4 ms·
> Have I missed anyone? "Security-minded" folk who insist corporates should have full control of their device via signed code from pre-boot, incidentally preve
by sangnoir 7y ago
> Have I missed anyone?
"Security-minded" folk who insist corporates should have full control of their device via signed code from pre-boot, incidentally preventing "non-authorised" replacement parts from working since repair is an attack vector, allegedly.
- ossworkerrights 7y agoApple
- dandelo1953 7y ago$1000, as seen in terms of security is not much to spend on something "perishable". Fixing your secure phone takes more than knowing how to RTFM..... Which means bringing it to repair shop.... which means evil maid or whatever mix of flavor of vulns that creates
- scarface74 7y agoWould you trust Joe Random to replace anything in the hardware authentication pipeline?
- ossworkerrights 7y agoWould you trust a plumber entering your house? They might plant bugs. paranoia
- scarface74 7y agoWould you trust Joe Random to replace anything in the hardware authentication pipeline? Edit: Replied to the wrong comment...
- gpm 7y agoWhy would I want a "hardware authentication pipeline" in a tractor?
- scarface74 7y agoReplied to the wrong comment....
- deleted 7y ago[deleted]
- jandrese 7y agoWhat's the threat model for a tractor/harvester/etc...? Who wants to send a piece of farm equipment on a very slow rampage via a complex and difficult hack job? One that will be stopped if the manufacturer has any sense at all and has physical kill switch. Maybe sabotage from competing farmers? But that seems far less likely than the owner wanting to maintain his equipment after the manufacturer has abandoned it.
- to11mtm 7y agoDevils advocating here, but they could always use the boogeyman of China wanting to disrupt our exports via espionage. Remember, doesn't have to be likely, just has to be a good headline.
- jandrese 7y agoI feel like if spies were sneaking around farms disabling tractors they probably wouldn't do it via a software thing. Lighting them on fire or shaped charges on the engine seem harder to reverse.
- to11mtm 7y agoEhhh, I'm thinking more along the lines of Stuxnet here. i.e. could something be done that doesn't necessarily destroy the attacked equipment itself, but instead impacts the output in a negative (and hard to trace) form.
- sangnoir 7y agoJohn Deere is not the only opponent to right-to-repair: Apple has consistently opposed any such proposals and I had them in mind (and Google too with how it handles security on Chromebooks; granted, Google provides a temporary "run-your-own-code" escape-hatch at boot time). Whenever Apples antipathy to 3rd party repairs is discussed on HN - there's almost always a contingent that declares security (as imposed by Apple) is a reasonable trade-off to for not being able to do your own repairs