• 213 Posts
  • 1.4K Comments
Joined 4 年前
cake
Cake day: 2023年3月2日

help-circle










  • Bluetooth range is too short. AM/FM frequencies are regulated so that individual cannot legally broadcast. So these probably aren’t used to send data to manufacturers.

    They’re probably relying on existing channels that are IP capable, have good coverage, have relatively cheap antenna/MoDem available on the market. Such as 3/4/5G, Wi-Fi, LoRa.

    Disabling those likely mean loosing features, ie emergency calls, anti-theft localization… But it may be the easiest way and can be an acceptable compromise for some. Flashing devices to keep using the hardware and features with more trustworthy software is potentially better. I fear regulators/vendors would put roadbloacks. All onboard systems may require some kind of certification to be street legal. If software certification is necessary, then hobbyist couldn’t possible pay for that, which means in practice hacking you own device may not be legal. If there’s an accident, except insurances to use any unauthorized car modification to put the blame on you and deny coverage.



  • The Dutch warning does not identify China or Chinese manufacturers as the source of the threat. It addresses the vulnerabilities of connected vehicles in general.

    That makes sense. Adversairies, whoever they are, can exploit vulnerabilities in car regarless of the factory’s location.

    Fixing individuals vulnerabilities is not enough. Manufacturers need to rethink and reduce the amount of connectivity to reduce risks. An always-connected onboard system with mic, camera, and complex software almost certainly has flaws that can be abused.



  • Any insight into the most severe ones, eg is remote exploitation possible and likely?

    The Linux project request CVEs for any memory safety bug just in case some turn out to be vulnerabilities, in which case they may be exploited given enough effort. Many are likely not exploitable or unlikely to be, and/or low severity.

    There are some higher severity ones given the following message. But this doesn’t mean all CVEs listed are severe issues.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.








  • Hirom@beehaw.orgtoMemes@sopuli.xyz•Bang!
    link
    fedilink
    arrow-up
    7
    arrow-down
    1
    ·
    10 天前

    In such hypothetical situation, it may be a bit more ethical to do like in the Alias series finale. Don’t kill the vilain, let him to starve in a remote place. If he happens to be immortal for some reason, ensure he’s burried deep.



  • People are causing confusion when using account to both repost messages, which are sometimes written in the first person, and writing their own posts in the first person.

    It seems fair to label them as bot or similar if the amount of (presumably automatic) reposts cross a threshold. It would be nice to make it possible to remove the label after they stop mixing both activities within the same account.

    If the platform is too accomodating with accounts that mix artificial and human content, expect bots and LLMs account to abuse the rules and claim they are partially human curated. It’s going to be impossible to verify and a nightmare to moderate.