3 ms·

It's worrying to see multiple folks talking about how they've seen hardware exploitation yet aren't allowed to talk about it. It'd suggest insecurity is somethi

by jart 4y ago

It's worrying to see multiple folks talking about how they've seen hardware exploitation yet aren't allowed to talk about it. It'd suggest insecurity is something they're not allowed to address and forced to accept, which is worse than being hacked. What makes hardware weaknesses so troubling is due to how close software lets untrusted code get to the metal, with things like jit gpus and wasm. Mix that with ad exchanges that let anyone bid to run code on your computer, and I wonder why the world hasn't imploded yet.

hilbert42 4y ago
It's worrying to see multiple folks talking about how they've seen hardware exploitation yet aren't allowed to talk about it. You're correct, it is worrying but sometimes it's inevitable. Moreover it's worse when governments get involved. In my case I've signed documents that strictly limit me from being explicit.
adrian_b 4y ago
In the first few decades of the electronics industry, every device was provided with huge amounts of information in its datasheets and databooks. That allowed an electronics engineer to make detailed comparisons between many alternatives before buying any samples and it also allowed the creation of many designs where the components where used for purposes that were very different from anything imagined by their vendors. Already after 1990, but especially after 2000, the amount of technical documentation about hardware components that is available freely has dropped dramatically and now for most of the more complex hardware components it is possible to obtain enough information to make a design only after signing non-disclosure agreements. This fashion of the NDA's has made it very difficult to create really innovative products or new competitors in an existing market. For a company already established in a market, which only does new versions of old products, obtaining the documentation under NDA is trivial. On the other hand, for designing an innovative product, obtaining the documentation is very hard. One reason is that there is a vicious circle, until you have all the documentation, you cannot know which is the component that is suitable for your design, so you cannot commit to buy it, but many companies will not provide the documentation before you can convince them that you are committed to buy quantities large enough of that component. Even the documentation obtained under NDA is usually much less complete than what could be obtained freely a few decades ago, so not only it is impossible to determine whether the component could be used for any other purpose than that specified by the vendor, but usually the documentation is not complete enough to determine with certainty that even the intended purpose can be accomplished. Because of that, in most hardware projects a series of tests on prototype boards are absolutely necessary to fill the gaps in the technical documentation provided by the vendor. So very frequently many designers have to duplicate the work of others in discovering workarounds for the bugs or lower performance than expected of various components, because even if they would want to share their experiences, they are prevented by the NDA's that they have signed. Unfortunately, being not allowed to talk about various technical facts, without any good reason to forbid this, has become a pervasive policy.
autoexec 4y ago
wasm was always going to be a security nightmare. I can't imagine how that was seen as a good idea. At this point I don't let JS run by default at all, but most people won't bother doing that and they're just going to be screwed.

by jart 4y ago

hilbert42 4y ago

It's worrying to see multiple folks talking about how they've seen hardware exploitation yet aren't allowed to talk about it. You're correct, it is worrying but sometimes it's inevitable. Moreover it's worse when governments get involved. In my case I've signed documents that strictly limit me from being explicit.

adrian_b 4y ago

In the first few decades of the electronics industry, every device was provided with huge amounts of information in its datasheets and databooks. That allowed an electronics engineer to make detailed comparisons between many alternatives before buying any samples and it also allowed the creation of many designs where the components where used for purposes that were very different from anything imagined by their vendors. Already after 1990, but especially after 2000, the amount of technical documentation about hardware components that is available freely has dropped dramatically and now for most of the more complex hardware components it is possible to obtain enough information to make a design only after signing non-disclosure agreements. This fashion of the NDA's has made it very difficult to create really innovative products or new competitors in an existing market. For a company already established in a market, which only does new versions of old products, obtaining the documentation under NDA is trivial. On the other hand, for designing an innovative product, obtaining the documentation is very hard. One reason is that there is a vicious circle, until you have all the documentation, you cannot know which is the component that is suitable for your design, so you cannot commit to buy it, but many companies will not provide the documentation before you can convince them that you are committed to buy quantities large enough of that component. Even the documentation obtained under NDA is usually much less complete than what could be obtained freely a few decades ago, so not only it is impossible to determine whether the component could be used for any other purpose than that specified by the vendor, but usually the documentation is not complete enough to determine with certainty that even the intended purpose can be accomplished. Because of that, in most hardware projects a series of tests on prototype boards are absolutely necessary to fill the gaps in the technical documentation provided by the vendor. So very frequently many designers have to duplicate the work of others in discovering workarounds for the bugs or lower performance than expected of various components, because even if they would want to share their experiences, they are prevented by the NDA's that they have signed. Unfortunately, being not allowed to talk about various technical facts, without any good reason to forbid this, has become a pervasive policy.

autoexec 4y ago

wasm was always going to be a security nightmare. I can't imagine how that was seen as a good idea. At this point I don't let JS run by default at all, but most people won't bother doing that and they're just going to be screwed.