• 0 Posts
  • 64 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2023

help-circle

  • Just reread it and no, it’s not a BT vulnerability. The “erase flash” command is something that has to be done by software running outside the BT stack. You can even see that inside the slides. The UsbBluetooth software is connected to the device with the flawed bluetooth chipset.

    The vulnerability is that if you have this chipset and compromised software, someone can flash the chipset with compromised flash. They even say that it’s not an easy attack to pull off in the article.

    In general, though, physical access to the device’s USB or UART interface would be far riskier and a more realistic attack scenario.

    In otherwords, the attack is something that can only be pulled off if there’s also a security vulnerability within other parts of the hardware stack.


  • cogman@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    80
    arrow-down
    3
    ·
    3 months ago

    I just re-read the article and yes, you still need physical access.

    The exploit is one that bypasses OS protections to writing to the firmware. In otherwords, you need to get the device to run a malicious piece of code or exploit a vulnerability in already running code that also interacts with the bluetooth stack.

    The exploit, explicitly, is not one that can be carried out with a drive-by Bluetooth connection. You also need faulty software running on the device.



  • cogman@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    34
    arrow-down
    1
    ·
    3 months ago

    Security wise, unless you are being specifically targeted by someone, you are almost certainly fine. And if you are being specifically targeted, I think someone hacking your ESPs is the least of your worries. A malicious attacker that knows your physical location can do a lot more scary things than just spying through ESPs.


  • cogman@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    180
    arrow-down
    16
    ·
    3 months ago

    You’re fine. This isn’t something that can be exploited over wifi. You literally need physical access to the device to exploit it as it’s commands over USB that allow flashing the chip.

    This is a security firm making everything sound scary because they want you to buy their testing device.



  • The amount of power AI and Crypto require is orders of magnitude the amount of power required by pretty much any regular application. The company I work at uses somewhere around 2000 CPU cores worth of compute at AWS (and we have ~100 microservices. We are a fairly complex org that way).

    Generally speaking, an 80CPU core system takes up ~200W worth of power. That means my companies entire fleet operating eats about 5kW of power when running full bore (it isn’t doing that all the time). My company is not a small company.

    Compare that to what a single nvidia A100 eats up. Those GPUs take up to 400W of power. When doing AI/crypto stuff you are running them as hard as possible (meaning you are eating the full 400W). That means just 12 AI or crypto apps will eat all the same amount of power that my company with 100 different applications eats while running full bore. Now imagine that with the model training of someone like chatgpt which can eat pretty much as many GPUs as you can throw at it.

    To put all of this in perspective. 5kW is roughly what a minisplit system will consume.

    Frankly, I’m way more concerned about my companies travel budget in terms of CO2 emissions than I am our datacenter usage.




  • cogman@lemmy.worldtoLinux@lemmy.mlLinux Directory Structure - FHS
    link
    fedilink
    arrow-up
    35
    arrow-down
    1
    ·
    9 months ago

    usr does mean user. It was the place for user managed stuff originally. The home directory used to be a sub directory of the usr directory.

    The meaning and purpose of unix directories has very organically evolved. Heck, it’s still evolving. For example, the new .config directory in the home directory.



  • I’m a former mormon, and I can tell you that love bombing (from a cultists perspective) is never from ill intent. They are just trying to share “the truth” and they believe that if you adopt “the truth” everything about your life will be made better.

    If someone is love bombing you for an organization, first thing to do is investigate that organization. Read the stuff they don’t want you to read. Particularly, don’t pull that information from their media/materials. You should seek out the opinions of ex-members of the organization to get a real feel for what it’s all about.

    For example, imagine if the rotary club was trying to recruit you. What do you think an exrotarian would say? Well, you can google it. And, surprise, it’s mostly “Yeah, I moved and just sort of lost interest”.

    Now go visit /r/exmormon and see the miles of shit they have to say about previous membership.

    That, to me, is the acid test. Are exmembers that way because it was just sort of a “meh” event. Or did they get there because the organization was abusive?




  • It does not work like that.

    The problem with such statements is the energy costs are nowhere near fixed. The amount of energy needed to play a song on my iPod shuffle through a wired headset is wildly different from the power needed to play that same song on my TV through my home theater equipment.

    The same is true on the backend. The amount of power Google spends serving up a wildly popular band is way less than what they burn serving up an unknown Indy band’s video. That’s because the popular band’s music will have been pre-optimized by Google to save on bandwidth and computing resources. When something is popular, it’s in their best interests to reduce the computational costs (ie power consumption) associated with serving that content.


  • Yes and no.

    Some salts are easier to work with than others. Kosher salt, in particular, is fairly hard to over season with because you can visually see just how much you’ve thrown onto a steak or such. Fine salt, on the other hand, is a lot easier to over season with.

    But then it also depends a lot on the dish. Sauces are really hard to over season. The sea of fluid can absorb a fair amount of salt before it’s noticeable. Meats are similar. A steak can have a snow covering of kosher salt and it won’t really taste super salty.

    Bread, on the other hand, will be noticeably worse if you throw in a tbs of salt instead a tsp.

    But salt wasn’t specifically what I was thinking when I wrote that. Herbal seasoning garlic, rosemary, thyme, sage, etc, generally won’t overpower a dish if you have too much of them. Especially if you aren’t working with the powdered form. (Definitely possible to over season something with garlic salt/powder).




  • The cost has already been paid. Even small farming communities have rail line access that’s mostly been abandoned because the line owners switched business models.

    As for flexibility, again, that’s mostly an issue with how rail line management has evolved. From shorter more frequent trains to ultra long infrequent trains. Mostly to cut the cost of staffing.

    The solution is simple, nationalize the rail service. Put it under the USPS and have them figure out scheduling to optimize the speed of goods shipping.

    The current state of the rail system is entirely due to the monopolistic nature of ownership. The incentive is to increase prices as much as possible while shipping to the fewest stops possible. Profit motives are in direct conflict with generalized shipping.

    The reason trunking works today is the public nature of roads. Well, why shouldn’t rail lines be equally public? We practically gave the property away to the current rail owners with the notion it was for the public good… They’ve failed that.