Hacker Newsnew | past | comments | ask | show | jobs | submit | mike_hock's commentslogin

A poorly documented or undocumented (debugging) backdoor in a chip marketed for ATMs and medical hardware, enabled by default, at the very least qualifies as reckless endangerment.


Not really. A properly designed network should take account for such things as unknown/irreparable flaws. An irreparable backdoor in a device can be mitigated with a gatekeeper, something akin to a firewall that will not allow a threat actor to have access to a faulty device.

The real recklessness would be allowing an ATM unfettered access to the internet on the assumption that the manufacturer has already protected the device from every known and unknown threat.


I was basically going to quote your whole statement here and then point to the more than 19 US states that have had Water Treatment plants forced to disconnect much of their Operational Technology systems.


And those disconnects would be that effective gatekeeper. Maybe overkill, but "air gapping" is a often a reasonable mitigation.


it is not overkill to airgap OT tech. having it on the internet is really braindead.

most ones that are routable are hackable real easily. the only reason no one does it is because they dont need to or dont want to.

more people should do this. there should be laws to prevent such systems to be connected to others.

main problem is often billing systems and sometimes OT stuff will need things like weather info or external data which makes it harder or more expensive to effectively airgap. remote places are also a pain to maintain if u cant connect into them.

this is why most of these places rely on not being routable over most internet, so u vpn to some place and connect in from there. Sibsequently many engineers will not properly secure OT because its not routable.

then a routing mistake happen at ISP and oops all the boxes are rooted -_-.

airgapping is not overkill.


Both can be negligent at once.


ofcourse. its just a difference between 'ooh china is evil' or 'derp some company has shit processes' which on a certain level is quite a big difference, though for most consumers will indeed boil down to the same.


Great article for April 1st! No, wait. It's August 7th. Wat.


I already have a second usable device and I don't mind the extra weight that much most of the time. It's called a laptop computer.

As soon as we get to a point that Linux on the phone works at all, I'm happy to switch completely.

Here, "it works" literally just means it works. Not "GPS doesn't work," "camera only half works," "interop with Android/iOS apps that you're forced to use doesn't work." That doesn't mean "it works." And of course "only works for 2-3 years and then the device gets abandoned" doesn't mean "it works" either.


It's not actually vulnerable.

You're absolutely right. I made a critical error. It's NOT vulnerable.

It' actually vulnerable.

You're absolutely right. I made a critical error. It IS vulnerable.

It's not actually vulnerable.

You're absolutely right. I made a critical error. It's NOT vulnerable.


Hilariously, this comment tripped the LLM writing filter and was auto-deaded. I vouched for it.


Thanks, I guess :D


> I've been able to formally verify that the Rust behavior is identical to the Postgres C behavior

I thought you wanted to get rid of the bugs!


The tongue-in-cheek tone aside, every good rework begins with mostly replicating the old program and only then fixing bugs.

But I've seen brave reworks too. They get my standing ovation when pulled off right.


I think this a positive effect of LLMs, especially once these capabilities get into the hands of criminals and hostile foreign states, i.e. they will do maximum damage with all the safeties off.

This will force everyone to finally take security seriously at both the development and operational levels. You can no longer keep sneaking backdoors into software and count on them remaining hidden for 10 years so you have a nice portfolio of zero days to exploit at any given time.


Thanks for the honest, load—bearing emojis.


If I remove one emoji, the whole eBPF verifier rejects the build Appreciate you taking a look


That’s the _one caveat_.


Thanks for the PSA but I already knew that I wasn't gonna touch it with a ten foot pole.


If anything this reinforces my love for Deno and its ecosystem. A backed-in LSP server is just great developer experience.


> What if <common sense>?

I find it baffling that some people had to find this out the hard way. You already knew that it's — if not more work — then at least more tedious to study existing code than write your own.

People have been choosing greenfield rewrites over grokking legacy code since forever.


I don't buy that minor being "sad" is all nurture and no nature. No matter what tempo or rhythm you put on it or what instruments you use to play it, it may not sound sad, it may sound dramatic and powerful instead, but it never sounds upbeat and happy the way major does (or at least can).


Listening to "Fiddler on the Roof" and klezmer music unsettled to me the idea that major is happier than minor. I still think minor tends to sound "sad", but those wedding songs and the Russian dance in FotR are clearly upbeat and celebratory. (Literally upbeat; the Russian dance is more upward-beat, as it gets faster and faster!)


Yes, the klezmer “default” is minor and upbeat.

It’s my favorite example for the “minor != universally sad across cultures” thing since it’s not so “out there” for the Western ear that people would struggle to even hear minor/major/“music” in it at all.


I’m not seeing how that’s inconsistent with it being culturally derived?

Your brain is still just pattern matching “minor = sad” based on thousands of hours of examples from the western canon consumed throughout your life regardless of how you dress it up with rhythmic variations.


> but TO ME it never sounds upbeat and happy the way major does (or at least can)

FTFY. Notice when you conflate subjective experiences with objective ones. You have been molded by the culture you grew up with. Trying to disentangle yourself from it is like for a monolingual person to express thoughts without using a language.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: