middleca

This feels like a very bizarre propaganda / pro-military opinion piece. Google isn't a defense contractor, its employees aren't any more or less patriotic if they don't want to build software that goes in killbots.

Google and all the other mega-tech corps do a similar tech phone screen where they're reading off an answer sheet. (powers of 2, sort these functions, linux kernel calls, etc).

Sounds like you dodged a bullet, this sort of thing speaks volumes to how the company is run internally and how you'd be treated there.

Came here to say +1 to this, definitely employ a bastion host and make sure that's the only way to SSH to your servers. This can be a little tricky to do correctly if you don't have someone on your team, but it's a valuable way to reduce your surface area to monitor.

Installing fail2ban is also a very basic / smart way to discourage brute force SSH attacks on your boxes. Also you could try piping your SSH logs into something like papertrail / slack, so you have clear visibility into who's logging into your servers, etc.

cool project, thanks for sharing!

It'd be interesting to see a wind speed sensor, temp sensor, or light sensor or something on the AC unit so you could know when it's on!

Schneier's estimate assumes rented hardware time, but purchased hardware and multiple attempts would drive down the cost dramatically over time. This estimate also doesn't include optimizations by leveraging previous cycles or spends, or the impact of storing something like a rainbow table.

Given a government budget and time-scale, and ignoring sunk costs, I would think a collision attack could already be in a negligible cost range for any well funded sophisticated attacker that has setup shop.

edit: also that opinion post is 2 years old

You can actually do this with a usb cable, or flash your own firmware over the air, you'd only need a jtag programmer if you wanted to replace the open-source bootloader :)

Cool hack! How are you driving the furby?

+1 for CoAP - We use it!

oh hey! :)