HNHacker News
TopNewBestAskShowJobs

steckerbrett

523 karma · joined May 12, 2015

submissionscomments
steckerbrett··on Exploit to get root on OS X 10.10 fits in a tweet
Yes, Apple does not patch old versions of iOS or OSX.

All iPhone 2G, 3G and 4 are all vulnerable to root code execution flaws (some exploitable from the web browser) and do not receive updates.

steckerbrett··on iLoo
Lots are made of copper which would dispel that entirely.
steckerbrett··on Jake Dyson Lighting
I paid almost double that ($700 US), and it is still definitely worth it. The product does much better than any other I've used, it's easy to clean, and it takes all manner of abuse. It's one of my favorite household tools by a long stretch.
steckerbrett··on VnStat – A network traffic monitor for Linux and BSD
`iftop` works well on OSX.
steckerbrett··on Airless Tires Roll Towards Consumer Vehicles
Normal tires are terrible to recycle. You have to grind them up, sift out all the metal pieces, and then you have some poor quality recycled rubber to use for something.
steckerbrett··on New Horizons phones home
I'm still amazed we knew about its existence any time prior, the best picture we had in may is just 9 pixels wide. There's more visual information in Google's favicon.
steckerbrett··on Two more Flash 0-days emerge in Hacking Team leak
What websites use it? I've not encountered a single incompatible website recently, and haven't had flash installed for a long time now.
steckerbrett··on Mikron 1663RU1 – first Russian 90nm chip: weekend die-shot
Essentially any time you see ceramic packages they are either US or Russian military where cost is not a consideration. Aerospace is very similar in their requirements for ruggedness and performance over temperature swings, so often end up using the same packed chips as the military rather than consumer level ones. Lots of early medical electronics like pacemakers seem to use military spec packages as well, presumably just because they are in a space where you can't really dig them out easily and replace some faulty consumer grade 74 series logic.
steckerbrett··on New airline seat arrangement looks to increase passenger capacity
You would get better packing efficiency if the "chairs" were just straight boards you strapped people to and put them on shelves. You'd also have the advantage of the people in the top rows shielding the bottom people from radiation.
steckerbrett··on Huge data breach prompts resignation of OPM director
Shouting "encryption" isn't a whole lot better really. You can use "military grade encryption" all you want, but if the server it is stored on has the keys there's extremely little point except the feel-good vibes.
steckerbrett··on Low-Power $5 FPGA Module
Probably easier to use the GPIO in your micro controller to transmit it with RF, unless you've also designed a Faraday cage phone.
steckerbrett··on Low-Power $5 FPGA Module
No, this is targeted towards consumer, mobile devices. For cryptographic use you want small process, high bin, typically extremely large and expensive chips. The thing has integrated LED drivers, it's about as far from what you want for that application as you can get.
steckerbrett··on Monopoly Man – the same image uploaded to Imgur 3.2M times?
They are comparing SHA256 hashes, so the images are literally identical (and don't just appear to be identical visually).
steckerbrett··on Transcend (YC S15) Launches an Extra-Efficient LED Light for Indoor Farmers
Fruit and nuts are probably not going to see this sort of thing, primarily because the trees take a very long time to come to maturity. With some varieties you might be looking at a decade of care before you actually get any yield from them at all.
steckerbrett··on Retroshare – Secure communication for everyone
That's always the end feeling with RetroShare. I'd love to use it, but the interface is completely unpalatable.

There's supposed to be a web interface[0] that looked significantly better but I don't think that ever went anywhere (last commit is in 2013).

[0]: https://retroshareteam.files.wordpress.com/2013/04/djrs_2013...

steckerbrett··on Apple Open Source Site
This is amongst the least ugly of Apples non-consumer facing sites, some of the portals still have pinstripes from the 10.1 days.
steckerbrett··on Hacking Super Mario World to Warp to the Credits [video]
Probably not as awful as it sounds on the surface, with an emulator you can sit and stare at the current state of the machine quite handily. It would be essentially impossible to work this sort of thing out without the aid of tools.
steckerbrett··on IPv4 Depletion
World accessible devices is a pretty scary concept. If you have your garage door controlled by an ESP8266 it would take a single host to denial of service attack it, maybe even just one server to denial of service attack every garage door in the united states.
steckerbrett··on Latest prototype self-driving vehicles cruising around Mountain View
It'll probably make a lot more sense when you have a majority of cars that can act as a swarm rather than having to tolerate irrational and unpredictable human drivers. I can imagine there will be eventually some sort of standard for near field communication of autonomous drivers that can give hints about behavior rather than needing to infer them. Doesn't even need to be trusted or authenticated, a driver can just make more detailed signals than the human readable yellow and red lights that we currently use. Even just being able to say that you'll be turning in 1KM would make things significantly more efficient to navigate around. It extends even further if you want to have drivers like ambulances and fire trucks to have "sudo" powers, autonomous drivers can get themselves into a formation to allow the vehicle through before it is even visible over the horizon.
steckerbrett··on The town that banned Wi-Fi
It's easily disproved by the fact that they think they are escaping it by simply moving away from WiFi. The 2.4GHz band is swamped in most consumer settings by remote controls, doorbells, video systems, remote control cars.

Beyond that (imagining you somehow eliminated all of those) the biggest source of radio frequency garbage is going to be from space rather than a consumer grade <1W transmitter, the atmosphere is pretty opaque to 2.4GHz. Somewhat coincidentally the cosmic noise we can hear from earth is mostly in the microwave range.

Maybe if people's skulls started vibrating in time with the woodpecker [0] or something I'd believe it.

[0]: https://en.wikipedia.org/wiki/Duga-3

steckerbrett··on Asciinema
Previously: http://showterm.io/
steckerbrett··on Stealing keys from PCs using a radio: cheap electromagnetic attacks
A lead gap might be a better term.
steckerbrett··on Suddenly, a leopard print sofa appears
I had some success with pictures of sofas from a top view, but a lot came out as complete nonsense like "nail" or "light bulb". Seems on at least some patterns it is trained to view things in a particular orientation that you would normally see them in. I imagine that if it did exhaustive rotation searches on a lot of objects the results would often be completely incorrect.
steckerbrett··on Stealing keys from PCs using a radio: cheap electromagnetic attacks
Often this sort of leakage comes down to timing, you can infer what a person is doing by the amount of time it takes you to do something. In the simplest example (and only slightly related to the linked article), imagine we have an API end point that allows you to log in using a password. A naive implementation of authentication might look like this:

    if ( password = "hunter2" ): 
        return True
This in a lot of cases will be vulnerable to a timing attack. If the user submits the password "huntducks" it will take the function momentarily longer to return than if they had submitted "whalehorn", due to the underlying comparison exiting at the first non-match. With a bit of trial and error they can deduce the password one character at a time by altering their guess to take longer and longer to execute. To avoid this security sensitive code needs to be time constant, which is a lot harder than you'd imagine.

Attacks like the author are performing are a lot more complicated and use tricks like coercing the victim into signing distinctive plaintexts, but the example also works for more complex systems like ECDSA where people can derive the signing key by just knowing how long it took.

steckerbrett··on Sourcepoint: Former Googler Will Sell Tech to Punch Through Ad Blockers
One is screen scraping, one is attempting to find out how a product actually works. Neither goal has a monetary incentive so it is likely that people have got there before me.
steckerbrett··on Sourcepoint: Former Googler Will Sell Tech to Punch Through Ad Blockers
I've seen one person go thermonuclear trying to prevent ad blocking, and it seriously sucks. Randomly generated content classes and IDs, shifting DOM elements around to avoid them being targeted that way, and later on just completely removing all the divs from the area and manually painting large advertisements with primitives. Made scraping substantially more difficult, but of course not impossible.

One site that still has me beat dynamically loads all of the content and code through a websocket, and various bits are so heavily obfuscated that they look like brainfuck. Finding tools to tamper with SSL websockets is a challenge enough in its own right (Chrome has nicer tools now though).

steckerbrett··on Even with a VPN, open Wi-Fi exposes users
Both.
steckerbrett··on Even with a VPN, open Wi-Fi exposes users
Little Snitch is one of my favorite pieces of software, it is truly amazing how noisy most software is. Without it, your ISP knows even what programs you have open because they call home every 15 minutes for stupid reasons.
steckerbrett··on Building Microsoft Surface Pro 3 [video]
I've pulled apart wacom tablets before and the panes really aren't that thick, you're talking a single layer of flex PCB. I find it difficult to believe that this was the defining reason for them not using it in their hardware. The 8 bits of resolution they ended up with are probably not all ending up being useful either, which sounds like a pretty disappointing user experience.
steckerbrett··on Cryptographic Right Answers
Mostly it's just an indicator that the person doesn't understand the security concepts. If you believe a 4096 bit AES key will do you any good, there's probably other fundamental issues that you've misunderstood.
← PreviousPage 5 of 6Next →