lvh

You get a very different CVSS score depending on the formula you use. Ubuntu's response page lets you select between the two.

(I think CVSS is a very poor metric in cases like these; I'm just explaining what I think Ubuntu's process/position is, not making excuses for them. My read is the 9.8 is probably too high but nevertheless more accurate in this case.)

"The operating system makes it easy to mess with" doesn't seem like a particularly useful property for application file formats.

That doesn't really explain why, you're just saying that the thin you claimed was desirable is desirable.

(I don't disagree! I'm just saying: you haven't advanced your argument or answered GP's question.)

This is a fantastic example of applying deception strategies in practice as part of a detection & response plan. The most common use case is as a canary, but it absolutely works as evidence of compromise, too.

I won't comment on the specifics of the case (the complaint comes across as very convincing), but I will remind people that it's common for investigations to ostensibly show an employee doing bad things, when in reality it's e.g. that employee's credentials/devices that are compromised.

Some of our customers, like Tailscale, are a helluva lot more picky than that.

Re: hashing: Yes, but I'll leave that one to Paul who is a lot smarter than I am :)

Re: QA: can you say a bit more about the type of coverage you're worried about? Is your concern that we'd be missing APIs, or that the storage format itself breaks, resulting in fact elision? payne (the underlying project) has a borderline obnoxious amount of tests, but that doesn't mean we didn't miss anything :)

FYI: we're planning a followup post for people who are less interested in the Datomic mechanics and more interested in the usefulness to investigations and other security functions. Informally, I think of it this way: your SIEM has the deltas, but often you want the contextual states in between the deltas (and a lot of investigation is about trying to reason about that state). We built this tool originally to support that, and it turned out that approach was also super useful for things like compliance, CSPM...

We already wrote a high level blog post here: https://www.latacora.com/blog/2023/11/01/our-approach-to-bui... -- but the one I'm hoping to write is more of a case study.

(I'm one of the founders of Latacora and reviewed the post.) If any of you are at Heart of Clojure, I'll be there both wearing my Latacora hat and my Clojurists Together hat :)

I don't know if I count as a "feline friend", but: SIDH kept the DH shape. Being able to upgrade the protocols we had relatively closely is appealing. "Structure is useful but seems precarious" wasn't exactly secret knowledge.

We did an updated version of the Cryptographic Right Answers for PQC. Given how quick the field is moving, I'm sure we're going to have to edit it a bunch :)

https://www.latacora.com/blog/2024/07/29/crypto-right-answer...

These standards are developed out in the open.

Are you suggesting a true backdoor, or just "the NSA knows something about lattice algorithms the rest of us don't"?

The additional information you need is that that's what Thomas Wouters does (and has done for as long as I've known them, which is many, many years).

You should try C-f "Chinese".

We're talking about chips: stuff optimized for inference and training. It may have a lot of memory, it may be able to perform a lot of operations, but it would be difficult for it to enforce high-level concepts like "woke ChatGPT".

Thanks! I'm glad you liked it. Happy to answer any questions about that talk.

How do you know this person (Tal Broda) made this? It doesn't seem to list an author.

They may often be used with small embedded computers, but 1 Coral TPU handily beats even a top-end CPU for the stuff Frigate needs it to do -- and it does it at minuscule power draw. Sure, it's inference-focused, and that means it has limitations: it sucks for e.g. speech models, too. But it's pretty great at what it does and gets used in real applications too. My guess is you saw the USB-C model, but they do M2, big cards with multiple M2 slots, and miniPCIe (popular in industrial applications) too.

They sold (and continue to sell) TPUs under the Coral brand, and they're pretty popular for edge inference (e.g. Frigate).

My daily driver is a 1986 911 Turbo (aka the 930). That's a nearly 40 year old car, they make a similar new infotainment system that works for even older cars. Thing runs like a dream, and they tried very hard to make it "fit" in the old interior even though it clearly had completely different design constraints.

Good news: you can now, I just installed it and it was easy and fun. https://github.com/PaulWieland/ratgdo

But it is external to the device, you're right :) And for some crazy reason this guy is getting a lot of orders recently ;)

That sounds even dicier than modifying the wall switch, but sure :)

There is a part of me that wants to break the damn thing open to hunt for a 3.3V line so I can power the ratgdo without a USB PSU...

That's fair. Maybe my security background is shining through here. I guess we used to have "slashdotting" but that doesn't generalize well :)

I did do some napkin math to quantify how much that bad traffic may have been: HA estimates between 6857-25576 intallations of the MyQ integration. Let's say 16k clients. HA makes it really easy to detect and "add" the integration (which counts as an installation even if it's not configured), so, that's definitely not all clients hitting the API. Let's say it's 50%, so 8k actually using it. Most users just notice myQ is broken. Let's say some fraction retry, which would look the same as an extra user from a volume perspective. Call it an even 10k users (including repeat users).

The most recent change is after they broke everything past the OAuth dance. Let's say the OAuth request is 1kB. The retry code retries up to 5 times with exponential backoff. Let's say 5 requests over 10 min.

(5 requests / 10 minutes) * 1 request/user * 10k users = 5k requests/minute, or 83 per second, amounting to 83kB/s inbound.

There's no reason to assume those requests would synchronize, but I'm sure there's something (let's say every single myQ user updated at the same time).

If what they're saying is true, sounds like actually malicious botnet wielders can ransom the living daylights out of them. Given 1Tbs DDoS attacks they'd only need a tiny fraction of the full bore ion cannon! ;-)

[1]: https://github.com/arraylabs/pymyq/blob/master/pymyq/request...

Sort-of: the newer ones require the physical button to speak the same rolling code protocol the remotes do. So, yes: but you have to modify a real door opener. ratgdo has the advantage that it pretends to be said door opener.

Perhaps they updated the statement since then, but they're not accusing them of "basically" DDOS: they literally say DDOS now. Which of course prompts the question: is the problem that the CTO doesn't understand what DDOS is, or are they intentionally painting HA as malicious somehow?

A third-party hub would have a similar problem, though, right?

Why did that software work mostly fine most of the time since 2017? Even Chamberlain admits their blocking is deliberate. Even Chamberlain's external statements suggest this is part of their corporate strategy.

Why is Chamberlain's API so brittle it can't stand prodding from what they claim is a tiny fraction of users, even if those are misbehaving? Do you agree that comparing that to DDoS is ludicrous, and suggests either dishonesty or a fundamental misunderstanding of what "DDoS" means?

My garage was broken into. The open door warning is how I found out.

That helps, but a remote integration doesn't _have_ to be hostile. I get that it's different from IoT, and most of my stuff is local Zigbee after learning the hard way, but my Home Assistant also talks to the Norwegian meteorological institute and Tailscale :)

One reason this is tricky to do is because up until let's say the last 6 months or so, myQ _wasn't_ hostile, even if it was Cloud-based. (I get that that aligns with your point! I'm not arguing with you there.)

Odds are that whatever nice Chamberlain opener you want will have myQ built in because that's their business strategy. You can try getting a different brand if you're voting with your wallet -- but if all you care about is security: the Cloud connectivity is optional and you can just not connect it to WiFi.

The ratgdo is more trustworthy, and it just connects (really easily, too, especially with the new v2.5 board) to the opener via the same contacts that the dry contact button does.

Based on my local big box store and garage installer availability, Chamberlain has a de facto monopoly. They also pulled the rug out from under customers: that behavior had been in Home Assistant since 2017, and it's their own recent changes that caused the alleged "DDoS". They say it's to promote official products, but the company previously had a local hub that didn't require their cloud service and discontinued it.

The API breakage coincides pretty well with their brand new CTO, whose objective is apparently "transformation to a smart access software company".

It's unclear if the CTO just doesn't understand that "DDoS" generally implies malice, or if they're intentionally using that language to blame users for using their product.

Good news: ratgdo, an ESP-based local solution works great. I hope the author is making a decent profit on the kits.