They can hide it in your storage firmware. Sprites Mods attached a jtag to a consumer hard drive, identified the CPUs, dumped the firmware, modified it, wrote it back. When it sees a certain string in any write to the disk, it enters evil mode. Then whenever it sees something that looks like a unix password file, it substitutes it for some known value. As in, hit your webserver with the magic string in the query string portion of the request, then ssh to the box and log in with a known password. Reinstalling your OS does nothing for you since it's in the drive firmware. Also was able to reprogram the firmware online, not requiring physical access to the drive. But literally anything can be compromised. You could have DIMMs that look for magic bits and when they see them they substitute code so the nation state can have code running on your computer anytime they want. Your cpu could do the same. Once it seems some long ass string of bytes that have a particular checksum, it switches to ring 0 or ring -1 or smm mode.
True, but Lenovo has repeatedly demonstrated that they're willing to do it, lie to customers giving them a false sense of security while leaving them vulnerable, and will continue to put their customers at risk even after being caught several times.
That's a cool thought experiment, but it doesn't work in practice.
> When it sees a certain string in any write to the disk
dm-crypt or zfs encryption or any other commonly used encryption will encrypt the data before it's written to disk, so the disk controller will not be able to do anything with writes or reads since it will not have the encryption key.
The general point related to the topic of the article is that the many controllers running on your device (not limited to Lenovo BTW) are black boxes almost impossible to inspect. The encryption engine on a hardware encrypted USB stick is making everything even harder. It can implement something like this but it's probably made to be extremely difficult to dump the firmware or inspect the features implemented in silicon.
If I'm doing software encryption like dm-crypt or zfs encryption then I don't need to bother with hardware encryption too. It's easier to trust software encryption. We have many interoperable and even open source implementations of the same encryption methods, the output is readable in open formats, so they can be validated against each other if needed.
>> will encrypt the data before it's written to disk
The people buying much of these "hardware encryption" products do so because they believe it removes the need for software encryption to/from the device.
Can we see the Congress Files now? Our congress members have spent millions of tax-payer dollars paying off their sexual assault and rape victims. And unlike the Epstein files there is no unsubstantiated gibberish submitted by crazy people that didn't withstand the smell test. One hundred percent of the content of the OCWR files will be substantiated and factual.
In this day and age, 100% of all presidential acts need to be documented publicly. It's no longer enough to wave a piece of paper around and say "see, it has his signature." Random cabinet secretaries and white house staffers running papers through the autopen should be a capital crime and the only sentence should be hanging.
Is this really something that has been happening, or just some nonsense that has been thrown out to see what sticks? Yes, using the autopen should be limited to the mass signing of trivial correspondence like annual christmas cards or form letter responses to anything received from the citizens that used a stamp. Has there been any one seriously concerned about legislation or executive order type of documents being signed this way?
It's hard to know. People have opinions that it might be happening, which is why I call for presidential action to be public, and not in the form of final signed papers. I want to be able to see the president making the decisions and taking the actions that affect everyone in the country.
I wasn't aware of this supposedly. I had assumed that the EO signed covered it in a single signature. Not sure which is worse here, my assumption or your supposedly.
Looking more into this, it looks like you're correct. It was a single action which resulted in that ~1,600 pardons, not 1,600 individual documents. My bad.
These sorts of project should be using the 68000 or the 65816 which both give a 24 bit address bus. Meaning they get 16 MB of address space to work with. They can make directly addressable frame buffers at high resolutions and reasonable color depths, and still have lots of memory available for programs and data.
I'm curious on why you think that, say, an M2 running linux will ever be a better choice for AI workloads than an M5 Pro running MacOS? What is it that you think is in the hardware that you'd be able to unlock with linux but isn't exposed by MacOS?
I'm sure a lot has changed since cough 2004, but that was the state with the PowerPC G4 and G5. Machine learning Linux applications used the IBM Power architecture because of their vectorization features, and that hardware was ridiculously expensive. When Apple started using Motorola and IBM's cheaper PowerPC chips with Altivec this small market was pumped, but none of their groovy scientific applications worked on OSX.
This created a large enough market for Linux distros installed on Apple hardware to make it a sustainable business model the makers of Yellow Dog Linux to buy the hardware through a reseller channel, ship it to the building, install Linux on it, then ship the device to customers. I worked there and it was fun.
Lots has changed since then of course, one of which being that Apple controls the chip from top to bottom, and their near-indifference in 2004 now seems to have transformed into something more adversarial.
> I'm curious on why you think that, say, an M2 running linux will ever be a better choice for AI workloads than an M5 Pro running MacOS?
I mean that if Asahi starts to gain on Apple with respect to generation of M chip they support. If Asahi supported M4 chips...
But clearly, my dream hasn't come true yet :-)
> What is it that you think is in the hardware that you'd be able to unlock with linux but isn't exposed by MacOS?
I believe that Linux would give me more control over exactly what is running on the machine (and using up precioius memory). Maybe it would also have better support for the toolchain/ecosystem needed to run local inference?
100% of AI use should have to be disclosed in all cases, not just software. A person using an AI is foregoing responsibility from the get go by using an AI to do things that they can't personally do. What would it even mean for them to be responsible if they submit a patch to a project written by an AI as their own work? Such a person submitting a patch they don't understand that is rejected is in exactly the same place as if they had never submitted a patch. They have nothing to lose.
Except writing patches to an existing project creates a derivative work, and the original copyright still applies to the project, even though your individual changes are owned by you.
(This is why fan made videos using copyrighted characters can be taken down.)
I would say that it can be pretty simple to solve these problems. If a software company is going to implement a license server or a time limited certificate into a piece of software that will prevent the software from working, then they should be mandated to keep all customer payments in escrow and within 5 minutes of the software becoming unusable by the users, the money has to be returned, with interest and adjusted for inflation.
So every week when World of Warcraft goes down for maintenance for a couple of hours. Blizzard should have to forfeit all of the subscribers money, since it is unusable for more than 5 minutes?
If a server runs for 30 years, and then shuts down. It should have to return 30 years of revenue, plus interest?
> So every week when World of Warcraft goes down for maintenance for a couple of hours. Blizzard should have to forfeit all of the subscribers money, since it is unusable for more than 5 minutes?
Skeuomorphism should make my life easier. But sometimes it goes against that. I want to have a button that prints my document, I don't want to have to operate a virtual letter press. Having a switch to turn something on and off that looks like a switch helps me. A screen door that is the lock activation isn't what I would expect.
https://spritesmods.com/?art=hddhack&page=1
reply