_M4] has two lanes of PCIe coming to the daughterboards via old-school 0.1" connector. Something that many electrical engineers would cringe at, and yet - it works rather reliably.

[NanoPi_M4] http://wiki.friendlyarm.com/wiki/index.php/NanoPi_M4#Layout

kees99··on Why did moving the mouse cursor cause Windows 95 to run more quickly?
A somewhat similar effect is alive and well on Android: background processes run measurably faster while user holds/moves their finger across the screen, and couple of seconds thereafter.

Mechanism is a bit different though: SufraceFlinger process that is responsible for acquiring touchscreen input, temporarily boosts CPU and GPU frequencies to make sure screen animations are nice and fluid.

kees99··on Termshark – A terminal UI for tshark, inspired by Wireshark
Option "-l" only supposed to be used with text output. When mis-applied to binary (-w) output, it will:

- On Linux, flush buffer at wrong places, breaking last (few) packet(s);

- On Windows, flush buffer after every byte (which gives acceptable result, but is very inefficient).

With "-w", always use "-U" instead.

kees99··on [OpSec] Auto lock screen when you depart with the smartphone
Or better yet, let udev trigger do the hard work of watching for you. Just add one line to /etc/udev/rules.d/99-my.rules file:

  ACTION=="remove", ENV{ID_SERIAL}=="Pixel_3_0a7...", RUN+="/usr/bin/screensaver-lock-script"
To find out your phone's ID_SERIAL string, run this then plug in:

  udevadm monitor -up
kees99··on Show HN: Startup with no website - GuerillaClick@gmail.com
other captive portals let user in, ostensibly to open inbox and click the link, then kick off the net if that didn't happen within 5 minutes.
kees99··on Blocking website ads with a hosts file
Facebook does exactly that.

https://pbs.twimg.com/media/Dt23cXZXgAEDdW4.jpg

kees99··on How Many Computers Are in Your Computer?
> And SATA/SAS drives are running multiple ARM Cortex M series MCUs

http://spritesmods.com/?art=hddhack

kees99··on Cloud Computing Without Containers
Well, CF always charges you for full 10,000,000 requests/mo too.

Also, it is super-common (especially on low end) to offer burstable CPU VMs [1,2]. So you are not getting charged for full CPU, unless you specifically ask for it.

[1] https://www.hetzner.com/cloud?country=us (bottom of the page, toggle between "default" and "dedicated CPU")

[2] https://aws.amazon.com/ec2/instance-types/t3/ (product details, "Baseline Performance/vCPU" column)

← PreviousPage 7 of 9Next →