• 0 Posts
  • 80 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2023

help-circle


  • Just reread it and no, it’s not a BT vulnerability. The “erase flash” command is something that has to be done by software running outside the BT stack. You can even see that inside the slides. The UsbBluetooth software is connected to the device with the flawed bluetooth chipset.

    The vulnerability is that if you have this chipset and compromised software, someone can flash the chipset with compromised flash. They even say that it’s not an easy attack to pull off in the article.

    In general, though, physical access to the device’s USB or UART interface would be far riskier and a more realistic attack scenario.

    In otherwords, the attack is something that can only be pulled off if there’s also a security vulnerability within other parts of the hardware stack.


  • I just re-read the article and yes, you still need physical access.

    The exploit is one that bypasses OS protections to writing to the firmware. In otherwords, you need to get the device to run a malicious piece of code or exploit a vulnerability in already running code that also interacts with the bluetooth stack.

    The exploit, explicitly, is not one that can be carried out with a drive-by Bluetooth connection. You also need faulty software running on the device.


  • Security wise, unless you are being specifically targeted by someone, you are almost certainly fine. And if you are being specifically targeted, I think someone hacking your ESPs is the least of your worries. A malicious attacker that knows your physical location can do a lot more scary things than just spying through ESPs.


  • You’re fine. This isn’t something that can be exploited over wifi. You literally need physical access to the device to exploit it as it’s commands over USB that allow flashing the chip.

    This is a security firm making everything sound scary because they want you to buy their testing device.



  • This is what kills the ADFs and Israeli whining on antisemitism.

    They’ll call any statement saying Palestinians aren’t disposable refuse antisemitic. Yet, when a guy they like does literal Nazi salutes while quote tweeting shit from the protocols of the elders of Zion “oh he’s just having fun”.

    These are the most antisemitic organizations on the planet. They don’t care about protecting Jews, they care about protecting Israel and will gladly allow an antisemite propagandist in their ranks if it furthers that cause.


  • The amount of power AI and Crypto require is orders of magnitude the amount of power required by pretty much any regular application. The company I work at uses somewhere around 2000 CPU cores worth of compute at AWS (and we have ~100 microservices. We are a fairly complex org that way).

    Generally speaking, an 80CPU core system takes up ~200W worth of power. That means my companies entire fleet operating eats about 5kW of power when running full bore (it isn’t doing that all the time). My company is not a small company.

    Compare that to what a single nvidia A100 eats up. Those GPUs take up to 400W of power. When doing AI/crypto stuff you are running them as hard as possible (meaning you are eating the full 400W). That means just 12 AI or crypto apps will eat all the same amount of power that my company with 100 different applications eats while running full bore. Now imagine that with the model training of someone like chatgpt which can eat pretty much as many GPUs as you can throw at it.

    To put all of this in perspective. 5kW is roughly what a minisplit system will consume.

    Frankly, I’m way more concerned about my companies travel budget in terms of CO2 emissions than I am our datacenter usage.





  • cogman@lemmy.worldtoLinux@lemmy.mlLinux Directory Structure - FHS
    link
    fedilink
    arrow-up
    35
    arrow-down
    1
    ·
    10 months ago

    usr does mean user. It was the place for user managed stuff originally. The home directory used to be a sub directory of the usr directory.

    The meaning and purpose of unix directories has very organically evolved. Heck, it’s still evolving. For example, the new .config directory in the home directory.





  • It does not work like that.

    The problem with such statements is the energy costs are nowhere near fixed. The amount of energy needed to play a song on my iPod shuffle through a wired headset is wildly different from the power needed to play that same song on my TV through my home theater equipment.

    The same is true on the backend. The amount of power Google spends serving up a wildly popular band is way less than what they burn serving up an unknown Indy band’s video. That’s because the popular band’s music will have been pre-optimized by Google to save on bandwidth and computing resources. When something is popular, it’s in their best interests to reduce the computational costs (ie power consumption) associated with serving that content.