• 0 Posts
  • 33 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2023

help-circle






  • Just reread it and no, it’s not a BT vulnerability. The “erase flash” command is something that has to be done by software running outside the BT stack. You can even see that inside the slides. The UsbBluetooth software is connected to the device with the flawed bluetooth chipset.

    The vulnerability is that if you have this chipset and compromised software, someone can flash the chipset with compromised flash. They even say that it’s not an easy attack to pull off in the article.

    In general, though, physical access to the device’s USB or UART interface would be far riskier and a more realistic attack scenario.

    In otherwords, the attack is something that can only be pulled off if there’s also a security vulnerability within other parts of the hardware stack.


  • cogman@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    80
    arrow-down
    3
    ·
    8 months ago

    I just re-read the article and yes, you still need physical access.

    The exploit is one that bypasses OS protections to writing to the firmware. In otherwords, you need to get the device to run a malicious piece of code or exploit a vulnerability in already running code that also interacts with the bluetooth stack.

    The exploit, explicitly, is not one that can be carried out with a drive-by Bluetooth connection. You also need faulty software running on the device.



  • cogman@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    34
    arrow-down
    1
    ·
    8 months ago

    Security wise, unless you are being specifically targeted by someone, you are almost certainly fine. And if you are being specifically targeted, I think someone hacking your ESPs is the least of your worries. A malicious attacker that knows your physical location can do a lot more scary things than just spying through ESPs.


  • cogman@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    180
    arrow-down
    16
    ·
    8 months ago

    You’re fine. This isn’t something that can be exploited over wifi. You literally need physical access to the device to exploit it as it’s commands over USB that allow flashing the chip.

    This is a security firm making everything sound scary because they want you to buy their testing device.


  • it is more obvious in the book compared to the film.

    The film was loosely based on the book and was explicitly written as a critique on fascism and the book. Verhoeven and Neumeier have said as much.

    But also, I don’t think you know what fascism is. There’s always people in a fascist state that have a good quality of life. The question is what happens to people that don’t fit in the state mold? What happens to enemies of the state? Who gets classified as an enemy of the state? Who holds power or can hold power in the state? The fact that to be a citizen you’d have to start by joining the state party is de-facto a fascist state.

    If you were part of the Nazi party in germany as a non-jew/communist/or someone with a disability. Life was pretty good. So good that US newspapers had Hitler as person of the year and sung him praises. They had commerce and a strong economy with most people having great lives. Nazis were popular and liked by the people because they saw them as making their lives better. And you could get a high ranking position in the government by joining the military and serving a term.

    In the film, the enemies were the Arachnids. War started because of the colonization of arachnid territories and extermination was the next order of business. Even though Arachnids are depicted as being thinking and intelligent beings. That was the point of the final scene “It’s afraid!”. Rather than try to understand or communicate with the alien/foreigner/etc, the government prioritized extermination and learning to make it fear them.



  • This is generally going to be less a doctor problem and more a hospital admin problem.

    Hospitals try and employ the fewest doctors possible to save money, they schedule doctors so they have 5 minutes per patient, and they pack the schedules as dense as possible to maximize the number of cases a doctor is handling.

    Any disruption here causes a delay. A patient showing up late, having questions, or the doctor needing to shit. It all adds up to the fail system.

    There are simple fixes here like extending the doctors appointments beyond the average required time and hiring now doctors, but that costs money and doesn’t optimize profit for the shareholders.


  • The amount of power AI and Crypto require is orders of magnitude the amount of power required by pretty much any regular application. The company I work at uses somewhere around 2000 CPU cores worth of compute at AWS (and we have ~100 microservices. We are a fairly complex org that way).

    Generally speaking, an 80CPU core system takes up ~200W worth of power. That means my companies entire fleet operating eats about 5kW of power when running full bore (it isn’t doing that all the time). My company is not a small company.

    Compare that to what a single nvidia A100 eats up. Those GPUs take up to 400W of power. When doing AI/crypto stuff you are running them as hard as possible (meaning you are eating the full 400W). That means just 12 AI or crypto apps will eat all the same amount of power that my company with 100 different applications eats while running full bore. Now imagine that with the model training of someone like chatgpt which can eat pretty much as many GPUs as you can throw at it.

    To put all of this in perspective. 5kW is roughly what a minisplit system will consume.

    Frankly, I’m way more concerned about my companies travel budget in terms of CO2 emissions than I am our datacenter usage.