7 ms·

Seems you're more focused on the "my consumer device does new stuff I don't like" issue whereas I'm more focused on the "my nation's telecommunications backbone

by evilos 4y ago

Seems you're more focused on the "my consumer device does new stuff I don't like" issue whereas I'm more focused on the "my nation's telecommunications backbone has a malicious FPGA hidden somewhere so it can man-in-the-middle critical communications" aspect.

fxtentacle 4y ago
I'm pretty sure if you offer a high enough bounty, some of the people working to deploy your infrastructure will go searching for those FPGAs. Also, I expect enthusiast users and large companies to purchase similar devices as small telcos. Scorned network administrators are probably even better bounty hunters. But yes, I was focusing mostly on the end-user aspect because if you want to create such a law, you need your citizens to like the idea.
- evilos 4y ago
  IMO proposing we "disallow remote updates" because we don't know what backdoors could be sneaked into devices is akin to proposing we outlaw fudging spreadsheets because we don't trust accountants. It's not really practical or enforceable. If a world power wants to hide something nasty in silicon or software, a bug bounty program isn't going to cut it. Maybe if the government had a genius-savant who could stare at silicon dies and find malicious circuits.
ryanmercer 4y ago
>"my nation's telecommunications backbone has a malicious FPGA hidden somewhere so it can man-in-the-middle critical communications" Not just that, for about a decade now I've had a thought that you could just have a chip "self-destruct" when a signal goes out and bam a chip re-writes itself to be bricked. If you bake this into some common chip (or just include it in a firmware update), or something used in say backbone level network hardware, or something in millions of cellphones you could send out the instruction in some previously routine traffic to and from the mothership and then a clock starts counting down. You build in long enough of a delay to ensure you get most devices to receive the signal, say a week or even a month, and you suddenly cripple millions of devices and create mild to moderate chaos which gives gives you a leg up for an invasion or has a massive impact on the markets, or cripples internet access for a large area for weeks or months until hardware can be replaced.

by evilos 4y ago

fxtentacle 4y ago

I'm pretty sure if you offer a high enough bounty, some of the people working to deploy your infrastructure will go searching for those FPGAs. Also, I expect enthusiast users and large companies to purchase similar devices as small telcos. Scorned network administrators are probably even better bounty hunters. But yes, I was focusing mostly on the end-user aspect because if you want to create such a law, you need your citizens to like the idea.

evilos 4y ago
IMO proposing we "disallow remote updates" because we don't know what backdoors could be sneaked into devices is akin to proposing we outlaw fudging spreadsheets because we don't trust accountants. It's not really practical or enforceable. If a world power wants to hide something nasty in silicon or software, a bug bounty program isn't going to cut it. Maybe if the government had a genius-savant who could stare at silicon dies and find malicious circuits.

ryanmercer 4y ago

>"my nation's telecommunications backbone has a malicious FPGA hidden somewhere so it can man-in-the-middle critical communications" Not just that, for about a decade now I've had a thought that you could just have a chip "self-destruct" when a signal goes out and bam a chip re-writes itself to be bricked. If you bake this into some common chip (or just include it in a firmware update), or something used in say backbone level network hardware, or something in millions of cellphones you could send out the instruction in some previously routine traffic to and from the mothership and then a clock starts counting down. You build in long enough of a delay to ensure you get most devices to receive the signal, say a week or even a month, and you suddenly cripple millions of devices and create mild to moderate chaos which gives gives you a leg up for an invasion or has a massive impact on the markets, or cripples internet access for a large area for weeks or months until hardware can be replaced.