Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's that touchscreen in my room?

laplab.me

Post reply on HN
Print view View original

121–130 of 576 posts

Re: What's that touchscreen in my room?

#121

Post by b112 »

AnthonyMouse wrote: post #109
kelnos wrote: post #53

> There were two strings printed with labels “SSID” and “Pwd”. I froze in horror. They wouldn’t dare. It is literally 3 meter distance. These are embedded devices, they do not need this complexity… Not surprising at all. I would expect that a lot of these are bought as retrofits, and not as a part of new construction. Running wires through existing walls can be annoying, and they don't want to put that barrier to sal…

> Running wires through existing walls can be annoying, and they don't want to put that barrier to sale in front of them. It also makes it more convenient to compromise the device from across the street (or across town with a directional antenna). Though of course that's not a problem if your security is up to par and the device continues to receive regular security updates, and we can only surmise that the author ha…

device continues to receive regular security updates

Have to reply to this, and my response was covered a bit by your statement of "security up to par".

Nothing should be considered secure. All those bug bounties are to entice black hats, into giving up juicy pre-0day vulnerabilities.

So just because a device is up to date with security updates, we all must understand, there are countless bugs unknown, needing to be patched, and often, being discovered by those that will never tell, never disclose, never report, and only use them for nefarious purposes.

This is why security is nothing without monitoring.

And why nothing is ever "safe", only likely "more safe" due to a security update.

Consider everything that is network connected as compromised. Everything.

Re: What's that touchscreen in my room?

#122

Post by AnthonyMouse »

b112 wrote: post #121
AnthonyMouse wrote: post #109

Earlier quoted context omitted.

> Running wires through existing walls can be annoying, and they don't want to put that barrier to sale in front of them. It also makes it more convenient to compromise the device from across the street (or across town with a directional antenna). Though of course that's not a problem if your security is up to par and the device continues to receive regular security updates, and we can only surmise that the author ha…

device continues to receive regular security updates Have to reply to this, and my response was covered a bit by your statement of "security up to par". Nothing should be considered secure. All those bug bounties are to entice black hats, into giving up juicy pre-0day vulnerabilities. So just because a device is up to date with security updates, we all must understand, there are countless bugs unknown, needing to be…

> Consider everything that is network connected as compromised. Everything.

This doesn't seem like useful advice.

If you know something is compromised, you're going to want to stop using it and build a clean system etc. You can't just do that continuously the instant you've built the new system.

Likewise, how does monitoring even work? Every device and app wants to phone home to some random server. The connection will be encrypted and even if it wasn't it could be some arbitrary custom protocol you'd have to spend several hours to reverse engineer. You could just block them all but that will cause massive breakage and possibly impair security when the thing you're blocking is whatever thing's security update mechanism.

What's a solution someone can actually use?

Re: What's that touchscreen in my room?

#123

Post by [deleted] »

userbinator wrote: post #100

Interesting article but one thing stood out: The landlord had no idea what this is. There are no buttons or labels on the thing, just a tiny yellow light to let you know it has the power. You move in and find a mysterious device on the wall that, at least to me, appears somewhat ominous and it's not obvious whether it may have a camera and possibly a microphone (the picture of it on the manual appears to show that it…

[deleted]

Re: What's that touchscreen in my room?

#124

Post by injidup »

inetknght wrote: post #114
AnthonyMouse wrote: post #109

Earlier quoted context omitted.

> Running wires through existing walls can be annoying, and they don't want to put that barrier to sale in front of them. It also makes it more convenient to compromise the device from across the street (or across town with a directional antenna). Though of course that's not a problem if your security is up to par and the device continues to receive regular security updates, and we can only surmise that the author ha…

> Though of course that's not a problem if your security is up to par and the device continues to receive regular security updates Just remember that the S in IoT stands for security :)

Secure Home

Re: What's that touchscreen in my room?

#125

Post by vanderZwan »

alexambarch wrote: post #116
kelnos wrote: post #53

> There were two strings printed with labels “SSID” and “Pwd”. I froze in horror. They wouldn’t dare. It is literally 3 meter distance. These are embedded devices, they do not need this complexity… Not surprising at all. I would expect that a lot of these are bought as retrofits, and not as a part of new construction. Running wires through existing walls can be annoying, and they don't want to put that barrier to sal…

> Also, oh, man, Jazelle. I'd forgotten about that. Hardware support for Java bytecode... that did not pan out well. As someone who was too young to be paying any attention during this time, what were some of the reasons this didn’t pan out? Java seems so dominant looking back that I’m surprised something like this wouldn’t have been a success.

I have also wondered this for years, and always was told "because JITs work better", but that felt a bit handwavy. Luckily for both of us David Chisnall just published an article on ACM about designing ISAs that properly explains the reasoning behind Jazelle and why it did not work in the long run:

> Small code is also important [for a simple single-issue in-order core]. A small microcontroller core may be as small as 10KB of SRAM (static random access memory). A small decrease in encoding efficiency can dwarf everything when considering the total area cost: If you need 20 percent more SRAM for your code, then that can be equivalent to doubling the core area. Unfortunately, this constraint almost directly contradicts the previous one [about decoder complexity]. This is why Thumb-2 and RISC-V focused on a variable length encoding that is simple to decode: They save code size without significantly increasing decoder complexity.

> This is a complex tradeoff that is made even more complicated when considering multiple languages. For example, Arm briefly supported Jazelle DBX (direct bytecode execution) on some of its mobile cores. This involved decoding Java bytecode directly, with Java VM (virtual machine) state mapped into specific registers. A Java add instruction, implemented in a software interpreter, requires at least one load to read the instruction, a conditional branch to find the right handler, and then another to perform the add. With Jazelle, the load happens via instruction fetch, and the add would add the two registers that represented the top of the Java stack. This was far more efficient than an interpreter but did not perform as well as a JIT (just-in-time) compiler, which could do a bit more analysis between Java bytecodes.

> Jazelle DBX is an interesting case study because it made sense only in the context of a specific set of source languages and microarchitectures. It provided no benefits for languages that didn't run in a Java VM. By the time devices had more than about 4MB of RAM, Jazelle was outperformed by a JIT. Within that envelope, however, it was a good design choice.

> Jazelle DBX should serve as a reminder that optimizations for one size of core can be incredibly bad choices for other cores

So: a decent JIT works better if you can afford the overhead of the JIT. Jazelle was only a good idea in a very brief period of time when this wasn't true, and even then only if you insist on running a Java VM.

[0] https://queue.acm.org/detail.cfm?id=3639445

Re: What's that touchscreen in my room?

#127

Post by hales »

wkat4242 wrote: post #68

> Turns out, I need a 3A fuse, so I ordered one from Amazon and installed it the next day. Ummm. 3A is 720W. If that tiny box dissipated that much, the entire closet full of them would be a literal oven. Besides there's not much point in an energy meter using that much power. It defeats the purpose. It's like testing matches :P it'll be 10W at most. Even peak inrush current would be nowhere near that high. 1A fuse wo…

Depends on the fuse time rating and the inrush current for the power supply (which can sometimes be more than 10A). Some 1A fuses might occasionally blow when you turn the unit on.

Re: What's that touchscreen in my room?

#128

Post by jonathanlydall »

A few years ago I came to the realisation that if you want people to be more environmentally conscious or economical in terms of utility consumption, (electricity, water, gas, etc), they need far better data than a single figure per month.

You want to be able to see usage to a resolution of at most 5 minutes.

That way people can spot things like “having my electric heater on for those couple of hours used more electricity than all my lights use for a month”.

I have an inverter and solar panels in my place (very common now in South Africa middle class homes due to unreliable electricity producer) and I can see a full history of electricity usage.

It’s easy for me to see where I can improve my efficiency or why my consumption was so high.

It’s still only an overall figure though, so you have to do an informed assumption as to what caused the consumption.

For example it’s obvious that the 3kw draw for about an hour or so after I shower is the geyser heating itself back up. I can see from the usage stats that my battery was depleted from the night, that the solar production is still low due to my showering in the early morning and that the energy was thus coming from the grid (the inverter records all these figures).

It is then obvious that I can very simply save money on electricity by putting a timer on my geyser so that it only heats after 10am or so, once the sun is high enough for solar production to cover the energy usage.

Now I just wish I had something as convenient for monitoring water consumption.

Post reply on HN