gattsuru
8hr ago
Ah, sorry, I was thinking short-cycling as a separate failure mode. Naively, I'd expect an MCU reboot loop to poll the thermistor(s), if they're over target temp engage the compressor, trip a safety or watchdog five to thirty seconds in, and then restart. An attacker that wanted to intentionally trigger that behavior, rather than 'just' triggering an indefinite defrost, should have been on the mind of whoever set up the mainboard's program and most HVAC techs, and...
... Uh, long-term effects I'm not describing here, but unless the answer is 'oh I could clean that out in an hour', I'm not sure should be described here.
The IT-world argument is that once you compromise any system on a subnet, you can at least listen to everything else on the subnet, and often attack everything else, too. While it's not entirely true in a modern world, it's pretty close. Conficker is the historical example of a wakeup call here. I get that HVAC techs don't really think that way (and, hell, some IT people don't, a la the 'air-gapped' networks that are really just bad firewall configs), though.
The HVAC argument is that a freezer failure is easily five digit cost of damage, even in the optimistic case where the food is just unsaleable rather than inedible, I can't imagine an expert working that job hasn't seen it. The defrost attack here might not be foreseeable for the average HVAC tech, who might reasonably expect it to 'just have a max timer', but in turn I don't think it's the only or even worst option. I don't have a good model of industrial freezers, but from what happens to consumer air conditioners or freezers when they're stuck short-cycling, I'm guessing that would be Bad, and the sort of failure that requires long technician hours and longer lead times on parts.
Emerson writes the password on the device for technicians to have access to, and Ke2therm uses all fives(no, it can't be changed).
The former's actually pretty reasonable, at least if it isn't something stupid like 'password', and NIST recommends it for a lot of devices initial configuration. The latter, I'd like to just have a talk. Holy shit. That's literally worse than the 'some idiot has on his luggage' option.
gattsuru
10hr ago
It's still weird that the guy building the web interface would do it, even if he was a career HVAC tech that had gotten pushed into software dev. But it's plausible.
What were the hackers after? Ransom ware?
That's a fun thought. Ransomware naively feels a little weird for me. Telling the people they need to pay you gives them a window to replace the controllers (or just turn off internet access and hope you didn't leave a time bomb). But I may be missing an attack vector there, or they might have been working toward the timebomb and just noticed enough devices they got interrupted.
There's some more esoteric options, though. Hitting food supplies is famously one a target for causing political unrest. Just shorting a few of the supermarkets would potentially be a very remunerative option, though it'd be a hilarious way for the hackers to get caught (or lose money). Burning Danfoss itself might be a thing, especially for the more ideological actors -- even if the threat genuinely doesn't exist for their newer products (not a given), there's no way its buyers avoid a security audit, and no way Danfoss avoids a ton of support costs downstream of that, on top of lost goodwill. Political or nationalist drives are always an option, if a goofy one. "Hey, Look At Me" or a personal grudge turned public is just plain dumb, but if any attack could be executed by a script kiddy, this one could.
Not sure some other options.
gattsuru
11hr ago
The default admin password would be common in normal IT world until 2020: it took a combination of California law (2018's SB-327) and NIST's mandate, along with some questionably-authorized-by-statute contracting pressures, that really made it universal for routers. I'll still see it (or password) on internal-only equipment, including some still-being-sold-as-new Unifi devices.
It's not even necessarily wrong in an environment where you'd expect some intrusion detection, or where the device requires a change on first login. It's just bizarre to do it, and then recommend people forward a WAN directly. This particular attack seems to have depending on another, different 'master' password, so I guess it doesn't even matter, but that's another thing that on its own points to 'reasonable if you're not that concerned about horizontal movement' (common in 2013) and really bad if you have any reason to worry about being the first hop in an infection.
Like, I'd hope they have fail2ban or equivalent set up? But I wouldn't be optimistic.
The competitor being worse makes me really concerned.
The manual for one of the affected models is available online, see page 11. The idea of a web host running on the hardware controller is... not the worst thing I've ever done, but :
"If the remote connection is on a WAN then the LAN router may need to be configured to allow this inbound counnection, with the addition of the web port added tot he end of the http string."
Definitely worse. I was building web-accessible hardware in 2013. This was, to be fair, a couple years pre-Let's Encrypt, and SSL wouldn't have solved this specific problem.
But I still knew better than that.
Early descriptions of the attack have claimed that there was a master password for the device exposed on the same interface (unclear if it's the HTTP or XML), which allowed the control commands through in bulk.
gattsuru
16hr ago
There's a lot of value in things like alerts, too. Being able to send someone an text message or even call someone when a glycol loop herps the derp can be a 10k-100k dollar value proposition, and pulling good logging data about current draw can give you warning months before actual death about a failing motor or compressor.
That said, the idea of inbound open ports for management is mind-boggling, even for hardware in the 2000s era. Even before you get to the security ramifications, it's just an absolute nightmare trying to get fifty sites to stick with static IP addresses, inform you when changing ISPs or modifying firewall configurations, or your DDNS provider changes literally anything. I know OT has worse practices than IT, but this one is pretty mind-boggling.
Forget setting up VPNs. Buy and configure a single main operational server, have the hardware send regular updates there, move all the heavy lifting and the UI somewhere you can control if and limit firmware updates to message protocols, certificates, and fundamentals. Allow big customers to buy, run, and redirect to their own server if they really need to own everything. Done. Two or three months work for an intern. I hate Everything Is The Cloud, but this is a tailormade situation for just putting things on the cloud.
gattsuru
19hr ago
The Lawmaster one is pretty atrocious, and I'm a bit surprised it doesn't get more play today (or even back in the late 00s). I guess on the upside, the ATF entered a house with three separate dogs and managed to not kill a single one? Even if they did scale the literal shit out of them, and manage to run the rest of the warrant search so poorly they were eventually told off by a judge, for what little that matters.
The Lamplugh raid is messier. There's serious question about the Lamplugh's claims, and while it's plausible that they were putzes and couldn't present their real arguments well, there's as good an odds that they were just putzes. I've grown a lot more skeptical of judicial review, but the case's specifics stink.
gattsuru
1d ago
It's generally not considered good trial practice to argue one theory of a case and then call witnesses who contradict that theory.
That's probably a good general rule of thumb, but the practice of calling a defendant to the stand and trying to portray their claims as self-serving is not limited to Law and Order or the Rittenhouse trial.
And Alnaji's stipulations do seem pretty self-serving, at least as his defense lawyer claims were accepted by the judge. "Had a dispute" falters a lot worse if, as the publicly available information suggests, Alnaji's group moved toward Kessler to confront them, rather than being approached. "Accident" turns from 'tots couldn't have predicted this could have happened' into 'I didn't mean to kill him' if Alnaji's was actually trying to hit the man with a megaphone.
Now, that just affects judicial sympathy (uh, optimistically: Milan seems a putz). But then there's the actual enhancements...
It doesn't matter whether he was trying to slap the phone out of his hand or hit him in the head with a megaphone, it's involuntary manslaughter either way.
As you noticed before, a megaphone can "armed with and using a weapon", something that allows the matter to go from a jail sentence to a prison sentence. I also can't find evidence that it actually requires 'intent' to use as a weapon under California law, either. Similarly, it does matter whether Kessler was especially vulnerable, and while it also seems like something where Alnaji didn't strictly need to 'know' that the 69-year-old was an old, fragile guy, it's a pretty strong way to demonstrate it.
That impacts the sentence in a fuzzy 'the judge can go this high' way. Now, that's something the court was predisposed to accept and still give a shorter and mostly non-custodial sentence as part of the tots-not-a-judicial-plea-bargain. But it also leaves a record that can be reviewed for things like an unlawful sentence.
And when that fails -- because we're still talking California -- it leaves the case in high company with examples like Latasha Harlins, aka the other cause of the Rodney King riots. Which still has relevance for prosecutors, even if it never impacts a court room directly.
gattsuru
1d ago
Ken Ballew would be 1971.
gattsuru
2d ago
There's been some similar drama with Star Citizen. It's an aethestically and conceptually fascinating game, limited heavily by the combination of a) bizarrely poor development priorities, b) incredible bloat in development goals, and c) a financial model that's become dependent on selling ships to whales, d) with corresponding impact on game balance.
The same people who can't get mission selection working reliably are, unsurprisingly, not great at handling game. So now there's 'mods' that allow an offline mode that gets past the notoriously buggy physics sync problems (just fixed literally two days ago), allows spawning in of resources and characters where they wouldn't normally exist, and has been modded with things like a Star Wars Star Destroyer. And CIG has issued takedown notices, with the corresponding totally predictable Streishand effect. This is particularly sticky because the original Kickstarter promoted private servers and modded play, only for those to be removed from the road map and eventually disavowed.
In practice, the shared persistent universe is enough of the call for this game that it's not going to have too many people jump ship. But there's reason CIG is treating it like a nuclear option: even minor improvements to the small team multiplayer environment or to casual gameplay, or for PvE-only worlds, would be something the actual game as presented just can't do, at least from past practice.
gattsuru
4d ago
There's a real pattern there in broad strokes, and with more layers than you'd expect, in no small part because there is a genuine contradiction. The physical rock character's stoic, good at problem-solving, traditionally masculine... and this is simultaneously desirable and absolutely infuriating to most women, since it seems belittling even in its best form where it solves problems easily and correctly. The Other One is emotionally open, in touch with his feminine side, risk-taking, and very understanding any triggers from past relationships/male authority figures... and also doesn't really come across as the sort of person a woman she be chasing, and not just in the stereotypical 'bad boy' way, either. Which, to be fair, can also be a fun taboo violation of its own, but still an awkward matter in a real relationship.
Yaoi fangirls are aware of a dynamic, because the genre formalizes one. Ukes are feminine, emotionally open, perceptive (often to a fault), shorter, and a bottom. Semes are masculine(ish), emotionally steady, inscrutable and less perceptive, taller and tops. In some circles, this can get as formal as hair color or blood type. Obviously, many of these associations are not real -- a lot of traditionally feminine skills in particular end up being pretty top- or switch-coded in practice, and a uke/seme excludes a pretty wide variety of real-world physiotypes -- but my guess from the outside is that they're part of what make yaoi attractive to women.
And in the real world, it doesn't really break down easily into one role or the other all the time, either in gay relationships or in M/M/F ones. In the trivial sense, there's a lot of switches, but more broadly it's extremely rare for people to have the same level of confidence and awareness in all fields, or just daily variation in personality expression. It's hard to actually set up a reciprocal norm when at the raw flirting stage, but it's something that tends to evolve pretty quickly in a real relationship in my experience and in those I've seen second-hand.
I have absolutely no idea on yuri/FF. Not really my thing, and while I'm aware of butch/femme people and how they act, I can't say much as to how well they generalize.
I'm kinda curious which one of spudyjek's guys seems androgynous masc to you. In her adult content, they tend to swap (the gray-furred bat is socially confident but physically vulnerable, the white-furred rabbit is socially vulnerable but physically confident... most of the time, but between furry genre assumptions and knowing about that content, I'm not going to get the same read as an outsider would.
gattsuru
4d ago
Curious if the non-orgy gay guys have that sentiment of postcoital sexual disgust and contempt for a partner who's been penetrated, or what rayon calls "the corrupting power of cock"?
There's a small fraction of gay men that treat anyone less masculine or that willingly bottoms like they're 'less right', and a larger extent where 'submissive and breedable' or 'bottom energy' is a not-the-most-friendly compliment, but neither aligns well to the orgy/no-orgy line, and neither are overwhelmingly popular.
But in the gay community do you see men suggesting that friends are impure or vile or undateable because of contact with a single-digit number of other men's cocks?
That one's a definite no. A manslut might not be a specific person's idea of a good partner, but there's so many well-known and well-liked self-described mansluts that it's clear a lot of other people would want them.
In a parallel situation to this frat party, does the drugged ketamine novice get ostracized, deemed forever gross and undateable, disinvited from parties for not having put up more resistance to the other guys?
I'm not very familiar with the heavy drug user side (or, to be honest, even the 'light' drug users, like poppers, marijuana, and alcohol), so I can't speak with too much confidence, there. My personal take would be kinda squicked out whether they were topping, bottoming, or sitting in a hotel chair high off their gourd, but I don't know what the average intuition for the hard drug orgy side would come out to.
gattsuru
4d ago
The PEPFAR numbers get complicated, even under their own assumptions, if you look at them remotely critically. USAID as a whole have numbers some more plausible backing, but that's damning with faint praise, and they're still not that plausible.
Part of this is the difficulty of getting any serious numbers at scale: you can't get a good measure of how many people are dying of what cause in Somalia for the same reasons people are (presumably) dying in Somalia.
More of it's because they had easy metrics that showed they were Doing Something, and a lot of reasons to conflate Doing Something with actual productive impact, and very few people with the ability to investigate those numbers had or have the ability to promote their findings. So you get a lot of statistics where the underlying measure is partly or mostly money spent, sometimes added through many other statistics that are partly money spent.
The political impact is messy, and virtually unprovable and undisprovable. The steelman arguments are less a clear fund labeled 'make sure Lula gets reelected', and pretty much any spending could also have a side effect of an army dedicated to promoting a specific political viewpoint or blamming the political opposition, but it's not clear what proof would look like, and even less clear what would be needed to show it didn't happen.
gattsuru
6d ago
I'd argue math matters -- there's a reason that people like me who need to use our knuckles for times tables still sometimes know Dijkstra -- but that's probably not going to help math PhDs choosing between a barrel of bourbon or a different type.
In the short term, this might boost math as a job, since now there's literally hundreds of lifetimes of proofs needing deep examination and translation being dumped on a weekday night... but even in the best-case, that's not what people signed up for. And worst case, the machines might be better at it than the humans, and if they aren't yet, they probably will be soon.
In theory, math PhDs are well-educated extremely smart people who should adapt best and most easily to a career change, but again, now what people signed up for, the PhD isn't cheap, and a career change to a different field that might just become the next benchmark isn't encouraging. Worst-case, this seems up there with 'moving to a new culture' or mega-dosing on THC that pegs the schizophrenia risk.
Notably, ML related results are nearly entirely absent from this batch of proofs; maybe a half dozen touch on it, distantly.
Yeah, and both anti-distillation and anti-LLM-training-assistance techniques are already known and disclosed. And given the 3SUM problem, if I'm understanding it correctly, I would be very surprised if there's zero here.
Related really fun thought: previous LLMs have been very prone to 'leaking' out to the public net as they do more advanced work or get stuck on genuinely impossible problems. Here, either OAI has really stepped up their sandboxing game, the leaked outcomes have become internalized universally without public fanfare, my search-fu has been flopping... or a lot of this stuff doesn't count as 'advanced work' or 'sticking'.
gattsuru
6d ago
Sorry. It's a MMF romantic relationship.
To be fair to the yaoi fangirl hypothesis, the artist is a woman. To be slightly more descriptive, the comment section has an absolute ton of guys wishing for one of the two slots.
gattsuru
6d ago
Scoot into the parallel universe of gay interactions, and penetration somehow doesn't seem to work that way. Eight dudes hooking up in various configurations, younger one plied with drugs by the others, and nobody would be surprised to hear that two of them ended up dating afterwards.
I'll caveat that there's probably more selection effect than just orientation in this hypothetical. Gay orgy guys are not the only preference point, and there's some strong if not perfect barriers between the two. There's also some people where the orgy would be a fun weekend, and mixing alcohol and pot wouldn't be noteworthy, or 'vhs head cleaner', but ketamine would be a nope right out situation.
((And, conversely, there's a pretty nontrivial excluded middle the other direction: there's folk who are tied into the gay drug orgy hookup situation that wouldn't turn down a woman for a long-term relationship because she was, too. I'm not going to say every bi guy thinks the spuydjeks solution is desirable, but if it's a literal fantasy for me even as a monogamous bi guy, and no small number of less monogamous bi guys are more openly willing to chase it. That might be a 1% of male population thing, but we're not exactly talking a supermajority of yaoi fangirls out there, either.))
gattsuru
8d ago
Paxton is (allegedly) corrupt and (hilariously) incompetent. It'd be a nice world where that mattered, but I'm honestly surprised that it's had as much a delta as it has so far. And since Cornyn burnt a lot of bridges over the last decade, he's got a lot of political capital on the right to burn.
I'd absolutely expect Vivek losing despite 10% tailwinds. I'd be extremely surprised if Paxton could.
gattsuru
8d ago
As far as I can recall, ToaKraka is literally the only (non-spambot) user who has been a problem in this regard.
I've posted links before to horny chats as well. I try to keep them inline, clearly labeled, and the charged content behind the click, but if the rule is a blanket ban, it's something I'll need to avoid as well.
While horny prompts are the only or majority of things I've tried to prompt an AI to write (contrast ARK fanfiction), the specific nexus of politically charged topics, known censorship, and the situation where everyone knows the typical media is poor quality but not what qualities it needs to excel in, has made it a useful barometer.
gattsuru
8d ago
I would still like to know what the "If they want to run with a different theory, they aren't going to be able to introduce the confession." rule is.
gattsuru
9d ago
… the UK has "protection from being fired for your speech" then I'd be with you…
I would quibble that the real rule is more that the UK claims that. Like supposed union protections or the umbrella of the NLRB in the US, these protections falter fast if the firer is popular or the firee unpopular.
gattsuru
11d ago
Yeah. Will add that I'm really not a fan of the judge's final decision spending a lot of ink on the 'hey, this is our first opportunity to bring this up, and the penalty here is well outside of the statutory bounds and separately raises 8th Amendment concerns' and then just not discussing the matter at all.
I've run into a decent number of techie (cis) lesbians, and then there's also the trans male contingent that gives similar twists to the bioessentialist perspective. The probabilistic argument still holds up -- you're talking well under a tenth of a percent -- but they do have existence proofs. That said, there's maybe one I know who'd flip this list, since they tend to either also be fabric nerds or be solely software-focused. Pretty much anyone with a EE background deep enough to know thermistor is going to be a renfest nut, and the exception I do have specifically rejected fabric and flowers stuff because her parents were really jerks about it rather than straightforward lack of interest.
Some of the words wouldn't be relevant even to a typical gay fashion designer. I doubt even the femmiest gay guy would consider a chignon, and they don't want to think about a pessary or doula, nearly by definition. On the other hand, taffeta, ruche, sateen, tulle, chambray, those are all pretty mainstream fabric terms, and many of which I'd expect them to have experience both talking about and using if they're even remotely into hobbyist sewing. Maybe jacquard, chenille, boucle, and damask if they do cosplay, upholstery, or embroidery, though they're weirder and I only know from trawling Michael's.
Bandaeu and kohl they might actually wear, if into crossdress; the real big question is whether it'd be something they'd call that rather than a tube top or makeup. Hell, espadrille isn't even a crossdress thing for guys, it's just a slipon.
gattsuru
12d ago
I've been going with hyprland/HyDE, but Omarchy has some nice benefits.
The entire hypr ecosystem is weird, but in a good way. I've called it catgirl thigh-high, and I've got a lot of sympathy for that tribe, but it's nicer still to just see the mission as the mission rather than a rallying cry for the politics.
Yeah, I’d expect especially the latter is a rough point. There’s a million Blue Dog Democrats in Texas, usually the reverse of the Thrown In the Pit on the right on something moderate-left on abortion or trans stuff… but there’s no way they’d make it through a primary without getting quisenarted.
More options
Context Copy link