[flagged]
Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
41–50 of 109 posts
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#42Earlier quoted context omitted.
Why is it so much of this hardware/firmware feels so much like deploying a PoC to production? Why can't they hire someone that actually knows what they are doing?
Hardware companies are bad at making software, and the corollary, software companies are bad at making hardware.
Which is why NVIDIA is king of the world, they are good at both hardware and software.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#43[flagged]
[deleted]
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#44[flagged]
Well it was solved decades ago in Java yet Java apps have proven no more secure in general.
It is a broader ecosystem problem that there almost no incentive to write secure code. Security is an afterthought like documentation.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#45[flagged]
Well it was solved decades ago in Java yet Java apps have proven no more secure in general. It is a broader ecosystem problem that there almost no incentive to write secure code. Security is an afterthought like documentation.
> Java apps have proven no more secure in general
Really? I think an extraordinary claim like "eliminating a whole class of problems makes applications no more secure in general" should also come with extraordinary evidence.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#46Earlier quoted context omitted.
Why is it so much of this hardware/firmware feels so much like deploying a PoC to production? Why can't they hire someone that actually knows what they are doing?
>Why can't they hire someone that actually knows what they are doing? Because those employees cost a lot of money and these commodity widgets have razor thin margins that don't enable them to pay high salaries while also making enough profit to stay in business. You can pay more to hire better people and put the extra cost in the price of the product but then HP, Lenovo, Dell, et-al aren't gonna buy your product anym…
[flagged]
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#47Welcome back to the 90s.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#48Earlier quoted context omitted.
Why is it so much of this hardware/firmware feels so much like deploying a PoC to production? Why can't they hire someone that actually knows what they are doing?
The consumer space is brutally competitive - you're working on tight margins and designs become obsolete very quickly. MediaTek's business is built on selling chips with the latest features at the lowest possible price. Everything has to be done at a breakneck pace that is dictated by the silicon. You start writing firmware as soon as the hardware design is finalised; it needs to be ready as soon as the chips are rea…
> You start writing firmware as soon as the hardware design is finalised; it needs to be ready as soon as the chips are ready to ship.
On top of that, there's bound to be errors in the hardware design, no modern technology even comes close to being formally proven correct, it's just too damn complex/large. Only after the first tapeout of an ASIC you can actually test it and determine what you need to correct and where to correct it (microcode, EC firmware, OS or application layer).
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#49Earlier quoted context omitted.
Well it was solved decades ago in Java yet Java apps have proven no more secure in general. It is a broader ecosystem problem that there almost no incentive to write secure code. Security is an afterthought like documentation.
> Java apps have proven no more secure in general Really? I think an extraordinary claim like "eliminating a whole class of problems makes applications no more secure in general" should also come with extraordinary evidence.
I think Java's CVE list should say enough. Point being humans can muck anything up, regardless of safeguards
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#50Earlier quoted context omitted.
> Java apps have proven no more secure in general Really? I think an extraordinary claim like "eliminating a whole class of problems makes applications no more secure in general" should also come with extraordinary evidence.
I think Java's CVE list should say enough. Point being humans can muck anything up, regardless of safeguards
A CVE list says nothing. I made my own language which has no CVEs, that obviously doesn't mean it's secure. The relevant metric is "CVEs per unit of functionality".