jtchang

Why are there any management interfaces exposed to the Internet at all?

This is a fantastic write up on the security incident. Almost any incident like this will have unknowns. It's good to make it explicit. I especially liked the part of what would have been leaked if the attacker was successful. Maybe they could include what type of hash was used.

This is going to pop a lot of wordpress sites.

Can you link to that comment ? That's pretty wild.

So tossing out an idea:

What if all manufacturers had to classify their product into internet connected i.e. smart or not. We mandate that manufacturer has to support updates for minimum 5 years or firmware source goes public. Have them put firmware source in escrow as well as have a way to update it.

If a manufacturer wants to reduce their liability then they have to release something to make it semi publicly supportable. With AI agents these days patching the firmware might one day be trivial.

Put some penalities with teeth behind this and maybe manufacturers will think twice before making everything smart.

Southwest airlines had a culture of turning around fast at the gate. So maybe no explicit policy but culture can drive unintended consequences and decisions.

Article mentions the passwords were hashed with sha256 plus a salt. For a long password more than say 12 characters this would take a very long time to brute force. My guess is a lot of these were dictionary attacks ?

Confused as to the actual root cause. Don't all hard drives provide SMART diagnostics these days? Was it really bad sectors?

Fantastic write up. It's mind blowing how much complexity there is to keep flights going day in and day out.

My guess is all airline NOCs operate 24/7 as flights happen around the clock. Also planes typically don't have much downtime as that loses money so everything has to be a continuous operation.

Cool looking at the pictures of the dashboards. It's nutty to think how much has to be tracked when doing airplane maintenance.

Correct me if I am wrong but I thought the primary appeal of LoRa was range? Also isn't the primary factor in making long range radio go through things is the frequency? So 2.4ghz is the same frequency as consumer wifi right and thus would propagate about the same right?

It doesn't seem like this would be that useful except that the protocol is LoRa so you can have higher bandwidth between two devices if they happen to be close enough together.

How does the app read the variable if it can't be read after you input it? Or do they mean you can't view it after providing the variable value to the UI?

I remember reading slashdot but what is their system? Is there a separate set of mods that moderate the moderators?

How is this mode not a standard part of their disaster recovery plan? Especially in sf and the bay area they need to assume an earthquake is going to take out a lot of infrastructure. Did they not take into account this would happen?

Fundamentally is there anything you can't write in rust and must write in C? With AI languages should mostly be transposable even though right now they are not.