killbot5000
Joined 16 years ago
Joined 16 years ago
It takes time and effort to think through proper secure boot architecture and to implement key management in a way that doesn’t kill developer productivity.
Their product managers, though, should have realized that setting these up in unsecured public spaces means that their threat model really does include local physical access to everything.
Using off the shelf hardware and software stacks all but guarantees attackers have tools at their fingertips to exploit said physical access.
Given all the recent exploits hitting the kernel, there’s a good chance that there exists an exploitable over-the-air vulnerability present in their WiFi/bluetooth stack, too.
So who is this shit working on? These companies must have detailed profiles on “people who do what we tell them” as a whole class of people. Scary.
1) alternatives may be more expensive by dollars
2) alternatives may be more expensive by time
3) time/money lost to altered consumption has proportional opportunity cost
Market consolidation reduces the cost of using “bad” services and increases the cost of using “good” services over time.
In the parallel HTTP fetcher, the error is discarded. This will likely result in a panic when the response is nil. Also, what if it a server locks up? Or the underlying socket never connects and never times out?
I know it’s a toy example, but one must consider all these things in a real system. Go does have good pathways for these concerns, but it’s also easy to do it wrong. I still have to manually reason about access to variables/struct fields from multiple go routines.