HN user

the_plus_one

70 karma
Posts0
Comments21
View on HN
No posts found.

In my experience, the bulleted list with emojis is usually a pretty strong tell (the one in the article just after "We call these parts sub-projects"). LLMs (maybe just ChatGPT) love doing that.

Is that necessarily a bad thing? I have older laptops than the U729 that still see some use. If you're not locally compiling a big codebase, running some AI/LLM thing, playing GPU-intensive games, etc., you really don't need much.

As an American that grew up in a rural area, this definitely isn't something that would've been taught in a public school here. At best, we had typing classes in middle school, and the (quite old) teacher insisted on two spaces after the end of a sentence, something that disappeared after we stopped using typewriters.

It's been several years at this point, but I used to be a cloud support engineer for AWS (i.e. the first line of defense against support tickets). We were trained to always be kind to the customer, even if we're frustrated with them, so a response like "please read how the lambda works" probably would've gotten me reprimanded. Customers can rate your response from one to five stars, and if I remember correctly, anything less than four required a written explanation to your manager as to what went wrong.

That job was a glorified call center; I didn't last very long.

Very cool post! I enjoy anything that has to do with game hacking, and it's nice to see D, a language I don't have a ton of experience with. Just one note you/the author may be curious about:

Notably a process_vm_writev syscall also exists, however it adhears to memory page protections - so if I wanted to inject data into a write-protected memory page, it’d fail.

You can work around this by convincing the process to re-mmap() the read-only section with PROT_WRITE. One way I've done this is by building a shared library with __attribute__((constructor)) that gets LD_PRELOADed into the game binary, though you have to be careful with the timing (e.g. your library may start running before the game has allocated the mapping you're looking for). That said, if you've done this, you are also free to just allocate your own memory rather than having to look for unused portions of it.

    - They can know when you sleep
    - They can detect when there are 2 people sleeping in the bed instead of 1
    - They can know when it’s night, and no people are in the bed
I'm probably naive, but I'm failing to see how any of this is exclusive to having remote SSH access to the bed. Who's to say this isn't already happening with other binaries in the firmware? Maybe they're already phoning home?
    [...]that bypasses all forms of formal code review process.
How does the author know if anything else in the firmware goes under any kind of code review process?

It's not a bad article, but it does seem to make a lot of assumptions, and you already agreed to let arbitrary code run on your network when you added an IoT device to it.

This is more on the user end, but there's ways for users to isolate programs in such a way that this malware wouldn't have access to e.g. browser files and cryptocurrency wallets, some more effective/practical than others. Virtual machines, containers, jails, chroots, etc.

I think one example of what you're talking about can be seen on Android. The developer has to explicitly declare permissions (like file access) in the manifiest, and the user has to explicitly approve it.

I've looked into this before, and it seems like they got Starlink recently-ish (within the past couple years or so). A google search of "inurl:reddit mcmurdo starlink" brings up a few hits from /r/antarctica.

I bumped into kk4vcz at Defcon in 2021. I was standing around, looking clueless, and playing with my Baofeng near the ham radio village. He approached me and asked if I could transmit on a particular frequency to help test his watch. I said something along the lines of "oh that's really cool, I've read that guy's blog and follow him on Twitter." He said something along the lines of "yeah, that's me."

He even gave me a couple GoodWatch boards. Nice guy!

OSRS Map Viewer 3 years ago

To clarify even further, you can technically log into OSRS with old accounts, but none of your stats or gear from back in the day will be there. Everyone started fresh in OSRS when it (re)released in 2013.