> It's fortunate that the steps required here aren't particularly complicated for the devices you can update, and the advice essentially boils down to 'update them'. The problem is the devices you can't update or update easily.
> Update everything that ships a CA bundle: your OS ca-certificates package, certifi, Node, Homebrew, and rebuild your container images once the base images pick up the change.
> Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...
Quick -- we need to MITM all the smart TVs so they can be jailbroken in one fell swoop!
Not in the EU. If devices you made get hacked in the EU and you have a business presence there, you're liable for the resulting damages under the Cyber Resiliency Act. If you don't notify the authorities promptly upon discovery, you might also be criminally liable.
You have to make sure your VM + GPU hide or falsify all identity information. They just have to find one API or signal that you missed that reveals it.
Yes, however, this causes people who know what they do suffer because of people who don't. My question is whether this affects innovation, because the same thing at different places definitely does, and we actively fight against this exactly to help innovation.
Not always true. I have IoT devices where a valid certificate is useful because the original host doesn't exist anymore and the certificate isn't pinned.
Flashing the devices require direct UART/USB access which may involve soldering, if it even exists. This leak is gold for those because these devices will never get an updated CRL.
It's easy enough to apt upgrade, and curl shows it's not vulnerable.
But what about python pip and node and bun which bundle their own certs?
And then you'll have a compiled binary like Claude Code, which was built with bun, and has its vulnerable certificates bundled in, ignoring the system certs.
Yep, it's a long tail. Anything that ships it's own CA bundle will ignore whatever you fix at the OS level. Those bundles are generally root-only and don't have revocation checking, so they can't block a bad intermediate cert.
The fix can only come from the tool shipping an updated bundle, or if there's some way you can point it at the OS store once that's updated.
You can't hardly use the TVs then. I've seen TVs that don't let you use the HDMI port without it being connected if you have a streaming dongle connected. Hopefully that practice has mostly died off now (Samsung used to do this on some models, iirc), but it's still a risk and only kicks the can down the road a bit.
Yeah those devices also need to be “opened up” as it were. Some of them already have been. Just think about it like fermented whiskey. Leave them alone for a month or two until they run an opensource firmware you control.
> > Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...
The interesting question is, how many of these devices will have the compromised CA root certificate in place?
Oh and another thing is problematic, many a Java app ships with its own keystore.jks if it needs to trust some privately hosted endpoint, and that keystore.jks may or may not contain the compromised CA root certificate... updating the OS will not catch this kind of stuff.
> how many of these devices will have the compromised CA root certificate in place?
I have two Google devices at home and both are compromised still. If Google can't handle pushing out a quick cert chain update, then I truly doubt other manufacturers can.
I suspect that's a problem both with human read/written code, and LLM written code -- larger features should be chunked up into more manageable to understand and reason about functions, and assembled at higher levels.
Guiding the LLM (or humans structuring/guiding juniors) to shape the abstractions help make the overall feature and reliability of the code much better.
I didn’t think it would work either, but prompts like “Analyze the signal at 458.25MHz and determine the digital encoding” were all it took. Claude knew how to use the suite of rtl-sdr command line tools, and wrote throwaway Python scripts to analyze the captured data looking for modulation schemes, codec rates, estimating channel bandwidth, and so on. It was actually pretty impressive.
With some help, it downloaded the fcc licensor databases and ingested them into a SQLite database, which allowed it to identify voice frequencies that correspond to an identified control channel.
You can then use tools like dsd-fme to decode and playback digital voice channels and scan entire trunk systems. I’ve been having a blast lately and learning a lot.
Interesting related question -- I recently inherited several WiFI AP/Routers that are openwrt or DDWRT compatible. Are there any packages that folks are working on, or know of that can centrally manage a fleet of them?
If there wasn't, I was going to use this as a project to explore vibecoding...
I fucking loved that game. That and the Dr. Brain games define my childhood. Oh and gizmos and gadgets. And Commander Keen. And Descent. And Hillsfar. And Deathtrack.
But also yes, I did enjoy Myst. It's also what I enjoyed about Minecraft when it first came out. You just had to figure your shit out or get killed by zombies.
The market for video games is now on the close order of 1000 times larger than it was when Myst was released. It now includes the General Public, and all that entails.
Also there are a lot more high-quality games available now, for a lot less money. In the '80s and '90s you might spend $50-100 on a bad game and you'd play it anyways because you couldn't return it. Even if you could, your local game store only stocked so many things.
Now if you're paying full price for a game you've at least had the ability to read reviews and you know it's going to be half price in a year but you want it now. You also have tens of thousands of other games to pick from in basically any genre you want, accessible more or less on demand.
Maybe this is my nostalgia speaking, but it felt better that way. When there was so much less software every new application was a journey. The mystery of going to the local computer store and choosing a floppy disk in a plastic baggie off of that cork board. Or sending a mail order to some PO box in Texas somewhere, and then you get mailed back a floppy disk. Now you have so many options. The option that is often chosen is don't play anything. I probably am very biased on this.
The last time I felt that was Minecraft. You had to email Notch and pay him directly and he sent you a zip file. I genuinely felt the excitement from that like I was a kid.
Now, just click and buy. Done. No fun, no excitement. And the games are all focused on achievements and completion of inane fetch quests.
Now if you're paying full price for a game you've at least had the ability to read reviews and you know it's going to be half price in a year but you want it now.
This was true back then too. Computer Gaming World dates back to 81. Also the software stores that I (i.e., my parents) shopped at back then discounted older titles. This is why I got to play through the Castle of Dr. Brain after the Island of Dr. Brain was released.
Though there definitely is a lot of slop out there (even before that term gained a new meaning) I think it's hard to argue that there are so many more high quality games now than there ever were before just because it's so much easier to develop and distribute them.
Also don't rose-colored-glasses older games either, there was a lot of absolute trash. Bargain bins existed for a reason. That said just because a game is bad doesn't mean it isn't still fun in some way, even if for its brokenness. There's an entire genre of games these days where the basic principle is "if you find a bug, but it's funny, it's now a feature".
It's a loyalty test. And he's given his supporters permission to classify anyone who doesn't follow along as 'the enemy' aka 'the other'. It's a shortcut so his supporters know they don't have to give any credence to anything else they say, since now they assign all the other labels and insults he's hurled at 'his enemies' to the person they are talking to.
He's been doing this for years. Change the name from something widely used/adopted to something brand new and watch who follows along. Anyone who starts using the new name is a friend, and anyone who doesn't is an enemy.
Trans people typically whose a new name, referring to their old name as their “deadname”. People who insist on using the deadname when they know the person has a new name are deliberately mocking, and even being cruel to, the person who has changed their name.
Musk continues to refer to his trans child by their birth name and gender. I can’t understand how someone would do that to their own child (much less anyone at all).
After purchasing twitter he chose for it a new name and wants everyone to use it, but by not bothering to I’m simply following his example.
I make it a rule to refer to companies by the name they least want to be named by and making sure to tie the old and the new name at every opportunity. More often than not these are attempts to whitewash some crime.
In this case though it appears to be a desire to promote the name as part of committing moral crime.
(Most ppl have forgotten that X was the name of one of the two failing companies forcibly merged by their respective investors to form PayPal. I remember musk being a dick back then too)
That's pretty par for the course - at least, as far as authoritarian regimes go. It's getting very difficult to think of the US as anything but, at this point.
It's meant to be embarrassing, that's part of the control strategy. Once you start doing embarrassing things on Trump's behalf, everyone will know you've done a shameful thing, and you can only escape the shame by digging your way deeper into his cult where it becomes a virtue.
On the other hand, "You wouldn't download a wrecking ball?"
reply