4 ms·

Suitable story, hacking walled gardens on HN. Reminds me of the Rigol DS1054Z 50 MHz oscilloscope, that you can trivially 'hack' into the more expensive DS1074

Suitable story, hacking walled gardens on HN. Reminds me of the Rigol DS1054Z 50 MHz oscilloscope, that you can trivially 'hack' into the more expensive DS1074Z 75 MHz or DS11074Z 100 MHz scope. Rigol hasn't disabled this hack, even though they can easily do it. They likely loose money if they do so, since customers move to other scopes. Also, some Tesla updates make the experience worse instead of better (V11 update is terrible, inconsistent UI and much more menu diving). I should have disabled auto-updates, and read the forums before doing the update next time.

quux 5y ago
I think Rigol gave in to the hackers? Last year I bought a DS1054Z from amazon and it came with all the options permanently enabled.
heavyset_go 5y ago
Your aside reminds me of the PSP hacking days. Whenever there was an update, you'd have to hold it and check forums to see if it patched your root exploit.
rlpb 5y ago
This is the first I've heard of it - but is this perhaps a straightforward avenue for conventional price discrimination? Businesses that want the 100 MHz may well just pay for it because they don't want the hassle the hack might lead to. And the people who'd use the hack probably wouldn't have paid for the more expensive one anyway. So Rigol might be extracting maximum value thanks to the hack, rather than despite it.
tzs 5y ago
The system for key validation to enable the various features on that scope [1] is actually, if I recall correctly, a well designed system using sound, strong cryptography except they used short enough keys that you can easily brute force it. That's what they keygen programs for it do. It is almost inconceivable that they would know enough to use good cryptography but not know that they needed long keys, so a lot of people believe they intended for it to be easy to hack. One theory I've heard that makes sense is that this is for price discrimination. Your hobbyist user, buying a scope to figure out what is going wrong when they try to talk to their humidity sensor with their Arduino, is not going to pay an extra couple hundred dollars to get the protocol decoding add-on. Paying $400 for the basic scope is already near their limit. So let them have all the features--it makes the Rigol scope more attractive to those users without really costing Rigol anything. So why not just include all the features without requiring keys to enable them? Because people using the scope for business will pay more for them. That's because if they use a keygen program to enable them and use the scope to design or test some product, and later something goes wrong with that product and someone gets hurt and they find themselves being sued, they don't want to have to deal with how a plaintiff's attorney would try to spin that in front of jury. Sure, it would probably not be hard for the defense to respond and explain that the scope behaves exactly the same regardless of whether the key was purchased from Rigol or came from a third party keygen program, so you might think no harm would be done by plaintiff bringing this up. However, civil trials have time limits on how much total time each side gets to present their case and to rebut the other side's case. If defense has to take time to educate the jury on the whole Rigol key system and how keygen programs are safe, that's time they don't have for other things. I've seen that kind of thing happen. I was a witness for a plaintiff in a suit. Early on, defense was able to find something totally minor but that looked bad if you didn't know the details of state tax and corporations bureaucracy [2]. It took them 2 minutes to use that to make us look dishonest. It took much longer the next day to explain all the details to counter that. For the rest of the trial, we were short on time and had to drop some things. Later, when I was on the stand defense asked some questions about a particular piece of software the plaintiffs developed. They asked detailed technical questions and I answered them. Then they said "play the video of tzs's deposition from <date several months earlier>". On that video I was asked the same questions I had just been asked in court, and answered that I had not worked on that software and didn't know the answers. Defense then said "no further questions" and walked away. I expected our lawyers to then ask about this, so we could explain why I apparently was either lying my ass off in the deposition or lying my ass off a few moments ago, but they didn't. They later told me they were short on time, and decided that having the jury think I was a liar was less of a problem than dropping the other stuff they would have to drop to deal with that. So why the apparent discrepancy between my deposition and my later in court testimony? The deposition was 100% correct. I had not worked and that software and didn't have any deep technical knowledge of how it worked. Later however, I was designated as the person on our side who would be answering all technical questions about our software. This would cover all our software that might come up in the case, not just what I had worked on. So I spent a considerable amount of time after that deposition studying the source for such software, and by the time of the trial I was able to answer deep technical questions concerning it. (Which defendant was fully aware of, by the way, since between my first deposition and the trial, there was a deposition where I appeared in the role of expert on all our software). [1] Besides doubling the bandwidth, there are keys for expanding the amount of memory, adding advanced trigger options, adding protocol decoding for various useful protocols like I2C and RS-232, and I think some other features that I'm forgetting. [2] Briefly, when you paid your taxes you got a receipt from the state revenue department. You were supposed to file a copy of that receipt with the state corporations office. Someone failed to do that. If one then queried the corporations office we were listed as having not paid our taxes.

quux 5y ago

I think Rigol gave in to the hackers? Last year I bought a DS1054Z from amazon and it came with all the options permanently enabled.

heavyset_go 5y ago

Your aside reminds me of the PSP hacking days. Whenever there was an update, you'd have to hold it and check forums to see if it patched your root exploit.

rlpb 5y ago

This is the first I've heard of it - but is this perhaps a straightforward avenue for conventional price discrimination? Businesses that want the 100 MHz may well just pay for it because they don't want the hassle the hack might lead to. And the people who'd use the hack probably wouldn't have paid for the more expensive one anyway. So Rigol might be extracting maximum value thanks to the hack, rather than despite it.

tzs 5y ago

The system for key validation to enable the various features on that scope [1] is actually, if I recall correctly, a well designed system using sound, strong cryptography except they used short enough keys that you can easily brute force it. That's what they keygen programs for it do. It is almost inconceivable that they would know enough to use good cryptography but not know that they needed long keys, so a lot of people believe they intended for it to be easy to hack. One theory I've heard that makes sense is that this is for price discrimination. Your hobbyist user, buying a scope to figure out what is going wrong when they try to talk to their humidity sensor with their Arduino, is not going to pay an extra couple hundred dollars to get the protocol decoding add-on. Paying $400 for the basic scope is already near their limit. So let them have all the features--it makes the Rigol scope more attractive to those users without really costing Rigol anything. So why not just include all the features without requiring keys to enable them? Because people using the scope for business will pay more for them. That's because if they use a keygen program to enable them and use the scope to design or test some product, and later something goes wrong with that product and someone gets hurt and they find themselves being sued, they don't want to have to deal with how a plaintiff's attorney would try to spin that in front of jury. Sure, it would probably not be hard for the defense to respond and explain that the scope behaves exactly the same regardless of whether the key was purchased from Rigol or came from a third party keygen program, so you might think no harm would be done by plaintiff bringing this up. However, civil trials have time limits on how much total time each side gets to present their case and to rebut the other side's case. If defense has to take time to educate the jury on the whole Rigol key system and how keygen programs are safe, that's time they don't have for other things. I've seen that kind of thing happen. I was a witness for a plaintiff in a suit. Early on, defense was able to find something totally minor but that looked bad if you didn't know the details of state tax and corporations bureaucracy [2]. It took them 2 minutes to use that to make us look dishonest. It took much longer the next day to explain all the details to counter that. For the rest of the trial, we were short on time and had to drop some things. Later, when I was on the stand defense asked some questions about a particular piece of software the plaintiffs developed. They asked detailed technical questions and I answered them. Then they said "play the video of tzs's deposition from <date several months earlier>". On that video I was asked the same questions I had just been asked in court, and answered that I had not worked on that software and didn't know the answers. Defense then said "no further questions" and walked away. I expected our lawyers to then ask about this, so we could explain why I apparently was either lying my ass off in the deposition or lying my ass off a few moments ago, but they didn't. They later told me they were short on time, and decided that having the jury think I was a liar was less of a problem than dropping the other stuff they would have to drop to deal with that. So why the apparent discrepancy between my deposition and my later in court testimony? The deposition was 100% correct. I had not worked and that software and didn't have any deep technical knowledge of how it worked. Later however, I was designated as the person on our side who would be answering all technical questions about our software. This would cover all our software that might come up in the case, not just what I had worked on. So I spent a considerable amount of time after that deposition studying the source for such software, and by the time of the trial I was able to answer deep technical questions concerning it. (Which defendant was fully aware of, by the way, since between my first deposition and the trial, there was a deposition where I appeared in the role of expert on all our software). [1] Besides doubling the bandwidth, there are keys for expanding the amount of memory, adding advanced trigger options, adding protocol decoding for various useful protocols like I2C and RS-232, and I think some other features that I'm forgetting. [2] Briefly, when you paid your taxes you got a receipt from the state revenue department. You were supposed to file a copy of that receipt with the state corporations office. Someone failed to do that. If one then queried the corporations office we were listed as having not paid our taxes.