4 ms·

Author: Why must a physical SD card be mailed? Is it infeasible to provide a download link and instructions on how to use Rufus / dd / tool-of-choice to create

Author: Why must a physical SD card be mailed? Is it infeasible to provide a download link and instructions on how to use Rufus / dd / tool-of-choice to create the appropriately formatted card? Mailing SD cards in their final form in a regular envelope is not secure. An adversary can intercept and reformat, and folks will be none the wiser unless you provide some kind of tedious 3rd party integrity-check tool. I realize this is probably unlikely, but still, like.. why? Flashing from a reliable source is the gold standard.

Jerrrrrrry 2y ago
https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad
- tjohns 2y ago
  And just how are you delivering the key material for your one-time pad?
  - shermantanktop 2y ago
    It's OTPs all the way down.
  - Jerrrrrrry 2y ago
    Doesn't matter. Literally, could be entangled quantum photo-carrier pigeons. x ⊕ y = z z ⊕ x = y y ⊕ z = x Assuming another Out-of-Bound communication channel, all communication channels are provably safe. https://en.wikipedia.org/wiki/One-time_pad#Perfect_secrecy https://en.wikipedia.org/wiki/One-time_pad#Perfect_secrecy
    - echoangle 2y ago
      If you have the Out-of-Band communication channel to transmit your OTP (which has to have the same size as the data itself), you can just transmit the data using this method and skip the other channel.
      - teddyh 2y ago
        True, but you might have a secure OOB channel for a limited time. In that case, you can transfer an arbitrarily large OTP over the secure channel, to be used later, in small pieces, when you do not have a secure channel available.
- dredmorbius 2y ago
  Signed checksums are generally sufficient to validate integrity. You could GPG encrypt / sign the entire payload as well if desired, though that requires recipients to have their own keys. Some 33 years after the introduction of PGP, this remains a significant stumbling block.
  - Jerrrrrrry 2y ago
    signed keys You just described using Out-of-Band communication, without using the words Some 33 years after the introduction of PGP, this remains a significant stumbling block. 'This problem was given the name the Two Generals Paradox by Jim Gray[8] in 1978 in "Notes on Data Base Operating Systems" starting on page 465.' https://en.wikipedia.org/wiki/Two_Generals%27_Problem https://en.wikipedia.org/wiki/Two_Generals%27_Problem
    - dredmorbius 2y ago
      Payload sizes of an OS distribution and a GPG signature / checksum differ by six or more orders of magnitude. The validation checks themselves can be readily publicly distributed. Though of course if desired, they can also be distributed with media, or in a separate postal mailing. PKI leverages OOB comms such that a single OOB exchange can validate an entire further chain of messages.
      - Jerrrrrrry 2y ago
        Payload sizes irrelevant validation checks themselves can be readily publicly distributed how do you know which one? with the a priori key exchange / Out-of-Band communication? distributed with media backdoor/spoofable/resignable >separate postal mailing finally, full circle. PKI leverages OOB comms such that a single OOB exchange can validate an entire further chain of messages. yes, hashing hashes and bloom filters arent novel. ultimately, the only solution we have so far is: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange#Public_key https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...
deleted 2y ago
[deleted]
zkirill 2y ago
It's tricky because the kind of buyer I have in mind would feel uncomfortable with that operation despite having the best instructions. It would lead them to pass on this product at this stage thereby ruining my market validation. I want to make the experience as seamless as possible given the constraints, and popping the SD card in the slot is the best I came up with so far. Having said that, the comment by tjohns below made me rethink some things. I may end up providing both the download link, and also mail the SD card. > Mailing SD cards in their final form in a regular envelope is not secure. An adversary could intercept and reformat, and it'd be tough to tell. I realize this is unlikely, but still, I'm like.. why? I agree. It's a poor medium for many different reasons. However, if I can sell these, then I can sunset them and start working on the actual electronic device, which will house the OS and software on eMMC or SSD.
- jmholla 2y ago
  I'd recommend including instructions in the email on how they can verify the SD card is loaded with the correct data. (e.g., `dd | sha256sum == curl | sha256sum`). This, I think would give you the best of both worlds. (Those are shell pipes (`|`) in my example.)
- petsfed 2y ago
  I think your starting assumption (that your target audience will be turned off by having to download an image and format an SD card but will not be turned off by plugging said SD card into an unenclosed dev board) is faulty, but I suppose your market validation test will suss that out.
kayodelycaon 2y ago
They explained it in the previous post they linked: https://flyingcarcomputer.com/posts/how-to-validate-market-with-development-board/ https://flyingcarcomputer.com/posts/how-to-validate-market-w... Long story, short: customers can just stick in the device, without having to figure out how to image an SD card.
michaelt 2y ago
The author is working on "a new type of personal computer. No AI. No cloud. No distractions. Just your thoughts." I suspect what the author initially hoped to make was a physical offline consumer device, like a classic TomTom or a ReMarkable. But then they seem to have noticed that's not a one-person job, so they've reduced their scope to selling an SD card that plugs into an off-the-shelf Olimex dev board. Mailing the SD card is them keeping their dream of being a physical hardware business alive.
GrantMoyer 2y ago
SD cards can be set permanently read only[1]. A malicious party could still swap it with a different SD card though, but that's true of any media. [1]: https://hackaday.com/2013/11/12/keep-your-sd-cards-data-safe-with-the-sd-locker/ https://hackaday.com/2013/11/12/keep-your-sd-cards-data-safe...

Jerrrrrrry 2y ago

https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad

tjohns 2y ago
And just how are you delivering the key material for your one-time pad?
- shermantanktop 2y ago
  It's OTPs all the way down.
- Jerrrrrrry 2y ago
  Doesn't matter. Literally, could be entangled quantum photo-carrier pigeons. x ⊕ y = z z ⊕ x = y y ⊕ z = x Assuming another Out-of-Bound communication channel, all communication channels are provably safe. https://en.wikipedia.org/wiki/One-time_pad#Perfect_secrecy https://en.wikipedia.org/wiki/One-time_pad#Perfect_secrecy
  - echoangle 2y ago
    If you have the Out-of-Band communication channel to transmit your OTP (which has to have the same size as the data itself), you can just transmit the data using this method and skip the other channel.
    - teddyh 2y ago
      True, but you might have a secure OOB channel for a limited time. In that case, you can transfer an arbitrarily large OTP over the secure channel, to be used later, in small pieces, when you do not have a secure channel available.
dredmorbius 2y ago
Signed checksums are generally sufficient to validate integrity. You could GPG encrypt / sign the entire payload as well if desired, though that requires recipients to have their own keys. Some 33 years after the introduction of PGP, this remains a significant stumbling block.
- Jerrrrrrry 2y ago
  signed keys You just described using Out-of-Band communication, without using the words Some 33 years after the introduction of PGP, this remains a significant stumbling block. 'This problem was given the name the Two Generals Paradox by Jim Gray[8] in 1978 in "Notes on Data Base Operating Systems" starting on page 465.' https://en.wikipedia.org/wiki/Two_Generals%27_Problem https://en.wikipedia.org/wiki/Two_Generals%27_Problem
  - dredmorbius 2y ago
    Payload sizes of an OS distribution and a GPG signature / checksum differ by six or more orders of magnitude. The validation checks themselves can be readily publicly distributed. Though of course if desired, they can also be distributed with media, or in a separate postal mailing. PKI leverages OOB comms such that a single OOB exchange can validate an entire further chain of messages.
    - Jerrrrrrry 2y ago
      Payload sizes irrelevant validation checks themselves can be readily publicly distributed how do you know which one? with the a priori key exchange / Out-of-Band communication? distributed with media backdoor/spoofable/resignable >separate postal mailing finally, full circle. PKI leverages OOB comms such that a single OOB exchange can validate an entire further chain of messages. yes, hashing hashes and bloom filters arent novel. ultimately, the only solution we have so far is: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange#Public_key https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...

deleted 2y ago

[deleted]

zkirill 2y ago

It's tricky because the kind of buyer I have in mind would feel uncomfortable with that operation despite having the best instructions. It would lead them to pass on this product at this stage thereby ruining my market validation. I want to make the experience as seamless as possible given the constraints, and popping the SD card in the slot is the best I came up with so far. Having said that, the comment by tjohns below made me rethink some things. I may end up providing both the download link, and also mail the SD card. > Mailing SD cards in their final form in a regular envelope is not secure. An adversary could intercept and reformat, and it'd be tough to tell. I realize this is unlikely, but still, I'm like.. why? I agree. It's a poor medium for many different reasons. However, if I can sell these, then I can sunset them and start working on the actual electronic device, which will house the OS and software on eMMC or SSD.

jmholla 2y ago
I'd recommend including instructions in the email on how they can verify the SD card is loaded with the correct data. (e.g., `dd | sha256sum == curl | sha256sum`). This, I think would give you the best of both worlds. (Those are shell pipes (`|`) in my example.)
petsfed 2y ago
I think your starting assumption (that your target audience will be turned off by having to download an image and format an SD card but will not be turned off by plugging said SD card into an unenclosed dev board) is faulty, but I suppose your market validation test will suss that out.

kayodelycaon 2y ago

They explained it in the previous post they linked: https://flyingcarcomputer.com/posts/how-to-validate-market-with-development-board/ https://flyingcarcomputer.com/posts/how-to-validate-market-w... Long story, short: customers can just stick in the device, without having to figure out how to image an SD card.

michaelt 2y ago

The author is working on "a new type of personal computer. No AI. No cloud. No distractions. Just your thoughts." I suspect what the author initially hoped to make was a physical offline consumer device, like a classic TomTom or a ReMarkable. But then they seem to have noticed that's not a one-person job, so they've reduced their scope to selling an SD card that plugs into an off-the-shelf Olimex dev board. Mailing the SD card is them keeping their dream of being a physical hardware business alive.

GrantMoyer 2y ago

SD cards can be set permanently read only[1]. A malicious party could still swap it with a different SD card though, but that's true of any media. [1]: https://hackaday.com/2013/11/12/keep-your-sd-cards-data-safe-with-the-sd-locker/ https://hackaday.com/2013/11/12/keep-your-sd-cards-data-safe...