5 ms·

Is there some kind of vote bot ring or something? This is a question with one short answer (at the time of my comment). It's hard to imagine why it made the to

by qup 3y ago

Is there some kind of vote bot ring or something? This is a question with one short answer (at the time of my comment). It's hard to imagine why it made the top on its own merits.

superchroma 3y ago
Most likely, moderation is on pause at Stack Exchange due to ongoing feuds with management.
generalizations 3y ago
I agree, and it's not even a good answer.
freecodyx 3y ago
But it’s a good question. I want to know. I am assuming this is not possible. The only thing i know of is capable of doing so is pegasus. But it’s very expensive afak.
- anonym29 3y ago
  You don't know what code is running on your baseband processor, do you? Do you know what other hardware your baseband processor has the ability to inspect?
  - zozbot234 3y ago
    In most SoC's the answer is 'everything' because there's no such thing as an IOMMU.
    - anonym29 3y ago
      Ding ding ding, we have a winner!
    - paulryanrogers 3y ago
      How big a concern is this if the data is encrypted by the kernel or user space?
      - Veserv 3y ago
        Encryption does not help in this case. They have complete remote control over the entire CPU so they can just run the decryption code directly. Encryption only helps if the endpoints that can get access to the plaintext are not compromised.
      - ignoramous 3y ago
        There are atleast 2 more exception levels with higher privileges than the Kernel on arm64.
    - moyix 3y ago
      I was under the impression that most modern (past few years) SoCs like Exynos, Qualcomm, Apple silicon all had IOMMU support. Sometimes it’s misconfigured to be too permissive but that’s getting better. Qualcomm SMMU: https://www.qualcomm.com/content/dam/qcomm-martech/dm-assets/documents/whitepaper_0.pdf https://www.qualcomm.com/content/dam/qcomm-martech/dm-assets... Apple: https://support.apple.com/lt-lt/guide/security/seca4960c2b5/web https://support.apple.com/lt-lt/guide/security/seca4960c2b5/... Samsung (vuln indicating it wasn’t configured correctly, but they still do have and use an IOMMU): https://nvd.nist.gov/vuln/detail/CVE-2022-39854 https://nvd.nist.gov/vuln/detail/CVE-2022-39854
    - numpad0 3y ago
      Why's IOMMU thrown around so casually in this forum as if it's a silver-bullet explosive reactive armors? They'd be running something like 30 years old giant main loop with "// don't remove this line, build breaks" comments everywhere, not like Rust microservices on formally verified microkernel. The main CPU/application processor/main CPU might be running better secured Unix/Linux and might be able to protect itself from peripheral CPUs, but that's not the point; a phone had always been a pair (minimum) of computers, traditionally referred to as Application Processor(AP) and Baseband Processor(BP), of only the slightly faster one is exposed to the user, and it's unclear what is going on inside the other one or how to handle it. That's the problem.
  - freecodyx 3y ago
    Ok but we are talking remotely enabling camera and microphone. The baseband is only responsible of intercepting traffic. This needs kernel injection.
- Veserv 3y ago
  It costs about 2-5M$ to buy or develop a new weaponized zero-click vulnerability that would allow you to simultaneously hack all 1,000,000,000 iPhones in use. So around 1/20 of a cent per iPhone.
  - abwizz 3y ago
    even for the single use case, 5M$ is not that far fetched in terms of opportunity cost.
joebiden2 3y ago
No, it's not a bot ring. I assume you think that because I posted links to stackexchange quite a few times the last few months. Instead, I just skim over stackexchange.com as part of my feed and when there's something what I assume HN interests, I post it here. I don't care much about Karma. I posted this specific topic since I find it kind of hilarious that police should now lawfully be able to do something they are almost surely not able to do. And I enjoy discussions to such topics here on HN, because most of the time the viewpoints mentioned here are at least of the same quality of the answers on stackexchange.
- qup 3y ago
  It seemed ridiculous to me that it could make the top of HN. It was a question with no discussion, yet. If it had a discussion or even a good answer, it would have made perfect sense. I assumed the goal would be stack overflow karma, as that's actually valuable.
  - throwawayadvsec 3y ago
    Or maybe it's the perfect place to discuss this kind of topics. An Ask HN with the same kind of question could have reached the front page.
  - godelski 3y ago
    It rose to the top because of the question, the link about France, and because new posts get higher weights. It is at 79pts and 59 comments currently and about to fall off the front page. But also on the front page is a post with 6pts and 1 comment (1hr old), 17 points and 2 comments (2 hrs), 7pts and 2 comments (30 minutes). and a few more. Just a slow Saturday.

by qup 3y ago

Is there some kind of vote bot ring or something? This is a question with one short answer (at the time of my comment). It's hard to imagine why it made the top on its own merits.

superchroma 3y ago

Most likely, moderation is on pause at Stack Exchange due to ongoing feuds with management.

generalizations 3y ago

I agree, and it's not even a good answer.

freecodyx 3y ago

But it’s a good question. I want to know. I am assuming this is not possible. The only thing i know of is capable of doing so is pegasus. But it’s very expensive afak.

anonym29 3y ago
You don't know what code is running on your baseband processor, do you? Do you know what other hardware your baseband processor has the ability to inspect?
- zozbot234 3y ago
  In most SoC's the answer is 'everything' because there's no such thing as an IOMMU.
  - anonym29 3y ago
    Ding ding ding, we have a winner!
  - paulryanrogers 3y ago
    How big a concern is this if the data is encrypted by the kernel or user space?
    - Veserv 3y ago
      Encryption does not help in this case. They have complete remote control over the entire CPU so they can just run the decryption code directly. Encryption only helps if the endpoints that can get access to the plaintext are not compromised.
    - ignoramous 3y ago
      There are atleast 2 more exception levels with higher privileges than the Kernel on arm64.
  - moyix 3y ago
    I was under the impression that most modern (past few years) SoCs like Exynos, Qualcomm, Apple silicon all had IOMMU support. Sometimes it’s misconfigured to be too permissive but that’s getting better. Qualcomm SMMU: https://www.qualcomm.com/content/dam/qcomm-martech/dm-assets/documents/whitepaper_0.pdf https://www.qualcomm.com/content/dam/qcomm-martech/dm-assets... Apple: https://support.apple.com/lt-lt/guide/security/seca4960c2b5/web https://support.apple.com/lt-lt/guide/security/seca4960c2b5/... Samsung (vuln indicating it wasn’t configured correctly, but they still do have and use an IOMMU): https://nvd.nist.gov/vuln/detail/CVE-2022-39854 https://nvd.nist.gov/vuln/detail/CVE-2022-39854
  - numpad0 3y ago
    Why's IOMMU thrown around so casually in this forum as if it's a silver-bullet explosive reactive armors? They'd be running something like 30 years old giant main loop with "// don't remove this line, build breaks" comments everywhere, not like Rust microservices on formally verified microkernel. The main CPU/application processor/main CPU might be running better secured Unix/Linux and might be able to protect itself from peripheral CPUs, but that's not the point; a phone had always been a pair (minimum) of computers, traditionally referred to as Application Processor(AP) and Baseband Processor(BP), of only the slightly faster one is exposed to the user, and it's unclear what is going on inside the other one or how to handle it. That's the problem.
- freecodyx 3y ago
  Ok but we are talking remotely enabling camera and microphone. The baseband is only responsible of intercepting traffic. This needs kernel injection.
Veserv 3y ago
It costs about 2-5M$ to buy or develop a new weaponized zero-click vulnerability that would allow you to simultaneously hack all 1,000,000,000 iPhones in use. So around 1/20 of a cent per iPhone.
- abwizz 3y ago
  even for the single use case, 5M$ is not that far fetched in terms of opportunity cost.

joebiden2 3y ago

No, it's not a bot ring. I assume you think that because I posted links to stackexchange quite a few times the last few months. Instead, I just skim over stackexchange.com as part of my feed and when there's something what I assume HN interests, I post it here. I don't care much about Karma. I posted this specific topic since I find it kind of hilarious that police should now lawfully be able to do something they are almost surely not able to do. And I enjoy discussions to such topics here on HN, because most of the time the viewpoints mentioned here are at least of the same quality of the answers on stackexchange.

qup 3y ago
It seemed ridiculous to me that it could make the top of HN. It was a question with no discussion, yet. If it had a discussion or even a good answer, it would have made perfect sense. I assumed the goal would be stack overflow karma, as that's actually valuable.
- throwawayadvsec 3y ago
  Or maybe it's the perfect place to discuss this kind of topics. An Ask HN with the same kind of question could have reached the front page.
- godelski 3y ago
  It rose to the top because of the question, the link about France, and because new posts get higher weights. It is at 79pts and 59 comments currently and about to fall off the front page. But also on the front page is a post with 6pts and 1 comment (1hr old), 17 points and 2 comments (2 hrs), 7pts and 2 comments (30 minutes). and a few more. Just a slow Saturday.