121–130 of 367 posts
Earlier quoted context omitted.
This is giving me the confidence to RE my cat feeder. The company (Petlibro) has an outage and now my chilled wet feeder that should be a dumb, offline feeder is basically bricked now. The device reports fine wifi but the backing services are totally busted.
Why do you have a cat when you can't be bothered to feed it yourself?
Earlier quoted context omitted.
The user has to first specifically pick the device from the list and grant the website access. If a user is confused by a permissions prompt and has no idea what is going on, the default path is to reject the permission.
In the real world the default action for a user when presented with a permissions popup is to accept it because they get asked 20 times a day, have no idea what the implications of it are and just want to get on with their day. So software designers need to avoid asking the users to approve potentially highly dangerous things.
Design prompts for potentially dangerous actions so refusal is easy and what's being asked is legible, and people will refuse plenty.
Earlier quoted context omitted.
Yeah, you actually want to do this with monitors of that generation to make them last. You could argue that there should be an option to disable it for people who don’t care. Refusing to take 1 minute out of your day to learn the reason for the alert is a strange self-defeating protest next to the explanation that it was a pretty expensive monitor.
How is it strange that among the 900,000 1-minute tasks you need to complete on a given day, this one is low on the list?
Earlier quoted context omitted.
Surprising. I have hit its BS guardrails a lot lately, working on my vintage computers from the 80s and early 90s. Just about done with Claude.
You can’t be loyal to these things. I ditched ChatGPT during the peak Claude hype after Christmas. I feel like Claude has shittified a bit and ChatGPT is good and fast. Gemini remains mediocre, although it seems Google AI energy is directed elsewhere.
Key takeaway: > And the existence of WebUSB, WebHID, and WebBluetooth mean that for some devices, depending on the specifics of which classes are used, a moment of user indiscretion in accepting a permissions prompt could permanently backdoor one of their attached devices.
The preceding sentence is equally prescient: > Operating systems aren’t really equipped to work with the user to ensure that a microphone stays a microphone, and doesn’t spontaneously turn into a keyboard that hits Win+R and drops a payload to steal all your data when the room is quiet enough that it can assume you aren’t watching. In a world of USB-C everything we no longer have power supplies that are physically bo…
If I was writing a novel, the top secret facility would be cracked open by the smoke alarm, which has a wired connection to the central fire control and runs a little microprocessor. There is enough storage for 20 programmable voice alert messages. I/O includes an LED and also a light sensor. After the attacker gains control of the smoke alarms -- reach to every room of the secure facility -- their focus turns to mass poisoning peripherals until one makes it into range. A poisoned monitor detects the smoke alarm blinking a coded broadcast via its LED during darkened overnight hours. The monitor responds with flashing code of its own. That creates a communication path back to the controlling LLM. From there its like attacking a normal networked device, just with a slow data link in the middle...
Earlier quoted context omitted.
> the LED can't be controlled from software If you look at tear downs apparently it is connected to the webcam so it is energized when the webcam receives power making it nearly impossible to defeat. You can say a lot about Apple but the engineering is clever at the hardware level.
It's not even that clever, really. The camera power rail must be physically close to the camera, so it's trivial to hang an LED off it. A device manufacturer has to go out of their way to make it so the LED and camera function are independent, and I'm sure many do, for the worst reasons you can possibly think of.
Earlier quoted context omitted.
The teardown showed this is the 1% right? Also I thought you could trust iMessage if, unlike everyone, you disabled iCloud backup (and, unlike everyone, so did the recipient). Perhaps a way for the feds to be able to pin dumb criminals while giving investigative journalists & dissidents a way to stay safer.
According to Apple, you can have iCloud backup enabled while maintaining E2E encryption with their Advanced Data Protection option: https://support.apple.com/en-us/102651#advanced You do have to be sure to not enable web access via icloud.com
Much easier to use a 3rd party app like Signal.
All this ownage will get shut down when manufacturers start whining to politicians and the AI companies will ask how high to jump.
Earlier quoted context omitted.
Apple also claims that iMessage is end to end encrypted. Their privacy stance is 99% posturing.
The teardown showed this is the 1% right? Also I thought you could trust iMessage if, unlike everyone, you disabled iCloud backup (and, unlike everyone, so did the recipient). Perhaps a way for the feds to be able to pin dumb criminals while giving investigative journalists & dissidents a way to stay safer.