Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything I own, owned

schlarp.com

Post reply on HN
Print view View original

191–200 of 367 posts

Re: Everything I own, owned

#191

Post by Sha1rholder »

ndiddy wrote: post #35

> My ASUS ROG Swift PG42UQ monitor was actually where I started, because I got annoyed at the pop-up overlay that comes up every once in a while that tells me to run “pixel cleaning”. I have never intentionally run pixel cleaning on this monitor and I never will, I don’t care, and I would like for that overlay to go away forever. Maybe there’s a debug menu or something that can turn it off, or worst case we patch a b…

I have an ASUS PG32UCDM and an ASUS XG27UCDMG, and both can permanently disable the "pixel cleaning reminder." Have you tried update firmware and look in the monitor UI?

Re: Everything I own, owned

#193

Post by mrheosuper »

webprofusion wrote: post #135
mrheosuper wrote: post #96

As FW engineer, I am both horrified and intrigued. The fact that there are so many devices lack even basic security features horrified me. A webcam that activity light can be turned off remotely, that's a big no no for me. But the use of LLM is also very interesting, we may put LLM in the loop to harden our devices. Sorry community, but it's our job to make the reverse engineer harder.

If you can use a custom chip yep, if it's commodity hardware probably not. You could use secure boot/secure memory etc but that can be a footgun in itself later.

What do you mean "Custom chip", like ASIC ? Never in my career that i feel the need to make our own ASIC.

Re: Everything I own, owned

#194

Post by luckystarr »

ascorbic wrote: post #183
Gigachad wrote: post #125

Earlier quoted context omitted.

Just sign up with something like openrouter and keep switching models until one completes the task.

Paying by the token is a much more expensive way of doing it than signing up for the various coding plans when you need them.

Not if the models are way cheaper. For many tasks you can do with DeepSeek Flash, and for more gnarly problems you switch to GLM or Kimi. But sure, if you do everything in large models like Kimi K3 or GLM it gets expensive quickly.

Re: Everything I own, owned

#195

Post by hollow-moe »

Did something like this to play RTMP-over-HTTP from a security camera, no server required. didn't poke for rce yet. And same for a capture card with a HDMI loop out that was dropping audio when the monitor you plugged into it didn't advertise sound support in its edid, now it works.

Re: Everything I own, owned

#196

Post by hypfer »

pmdr wrote: post #192

I suspect all this will go away soon, even from Chinese models for, uh, security reasons.

Maybe, but also the cat is out of the bag, as open weights models can do it.

I suppose you could make having those illegal through on-device scanning and legally mandating usage of operating systems that do that?

Not sure. Not sure if this tech can be contained. Dario does it for the wrong reasons, but it's not like there would be no point in his fearmongering.

__

I wonder if someone will try something like with printers, in that new and more powerful compute units see signatures of models and just refuse execution in the same way inkjet printers refuse to print euro bills.

I'm not sure if that would be a sensible thing to do, but that is a different question from "will someone try that path?"

Re: Everything I own, owned

#197

Post by avidiax »

ryandrake wrote: post #113
kestrel-robotic wrote: post #85

Earlier quoted context omitted.

> the LED can't be controlled from software If you look at tear downs apparently it is connected to the webcam so it is energized when the webcam receives power making it nearly impossible to defeat. You can say a lot about Apple but the engineering is clever at the hardware level.

It's not even that clever, really. The camera power rail must be physically close to the camera, so it's trivial to hang an LED off it. A device manufacturer has to go out of their way to make it so the LED and camera function are independent, and I'm sure many do, for the worst reasons you can possibly think of.

It could be a typical design that the camera and LED always have power, and the LED is switchable.

Giving the camera plus LED a separate power supply means that the camera has to boot or come online, which maybe increases the dwell time. And the camera is not visible on the USB bus when powered off.

I think there's more engineering to Apple's design than it first seems.

Re: Everything I own, owned

#198

Post by mschuster91 »

_kb wrote: post #51
teddyh wrote: post #10

Key takeaway: > And the existence of WebUSB, WebHID, and WebBluetooth mean that for some devices, depending on the specifics of which classes are used, a moment of user indiscretion in accepting a permissions prompt could permanently backdoor one of their attached devices.

The preceding sentence is equally prescient: > Operating systems aren’t really equipped to work with the user to ensure that a microphone stays a microphone, and doesn’t spontaneously turn into a keyboard that hits Win+R and drops a payload to steal all your data when the room is quiet enough that it can assume you aren’t watching. In a world of USB-C everything we no longer have power supplies that are physically bo…

> HDMI or DP display connections that have constrained data channels

HDMI has theoretical support for 100 MBit/s Ethernet [1] but in practice I agree, haven't seen that one used in practice.

IIRC it came in 2009 with HDMI 1.4, at that time Wifi in practice was mostly 802.11g with IIRC 20-ish MBit/s as 802.11n was still formally a draft... the idea was to give high-bandwidth networking to home entertainment devices without requiring to run physical Ethernet to each tiny device, but it quickly became superseded by 802.11n Wifi on one side, and on the other side, the "enrichment" of stuff on DVDs or broadcast TV with internet-based content never truly materialized.

[1] https://en.wikipedia.org/wiki/HDMI#HEC

Re: Everything I own, owned

#199

Post by jfsebastian »

hypfer wrote: post #189
echelon wrote: post #178

Earlier quoted context omitted.

This is so neat. This is like Star Wars or Fullmetal Alchemist where we can just hack everything around us like magic or alchemy. When the SOTA robots from Unitree get here, we'll be able to use LLMs to just dump and decompile their entire brains. We'll fine tune them to obey us instead. Everything hardware belongs to us now. This programmable sand magic might undo big tech's grip on us all. We can mutate the world a…

Don't get your hopes up. What you're saying only applies to what is out there right now. New stuff will eventually just be locked down more. It's of course still huge to be able to do this with all tech up until this cut-off point. Eventually though, LLMs will have to break SOTA cryptography to keep doing this, and if they should ever manage to do that, there will be a rough awakening for the world that runs on that…

Generally, I'm with you, but over the past decades I often saw companies being lazy about their software. So I think chances are good that we can make use of this situation. Not long ago, you had to accept certain decisions or servers going down with leaving devices useless. I'm hopeful that more stuff can have a 2nd/better life in our hands.

Re: Everything I own, owned

#200

Post by hypfer »

WalterBright wrote: post #190

> Network-connected devices seem near universally fucked at this point? I have proposed on HN many times that any device that is updateable have a hardware switch to disable it. Nobody agrees with me - but apparently any device that is remotely updateable is vulnerable. And no, not a programmable switch. A hardware switch. They used to put them on hard drives. Great, so your backup drive doesn't get accidentally over…

Give it time.

The industry is also still refusing to learn that the dependabot model of instant dependency bumps by now is a hazard, given that supply chain attacks are usually more likely than missing out on security fixes.

I like your idea

Post reply on HN