Hacker Newsnew | past | comments | ask | show | jobs | submit | negative_zero's commentslogin

Agree on your comments about amateur hour.

I've worked in payment terminal hardware security and this is not surprising to me at all.

This attack on the Ledger wallets would definitely rate as amateur in terms of sophistication in that world.


EEE here. I've not looked at these in detail myself as they are illegal in my country. Off the top of my head, the big problem I see is that, since you are injecting power BEHIND the circuit breaker an end-user can overload a circuit.

i.e You have a circuit with max current 16A; clever end-user plugs in 3 x 800W panels into different sockets BUT they are unfortunately on the same circuit; now 26A can be potentially drawn through a single cable IN THE WALL without tripping the breaker. This is a BIG fire hazard.

And you can't wave this away with instructions. It has to be 100% impossible for an end-user to do this.


That's why in Germany you are limited to at most 800 W for you house with plug-in solar.

Of course your argument still stands, but we're talking about at most 3.5 A extra current, not 10 A. Home installations seem to be adequately sized to be able to handle that load. At least I'm not aware of any reported incidents, and people have been putting them up for quite a few years already. And typically, German regulations err on the side of caution.

But sure, with 110 V, you will have more problems with the extra current for the same power, so in the American grid there could be further precautions necessary.


You cannot rely on that limit though. People WILL plug in more than that. The whole system has to be kept inherently safe. All other concerns are solvable, but I don't see how you solve this, bar having a special balcony-solar-socket installed where an electrician has verified that it will be safe in all scenarios.


Why? It works in many countries without incident. What makes the US different?


I would contest it's without incident. The US is higher risk since it uses 120V => the currents are x2 higher and US electrical safety standards are an eclectic mess of: world leading and 3rd world.

Not picking on the US though. These panels in their current incarnation, are lowering the level of safety of electrical everywhere.

This is all just my opinion though. A lot of my background is in compliance. I've been frustrated by some obvious electrical safety advancements that are STILL not being implemented. I also have first hand experience with many many signed off electrical systems which were death traps. This all biases me heavily towards not compromising on electrical safety. But maybe I am overreacting.


Americans are, for the most part, fucking morons. We invented the infamous warning labels like DO NOT EAT THE TONER CARTRIDGE or DO NOT HOLD THE CHAINSAW BY THE BLADE or REMOVE CHILD BEFORE FOLDING STROLLER or PEANUTS: CONTAINS NUTS

We're also very litigious, as it isn't hard to convince a jury to award damages to a fellow moron.


Italy has the "Do not store your cat under the seat" warning. They do NOT put it on Italian-market scooters and they definitely DO put them on US-market scooters.

https://members.modernvespa.net/brian_herwick_-_coolass/uplo...


Everybody in the world is a moron. Americans just recognize some places where we are morons and try to prevent stupid people (which includes me and you!) from doing some stupid things.

Not everything, Americans do get by with doing other moronic things that other countries do things to prevent. However other countries also do their own moronic things that Americans are much less likely to.


It would in practice be (mostly) fine, just as it is elsewhere. But electrical safety principles in the US are typically "must be safe regardless of the dumbest possible use" so that "mostly" is a big obstacle.


I sincerely get your concern. Clearly explain on the box what NOT to do and be explicit about the risk. Use an icon of a house on fire. Done. Life is risk, and regulating and banning things based on the lowest common denominator of human judgement is a fool's errand. Should we ban vehicles as well since about 40k people die from vehicle related fatalities annually?


In my view it's more that: electrical safety has advanced to it's current "version" and allowing these panels is a regression in safety. There's already plenty of products/theoretical-products that are banned and/or tightly controlled for electrical safety sakes (suicide cable is the poster child).

To use your car analogy, we're not banning vehicles. We're disable one of the airbags when enabling fuel economy mode.


I'm still working through the UK rules, ( https://assets.publishing.service.gov.uk/media/6a60a03c47af6... ) but one of those is explicitly addressing that: no more than 1 such device is allowed per circuit. Also those are 3.5A each on our voltage.

> you can't wave this away with instructions

But apparently you can with legislation about instructions.

Edit: government safety investigation https://assets.publishing.service.gov.uk/media/6a32bfea0bea2...

Final edit: "61% of respondents support having one device per household circuit while 19% considered that only a single plug-in solar device should be permitted per premises citing alignment with 44 Engineering Recommendations G98 Issue 2 Amendment 1, impact on the network, old wiring in properties and the ability of consumers to correctly identify separate electrical circuits.

Government response: Having considered consultation responses and stakeholder feedback, the government's approach is to limit the deployment to one per power circuit, subject to corresponding changes to the G98. Some respondents suggested limiting the total capacity per dwelling to 800VA, but we think the evidence for doing this is weak considering most UK dwellings have a minimum of two power circuits"

-- i.e. they thought about it and the concerns got outvoted.

It's probably fine. There's a lot worse lurking in outdated UK installations. Then we get on to ring circuits, which the rest of the world disagrees with and also seem to be fine.


Wait, people in the UK actually follow those instructions?

In the US, even with a warning, you'd get regular home fires as people hooked one of these panels into every available outlet just because they can. I wish I were joking.


Thanks for those links I will check them out.

I hope it's at least "probably fine". I've seen some pretty shoddy electrical work in my lifetime (including new installs) and am now of the mind that the deep-defense-in-depth of electrical safety we have these days is to also "cope" with shitty electrician work.


Wouldn't all three being plugged in be likely to trip the breaker, because it's just AC and the breaker can't really tell whether energy is flowing "forwards" or "backwards"?

Seems like the worst case scenario is when you mix solar panels with load on the same circuit.

800W at 110v is about 7 amps. Suppose you have a 7 amp solar inverter plugged in as the first thing on that circuit. Further down the line, you have 22 amps worth of load. The circuit breaker sees 15 amps, but the wiring between the panel and the load is carrying 22 amps, which would ordinarily trip the breaker but it doesn't because the solar setup is masking it.

I'm not an electrician. Perhaps wiring code has enough safety margin that being 800 watts over on some circuit isn't actually a serious safety concern, but I could understand why this might not be allowed.

The EU is on 230v, so maybe it's a bit more practical over there because you can add twice the solar capacity for the same amount of additional current you'd have in the US, so they aren't eating into the safety margin quite as much. Though it seems they also use thinner wire gauge generally, so maybe the difference is moot.


Yup. Worst case scenario is indeed mixing generation and load on the same circuit. And you have to assume that some number of people will manage to do that and create a fire hazard. To connect it safely, you need to know the circuit layouts and the rating of the cables. This is not something solvable with a safety sticker and safety instructions. A huge amount of effort has gone into making domestic electrical installs as inherently safe as possible and these panels are a back door to that.

Don't get me wrong, I think they're a spectacular idea, especially for renters. But you'd need an electrician to check the circuit and maybe even have a special balcony-solar-plug to prevent people plugging in too many panels in the wrong locations.

Quick edit: Random idea. I guess if the panel could communicate with the RCBO it's connected to and that RCBO can dynamically alter it's trip current could also solve it. But again, that's an electrician call and new thing installed.


There is a YouTube video where a guy tested how many amps are required before a fire starts and it was like 70 iirc. 30 amps didn’t even get the wires hot. I’m not sure that’s true after several hours of continuous usage of multiple space heaters plus plug in solar, for example. It’s not a risk I would even entertain but I think the real risk is pretty low.


I’d also guess bad inverter hardware could cause lots of dirty/noisy AC power effects and damage other equipment on the system. This definitely doesn’t sound like a very safe approach without a lot of conditions being met and exactly like your example there are too many ways it can go wrong.


Odd. Google Pixel 7 with GrapheneOS here. OsmAnd works perfectly fine for me without disabling any exploit protection options.


CoMaps behaves very very weirdly on GrapheneOS. Same with OrganicMaps.

Osmand and GMaps are working fine.

Waze is almost melting the poor thing. Beside of that working fine.


CoMaps and Waze definitely work well on GrapheneOS. There's a known performance issue experienced by some users with the OsmAnd OpenGL renderer which can be worked around disabling hardened_malloc. We could likely provide a performance vs. security toggle for hardened_malloc to avoid it, but we also plan to continue optimizing the default high security mode.


Osmand and OrganicMaps work flawlessly for me. Waze on 6 (not pro), works better than on my 9 Pro.


I use Comaps daily on GrapheneOS on a Pixel 8 Pro and it works great.


Have had no noticable problems with organic maps.


Weirdly how? CoMaps seemingly works fine out of the box on my device


Waze works perfectly fine for me


Anyone writing about apps compatibility should specify if it's with or without the play services


Can you even run Waze/GMaps without Play services?


Waze and Here Maps work well.


Yes.


Neat, every day I inch closer to not needing Play Services anymore.

https://plexus.techlore.tech/apps?q=waze


For more precision:

Waze is fairly easy to run without play services. GMaps I haven't yet found a way to run, but also haven't looked in quite some time.


Google Maps used to work without it but recently gained a hard dependency on Play services. We could add more shims to make more apps work without it installed but that hasn't been a focus yet.


Makes sense. Any idea if there's any interest in a shim to get notifications working sans Play services?

I haven't looked at anything shim related in quite a while and am not super familiar with the notification stack for Android, so if that's a stupid question I apologize.


comaps and organic maps shares some of the same codebase right?


AFAIK CoMaps is a fork of OrganicMaps after OrganicMaps added some sort of ads or sponsoring. They both use OSM


And yet problems exist. Live Updates are not rendered if both OsmAnd V2 rendering and hardened memory allocator are enabled: https://github.com/osmandapp/OsmAnd/issues/20190


Those are memory corruption bugs which are potentially exploitable vulnerabilities. There are no false positives for the security protections in hardened_malloc including the hardware memory tagging (MTE) integration. It only detects invalid memory corruptions via use-after-free or out-of-bounds accesses. Due to a relatively high number of apps having invalid memory accesses during regular use, we don't enable MTE for all user installed apps yet. We always use MTE for the kernel and userspace code in the base OS but it's opt-in for most user installed apps via a global toggle to enable it by default and a per-app toggle mainly intended for opting out for incompatible apps.

OsmAnd has a massive amount of legacy C++ code which hasn't been heavily tested with HWASan and MTE. It has a history of having many memory corruption bugs discovered and reported by GrapheneOS users. That's the exploit protections in GrapheneOS working as intended and it's why there are per-app compatibility toggles to work around apps which can't be used due to memory corruption during regular use. It would be better if apps had higher quality native code and didn't need us to provide compatibility toggles but that's the way things are. It's much worse on desktop operating systems.


Now get it through compliance :)


Obligatory link to an interview with three of the Goldeneye developers about the development of the game. I found it very fascinating.

https://youtube.com/watch?v=bNN9XhGZ3Yw

(Also The Centre for Computing History YouTube channel is seriously underrated)


As usual for these posts. No certifications. No proper markings. Probably non compliant. Will probably go unpunished.


Modular Approval is an FCC thing only. CE doesn't have it.


It always seems wild to me how, in the US, something like the grid is just a wild west.

"ERCOT said it is reviewing the test failures and drawing up plans to protect the grid from disruptions."

Why are they even allowed to connect? / Why are they not kicked off? / Why aren't they being forced to add their own grid inertia?


ERCOT operates under a “connect and manage” interconnection philosophy. This means things can actually get built quickly (unlike other ISOs), but some management is required.

Of course, there are some downsides to this approach, but overall I think it’s a superior. Just look at renewable and battery penetration compared to other ISOs.


This isn't the US - it's just the state of Texas. The rest of the contiguous United States is on two large grids. Texas has its own.

It's up to ERCOT to figure their own mess out. They will. Nobody else really has to care about it.


They aren’t being allowed to connect until they get it worked out. At least that’s how I read it.


Any chance of having a finger print scanner on the back of the phone?

I personally really dislike the screen ones. They're slower, less reliable and the location is unnatural.


Mine (really cheap G05) has it on the power button, much better than the back where it used to be on older models. Motorola have been innovative with the UX. It lights up when I pick it up, shake twice to toggle flashlight (extremely useful when looking for dog poop) and so on. Only brand I've considered for about a decade.


Shake to toggle flashlight is the one feature that makes people ask about my phone.


So if I am a small open source developer or run small website, this could be added to my AI scraping defences?

If something like Nepenthes added poisoned pages to it's tarpit then a small number of users can just poison all LLMs?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: