4 ms·

Parts pairing is still a thing. I would love to see right-to-repair advocates and infosec advocates in a ring, fighting it out. Why is it that consumers get s

Parts pairing is still a thing. I would love to see right-to-repair advocates and infosec advocates in a ring, fighting it out. Why is it that consumers get salty because they can’t read what they’re actually buying?

freedomben 3y ago
As a rare simultaneous right-to-repair and infosec advocate, it kills me that people think these must be opposite in nature. This is only true when you consider the user to be a threat vector. Big tech certainly does though, and there's a huge financial incentive to treat the user that way. Apple has also proven that the user-mistrust model works great for the company, and people will buy the products anyway. It's a sad state
- warkdarrior 3y ago
  As an infosec person, I'd love to sell replacement screens that also exfiltrate your data.
  - sennight 3y ago
    I would also love for you to bring to market a price competitive replacement screen that is somehow backdoored. I don't know why you think that would be profitable at all, but I welcome the price pressure.
    - mvid 3y ago
      If you are backdooring the hardware, then the idea would be that the data would be worth it to you. Seems like it would make it easier to compete on price, since the value dynamic is skewed
      - sennight 3y ago
        You think it would be profitable to source a spec similar screen, market it, backdoor it, exfiltrate in a detection evasive manner what started out as a 3.5MB wide data stream... and build out the infrastructure to receive hundreds of thousands of backchannel connections? Really?
- joshspankit 3y ago
  I agree and will add that in my experience the companies that do put right-to-repair opposite infosec are almost always relying on security through obscurity which as we know is not security at all.
ang_cire 3y ago
Infosec advocates are super pro-R2R. You're confusing corporate lawyers who (falsely) claim their controls are necessary for security with being people with any actual knowledge of infosec.

freedomben 3y ago

As a rare simultaneous right-to-repair and infosec advocate, it kills me that people think these must be opposite in nature. This is only true when you consider the user to be a threat vector. Big tech certainly does though, and there's a huge financial incentive to treat the user that way. Apple has also proven that the user-mistrust model works great for the company, and people will buy the products anyway. It's a sad state

warkdarrior 3y ago
As an infosec person, I'd love to sell replacement screens that also exfiltrate your data.
- sennight 3y ago
  I would also love for you to bring to market a price competitive replacement screen that is somehow backdoored. I don't know why you think that would be profitable at all, but I welcome the price pressure.
  - mvid 3y ago
    If you are backdooring the hardware, then the idea would be that the data would be worth it to you. Seems like it would make it easier to compete on price, since the value dynamic is skewed
    - sennight 3y ago
      You think it would be profitable to source a spec similar screen, market it, backdoor it, exfiltrate in a detection evasive manner what started out as a 3.5MB wide data stream... and build out the infrastructure to receive hundreds of thousands of backchannel connections? Really?
joshspankit 3y ago
I agree and will add that in my experience the companies that do put right-to-repair opposite infosec are almost always relying on security through obscurity which as we know is not security at all.

ang_cire 3y ago

Infosec advocates are super pro-R2R. You're confusing corporate lawyers who (falsely) claim their controls are necessary for security with being people with any actual knowledge of infosec.