81–90 of 91 posts
Super impresssive! I would absolutely love to work on such projects and admire the passion and countless hours that went into understanding and then building the system. Retirement is not something desirable for me, so maybe that's when I'll spend my time on hardware and software projects like this.
What's stopping you from starting today?
Earlier quoted context omitted.
I think visibility is one aspect, but not the whole story. An average home user runs Windows and doesn’t necessarily care if a hypothetical backdoor could exist in their hardware/software stack. They browse the web, do their banking, and share photos on SM after checking their mail and searching for Tiramisu recipes. The existential threat to themselves is low, so they don’t dig further into the ramifications. Journa…
Being worried about a hardware backdoor in your network card is more about technology fetishism than realistic threat analysis. It's like suburbanites being worried about home invasion. Sure, it's technically possible to happen, but the concern reflects personal neuroses rather than practical considerations. There's a disconnected, individual grandiosity in both cases - "what I have is so valuable that other people w…
BTW, I also think you are very right about this. The Insecurity Industry preys on fear. But it offers no substantial solutions. That doesn't mean the risks aren't real. They are. Modern software engineering is a calamity. Everything is full of holes. What is at issue is motives. The insecurity industry doen't want anything fixed. It wants, as you say, to lock down all your stuff, control it, and make you pay twice or thrice to use your own property. A protection racket is very different from offering actual "security". I try to expand on that here [0]
Earlier quoted context omitted.
You are minimising [0,1]. (I also think you are wrong in your risk asessment) [0] https://www.berkeleywellbeing.com/minimizing.html [1] https://en.wikipedia.org/wiki/Minimisation_(psychology)
That is not minimizing. Minimizing from a psychological perspective is to present an event that has occurred as unimportant or insignificant. Had the OP said "suburbanites have nothing to worry about if they are targeted in a home invasion" would be an example of minimizing. The rising fear about crime in general, or home invasion in particular, is a disconnect from the actual risk of either happening to oneself. Vio…
First, I agree with everything you just said about rising fear and the total disconnect of actual risk from how it is presented.
See my response above to sdwr viz emerging protection rackets in computer security, and my later comment about Ross Anderson's important paper after which I (and Edward Snowden) have found the words "Insecurity Industry" rolls off the tongue - for example Amazon's Ring Doorbell ecosystem which cynically preys on distorted perceptions of suburban crimes.
Other people have commented on that here, and I think they are correct. But let's not allow that to distract us from the reality that cybersecurity is in an appalling state and that the risks are very, very real, and getting worse.
The "insecurity industry" exploits that - while offing no substantial solution, and indeed has no interest in fixing things (as a principal agent problem) - but that's separate from the threat reality.
A great way to understand this might come from reading some of Bruce Schneier's wonderfully clear writing on security theatre and security perception. They sell the problem and the solution. Fear and safety often come in the same packaging, like those Taco kits or fruit and yogurt combos.
Anyway - not wishing to end argumentatively but "minimising" is appropriate because sdwr makes aspersions to grandiosity. It is a really strong characteristic to gaslight or undermine the other as "over-dramatic" etc, not just downplaying the facts. respects.
A network card with opaque firmware is a 0-day away from becoming a global catastrophe. Even RISC-V based switches like the Vega use proprietary switch chips (Wuhan China designed FSL91030M specifically), which is no better. You can verify input/output to a certain extent, but this doesn’t preclude a timer based function call or a tailored packet activation. I wonder why our society tolerates these unknowns. With the…
How much L3+ logic is in the NIC? Pretty sure by the time a packet hits the NIC it is encrypted. The lowest level (closest to hardware) encryption I know of happening is in the Linux kernel but isn't currently in production exactly because of security concerns.
If you are sending unencrypted packets on the network I can think of much more reasonable attack vectors for an attacker to try than planting a backdoor in the NIC firmware.
How would this not get detected by modern DPI?
And I don't know much about the internals of Palo Alto / Cisco etc network security appliances but I'm pretty sure they do have custom ASICs/ FPGAs for their switching logic purely because of this attack vector.
My conclusion: 1. Your home router is significantly more vulnerable 2. Your IoT devices are significantly more vulnerable 3. Any network packet going through the NIC is also going to the internet at large generally or see point 1 and 2. 4. The ISP hardware isn't exposed to this attack vector
Feel free to help my understanding, I could be wrong.
Earlier quoted context omitted.
Being worried about a hardware backdoor in your network card is more about technology fetishism than realistic threat analysis. It's like suburbanites being worried about home invasion. Sure, it's technically possible to happen, but the concern reflects personal neuroses rather than practical considerations. There's a disconnected, individual grandiosity in both cases - "what I have is so valuable that other people w…
> "what I have is so valuable that other people want to take it!" While I do agree this may apply somewhat to the original topic, your dig at suburbanites seems like a mischaracterization. Perhaps the upper/upper-middle classes feel this way. I would expect most other folks are primarily worried about being murdered during the event.
Beautiful work to share. > I needed a hardware MAC address filtering. What I really love is the stack trace of reasoning, that's very pedagogical, and that you either worked out lots of things from first principles or felt the need to explain them is if from naive perspective. Also, while impractical for real world networking I don't think this is just idle play. What with backdoors turning up in over-complex network…
I would like to see a hard disk with all open source software. This sounds extremely challenging, even just the physical construction. My thought is to take an EXISTING hard disk and replace the software. I think one problem is may some of the chips , it is hard / challenging to obtain programming information.
Earlier quoted context omitted.
USB is arguably much more complicated than 10base2 internet, which pre-dates it by a long way. In fact, if you're trying to use either PCIe or USB to connect to a 10base2 ethernet network, either of those will be far more work than the Ethernet side. You might be able to persuade a FTDI-style USB device to bit-bang 10base2 Ethernet for you. You'd implement a "PHY" side which translates the wire traffic to a clean bit…
USB LS/FS are pretty implementable in select FPGAs and MCUs without a dedicated PHY.
I would like to see a hard disk with all open source software. This sounds extremely challenging, even just the physical construction. My thought is to take an EXISTING hard disk and replace the software. I think one problem is may some of the chips , it is hard / challenging to obtain programming information.
You’ve got me curious of the use case, is it fascination or some other reason? From a security perspective, it seems straightforward to just encrypt the bytes before sending to the drive. That would ensure you can detect data being maliciously changed and/or protect against the drive somehow misusing the data.