Skip to content

UK wants to weasel out of demand for Apple encryption back door

Technology
22 16 0
  • 41 Stimmen
    3 Beiträge
    27 Aufrufe
    M
    Does anybody know of a resource that's compiled known to be affected system or motherboard models using this specific BMC? Eclypsium said the line of vulnerable AMI MegaRAC devices uses an interface known as Redfish. Server makers known to use these products include AMD, Ampere Computing, ASRock, ARM, Fujitsu, Gigabyte, Huawei, Nvidia, Supermicro, and Qualcomm. Some, but not all, of these vendors have released patches for their wares.
  • 18 Stimmen
    1 Beiträge
    11 Aufrufe
    Niemand hat geantwortet
  • 127 Stimmen
    5 Beiträge
    35 Aufrufe
    V
    a subtle edit resolving a duplicate reference in a way that removes displays from the list of parts that must be replaceable by a layperson with basic tools That's fucking significant change, considering probably even more smartphones become ewaste from cracked screens than anything else by a long shot...
  • 35 Stimmen
    3 Beiträge
    25 Aufrufe
    T
    On the one hand, this is possibly dubious in that things that aren't generally considered to be part of defence will be used to inflate our defence spending numbers without actually spending more than previous (i.e. it's just a PR move) But on the other hand, this could be immensely useful in telling the NIMBYs to fuck right off. What's that, you're opposing infrastructure improvements, new housing, or wind turbines? Aw, diddums, that's too bad. This is deemed critical for national security, and thus the government can give it approval regardless. Sorry Bernard, sorry Mary, your petition against any change in the area is going nowhere.
  • 119 Stimmen
    10 Beiträge
    64 Aufrufe
    S
    Active ISA would be a disaster. My fairly modern car is unable to reliably detect posted or implied speed limits. Sometimes it overshoots by more than double and sometimes it mandates more than 3/4 slower. The problem is the way it is and will have to be done is by means of optical detection. GPS speed measurement can also be surprisingly unreliable. Especially in underground settings like long pass-unders and tunnels. If the system would be based on something reliable like local wireless communications between speed limit postings it would be a different issue - would also come with a significant risc of abuse though. Also the passive ISA was the first thing I disabled. And I abide by posted speed limits.
  • Building a personal archive of the web, the slow way

    Technology technology
    2
    1
    24 Stimmen
    2 Beiträge
    19 Aufrufe
    K
    Or just use Linkwarden or Karakeep (previously Hoarder)
  • 1 Stimmen
    8 Beiträge
    40 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.
  • 12 Stimmen
    3 Beiträge
    22 Aufrufe
    F
    The new Pebble watches look interesting. Relatively basic, but long battery life (they promise) and open-source operating system.