4 ms·

Can't wait for the first large-scale exploit of this stuff, which will finally force DRAM manufacturers to fix their faulty crap.

by fbanon 5y ago

passivate 5y ago
Why wish for exploits that harm regular users who have nothing to do with design decisions made by DRAM manufacturers?
- dredmorbius 5y ago
  Until there are victims, threats tend to be ignored. This extends well beyond software. Next time you smell "gas", give a thought to the 300 souls of the New London School. https://en.wikipedia.org/wiki/New_London_School_explosion https://en.wikipedia.org/wiki/New_London_School_explosion Safety standards are written in blood.
  - passivate 5y ago
    We learn and improve when accidents happen, but there is no reason to wish harm on innocent people. >Until there are victims, threats tend to be ignored. If you can't convince someone to address a threat, you need to get better at convincing, rather than creating victims to prove a point.
    - dredmorbius 5y ago
      I'd much prefer this were the case. History strongly suggests it is not. In large part because non-manifested risks, or not fully manifested risks tend to be dismissed or belittled, most especially when that denial is presently remunerative. Vaccination and non-pharmaceutical interventions against global pandemics, an economy based on massive surveillance by states / enterprises / other actors, global warming, CFCs and ozone depletion, use of lead (in fuels, paint, glazes, toys, and other materials), asbestos, tobacco, car and highway safety, racism and ethnic favouritism, industrial safety, mercury use, plastics, unoderised natural gas, mine safety, electrical codes, fire codes in buildings, ... In the infosec / cybersecurity world we've at least the advantage of being able to provide proofs of concept which move a given risk from the theoretical to the manifest. Even then, effective reduction or mitigation takes far too long. If there's a correction, I'd suggest that the onus be placed not on the advocates but the deniers. A marked penalty for advocating a position which turns out to be untrue with credible basis for knowing that it is untrue is one possibility that's occurred to me. How that would play out I'm unsure, but I'd be willing to explore the question. You're advocating ought. I'm describing is.
      - passivate 5y ago
        Sorry, your entire argument hinges on your own opinion . "history suggests" and "tends to be" is your own subjective criterion and not something that I am interested in arguing over. I'm proposing ethical ways, wishing harm on others is unethical. You're free to make your own choice.
        dredmorbius 5y ago
        You're arguing against the messenger and their delivery. Not the facts themselves. Based on an appeal to emotions. I've already stated my case as clearly as I can, and why my preferred choice would be. Your response indicates that's insufficient to convey my intended meaning to you. Which is an interesting case of communications failure itself, come to think of it. Again, PoC is the widely-accepted alternative to general catastrophe. Even that is very often insufficient. In a "less harm* calculus, an exploit in the wild which demonstrates risk whilst minimising consequence (not a PoC, but an actual exploit) if that results in action to address the risk would actually be preferable to the ineffective pleading alternative which results in greater harms. Reality is the domain of pragmatic choices and hard trade-offs. The notion of regulations being written in blood is well-established. I'd strongly recommend the work of Charles Perrow, Normal Accidents and The Next Catastrophe in particular. Further: https://duckduckgo.com/?q=regulations+written+in+blood&ia=web https://duckduckgo.com/?q=regulations+written+in+blood&ia=we... https://avotraining.wordpress.com/2012/05/09/quite-often-the-problem-concerning-the-p/ https://avotraining.wordpress.com/2012/05/09/quite-often-the... https://sharaevans.com/history-of-safety-regulation-written-in-blood/ https://sharaevans.com/history-of-safety-regulation-written-... https://www.maritime-executive.com/article/Safety-Regulations-Written-in-Blood-2014-10-21 https://www.maritime-executive.com/article/Safety-Regulation... https://www.pilotsofamerica.com/community/threads/regulations-written-in-blood.97173/ https://www.pilotsofamerica.com/community/threads/regulation... https://aviation.stackexchange.com/questions/13081/why-do-people-say-aviation-regulations-are-written-in-blood https://aviation.stackexchange.com/questions/13081/why-do-pe... https://books.google.com/books?id=vDnbtIzpnccC&pg=PA66&dq=regulations+written+in+blood&hl=en&sa=X&ved=2ahUKEwiW2bTmp570AhXQQs0KHdzIAroQ6AF6BAgHEAM https://books.google.com/books?id=vDnbtIzpnccC&pg=PA66&dq=re...

Can't wait for the first large-scale exploit of this stuff, which will finally force DRAM manufacturers to fix their faulty crap.

by fbanon 5y ago

Can't wait for the first large-scale exploit of this stuff, which will finally force DRAM manufacturers to fix their faulty crap.

passivate 5y ago

Why wish for exploits that harm regular users who have nothing to do with design decisions made by DRAM manufacturers?

dredmorbius 5y ago
Until there are victims, threats tend to be ignored. This extends well beyond software. Next time you smell "gas", give a thought to the 300 souls of the New London School. https://en.wikipedia.org/wiki/New_London_School_explosion https://en.wikipedia.org/wiki/New_London_School_explosion Safety standards are written in blood.
- passivate 5y ago
  We learn and improve when accidents happen, but there is no reason to wish harm on innocent people. >Until there are victims, threats tend to be ignored. If you can't convince someone to address a threat, you need to get better at convincing, rather than creating victims to prove a point.
  - dredmorbius 5y ago
    I'd much prefer this were the case. History strongly suggests it is not. In large part because non-manifested risks, or not fully manifested risks tend to be dismissed or belittled, most especially when that denial is presently remunerative. Vaccination and non-pharmaceutical interventions against global pandemics, an economy based on massive surveillance by states / enterprises / other actors, global warming, CFCs and ozone depletion, use of lead (in fuels, paint, glazes, toys, and other materials), asbestos, tobacco, car and highway safety, racism and ethnic favouritism, industrial safety, mercury use, plastics, unoderised natural gas, mine safety, electrical codes, fire codes in buildings, ... In the infosec / cybersecurity world we've at least the advantage of being able to provide proofs of concept which move a given risk from the theoretical to the manifest. Even then, effective reduction or mitigation takes far too long. If there's a correction, I'd suggest that the onus be placed not on the advocates but the deniers. A marked penalty for advocating a position which turns out to be untrue with credible basis for knowing that it is untrue is one possibility that's occurred to me. How that would play out I'm unsure, but I'd be willing to explore the question. You're advocating ought. I'm describing is.
    - passivate 5y ago
      Sorry, your entire argument hinges on your own opinion . "history suggests" and "tends to be" is your own subjective criterion and not something that I am interested in arguing over. I'm proposing ethical ways, wishing harm on others is unethical. You're free to make your own choice.
      - dredmorbius 5y ago
        You're arguing against the messenger and their delivery. Not the facts themselves. Based on an appeal to emotions. I've already stated my case as clearly as I can, and why my preferred choice would be. Your response indicates that's insufficient to convey my intended meaning to you. Which is an interesting case of communications failure itself, come to think of it. Again, PoC is the widely-accepted alternative to general catastrophe. Even that is very often insufficient. In a "less harm* calculus, an exploit in the wild which demonstrates risk whilst minimising consequence (not a PoC, but an actual exploit) if that results in action to address the risk would actually be preferable to the ineffective pleading alternative which results in greater harms. Reality is the domain of pragmatic choices and hard trade-offs. The notion of regulations being written in blood is well-established. I'd strongly recommend the work of Charles Perrow, Normal Accidents and The Next Catastrophe in particular. Further: https://duckduckgo.com/?q=regulations+written+in+blood&ia=web https://duckduckgo.com/?q=regulations+written+in+blood&ia=we... https://avotraining.wordpress.com/2012/05/09/quite-often-the-problem-concerning-the-p/ https://avotraining.wordpress.com/2012/05/09/quite-often-the... https://sharaevans.com/history-of-safety-regulation-written-in-blood/ https://sharaevans.com/history-of-safety-regulation-written-... https://www.maritime-executive.com/article/Safety-Regulations-Written-in-Blood-2014-10-21 https://www.maritime-executive.com/article/Safety-Regulation... https://www.pilotsofamerica.com/community/threads/regulations-written-in-blood.97173/ https://www.pilotsofamerica.com/community/threads/regulation... https://aviation.stackexchange.com/questions/13081/why-do-people-say-aviation-regulations-are-written-in-blood https://aviation.stackexchange.com/questions/13081/why-do-pe... https://books.google.com/books?id=vDnbtIzpnccC&pg=PA66&dq=regulations+written+in+blood&hl=en&sa=X&ved=2ahUKEwiW2bTmp570AhXQQs0KHdzIAroQ6AF6BAgHEAM https://books.google.com/books?id=vDnbtIzpnccC&pg=PA66&dq=re...