Posted by scottjg 1 day ago
The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
Any number of people could have discovered and exploited this, but it’s tedious work. Most people who can do this are busy with their job and other things. Now LLMs enable people who understand these things to quickly get through the tedious parts, so they can do a lot more of this work in their free time than they could before.
> The most fascinating part of this wave of LLM reverse engineering is seeing how many weird and poor choices were lying in plain sight.
But in some weird way we're coming to the day of reckoning. I'm sure we'll always have missed bugs but with a lot of what we're seeing it more seems like these were avoidable problems. Code issues I can easily imagine at least one person on the team said "this isn't acceptable, we need to correct it" and them getting overruled. I'm sure each and every one of you has seen, if not experienced, this.
It'll be interesting to see if that continues. I suspect companies will still rush but from my experience even the best models happily produce shoddy code. And there's a feedback loop, the model's performance is influenced by the code's quality. So it's easy to degrade and get into a bad feedback loop. But I think people still value speed over quality, even in this world where Microsoft shit the bed
[0] in quotes because the entire conversation is essentially about what is actually good enough and what actually is the minimum viable product.
Would love to understand the decision-making behind this at Coway (or their firmware contractor). Anyone care to guess why someone would make this choice?
My guess: At some point in the past, a firmware was developed without plans to include firmware update functionality. The team that did this was later burned when the client tried to use a new certificate that the hardcoded, unchangeable system didn't recognize.
Angry meetings occurred, developers were chastised, and someone realized they could avoid that problem by fetching an updated root CA on demand. They did it over HTTP to avoid a chicken and egg problem.
In hardware manufacturing, everything is about crossing items off the list of problems. A problem was raised, someone came up with an idea to solve that problem, and it was implemented. The practice might have spread to other products because it became institutional knowledge about how to avoid a problem that made a customer angry once.
This is from my experience in the consumer hardware industry. If you're not watching the outsourced development closely, they will take the easiest route to solve the problem in front of them and nobody will consider any other consequences.
There is nothing wrong with downloading a certificate over HTTP. In fact, that's how PKI is designed and if you look at the AIA field of this very site you will see the certificate chain is meant to be served over HTTP.
What IS wrong is implicitly trusting an untrusted certificate. Whether it came over HTTPS or HTTP is irrelevant. But no one is talking about that.
I'm more puzzled why someone would buy a complicated IoT purifier for a drafty Bay Area house that probably has knob and tube wiring.
My most reliable air purifiers have a dumb, physical on/off switch. I bought them deliberately for that feature.
1) Others knowing knowing exactly which package you are downloading could give them a very clear way to fingerprint and target services you are running
2) HTTPS could allow you to potentially reduce your risk surface in a case where there is a bug in Steam's signature checker itself and someone sends a crafted payload instead of game files. Server validation would have prevented that. This has actually happened with apt before: CVE-2019-3462.
Odds are small, but I believe in DiD. I could imagine an attacker with nothing better to do could get up to this on say, a Uni's network.
And before you come at me with I should be using a VPN to protect against these scenarios, I do that already. This is about HTTPS being a sane default when possible.
The default for package upgrades on PCs should be HTTPS (as it already is on Arch, Alpine, NixOS, Flatpak, and Homebrew) since it reduces risk with minimal performance impact for most users.
Or they could connect to the service.
> Server validation would have prevented that
No it wouldn't have. HTTPS does not ensure a server's contents are trustworthy.
> And before you come at me with I should be using a VPN to protect against these scenarios, I do that already
So you protect yourself from unlikely, irrelevant threats by... deliberately paying strangers to MiTM your traffic?
You publicly demonize something long enough and otherwise intelligent people start believing HTTPS is a magic invisibility cloak or the Good Housekeeping seal of approval for the web.
It is a tool in the toolbox and nothing more. Wearing safety goggles while making spaghetti is equally stupid.
Solution: ignore security in 1st party code outside 3rd party library that tries to prevent ignoring security.
As far as I know, most of this cheap crap is basically supply chain management companies that contract a factory to manufacturer and contract a software development/IoT/chip company to write software. Everything is waterfall-style locked in with no ongoing support or funding after the production run is done. The software company doesn't care insomuch as it "works" and working to the SCM company is "powers on and functions", not "is secure". As such, there's not much accountability. If the endeavour gets bad publicity, they just close up shop and spin up a new brand.
EtA: I built a skill for it https://github.com/tclancy/ai-tooling/blob/main/skills/diagn...
1 20" box fan.
4 20" mirv 13 filters (cheapest is likely costco or lowes or home depot - buy in a 4 pack to save money).
More info Search "Corsi-Rosenthal Box" or click https://filterbuy.com/resources/air-filter-basics/how-to-bui...
Don't go hepa because it slows down the filtering too much. I use this technique in my house and it cuts down on pollen, smoke and mold. You'll feel a lot better than a tiny expensive hepa that has proprietary filters.
I'm seeing some 3d printed projects popping up that look to be filling this gap though.
Most surprising thing: all but one of those original Amazon fans is still running. They've had years of run time, at quite a bit higher stress than normal.
A smaller supplementary unit made out of PC fans and N95s can do that. A 120mm Noctua fan's flow and pressure fits well for about three 3M Aura masks in parallel.
It's unhinged how good the air quality is in a room with a device like this.
Example: https://www.cleanairkits.com/products/luggable-ultra-air-pur...
If volume is a problem, I'm sure one can lower the fan speed below the lowest setting with some electronics knowledge.
Better sealed homes might have better luck - it should work ok - but the best way to breathe filtered air quickly is to stick your head right above a filter.
It's like telling someone they bought a car and pointing out that golf dimples with increase your mileage. No reasonable adult would have that thing in the middle of their living room!
And I can override or change it from Apple Home.
The smart plug lets it verify that the fan is actually running, (because it measures usage) and we worked out that after a power cycle the Vornado goes back to a known state, and we can find the speed by forcing it all the way to 4 and then stepping back.
Need to try to get Sonoff bridge rigged up next but have been busy messing with Hatch alarm
I am wondering how the big corporate will respond sooner or later. Because it is clear and they know that as well with the every rising capability of LLM more people will find ways to liberate their hardware from such unnecessary dependency and accept less the money drain.
That said, the non-wifi model works perfectly with a simple HomeKit compatible on/off plug, so all this work — despite being very, very cool — seems a little pointless?
You can't install a true HEPA filter directly in a typical residential system, but you can have an HVAC tech install a bypass system in the air handler that would allow part of the air stream to be filtered via HEPA continuously. If you build the system (or house) from scratch and express your intentions to the HVAC contractor you could plausibly use direct HEPA filtration for 100% of airflow.
https://www.lennoxpros.com/healthy-climate-hepa-60-bypass-ai...
My house downwind of a freeway and a wilderness area, lots of nasty black tire dust mixed with allergens. It did not come with A/C. I had HEPA air purifiers around the house that I would leave in auto mode and they would run for a few hours a day based on the air quality.
Then I got central A/C installed with a standard 1" MERV 10 rated filter on the intake. Just running the blower for 10 minutes every hour is enough to keep the air quality in every room below the level where the air purifiers would kick on. I've given most of them away.
i have to do a major upgrade next month (30 year old gas furnace!) and i will need to do some research, but i would like to even ascend to true HEPA if it's feasible
Also, in new homes, beware of undersized heating systems that will fail prematurely.
| only your basic assumptions that are |
\ wrong. /
--------------------------------------
\ ^__^
\ (oo)\_______
(__)\ )\/\
||----w |
|| ||While this is impressive: Why not just get a not-cloud one in the first place? Why does an air purifier need to be controlled via wi-fi?
I'm against a lot of smart home things because its actually more maintenance, not less, to have to think about an object connecting to wifi, to have to decide whether or not to control it (what are you even doing to it?) And I suppose to have to write your own drivers or app. Why allow it to occupy this much mental space for you?
Also auto on/off. If you put Home Assistant app on your phone, you can wire up automations that turn things on and off depending on whether or not you're home. Could also have Home Assistant pull in air quality/pollution info for auto on/off. High pollen count today? Keep it running so I sleep well. Low pollen count? Turn it off.
Maintenance is minimal. I set the dehumidifer up 2 years ago and haven't touched it since or had a single issue. Main thing is a) get it working, b) get it isolated from internet, c) never touch or patch it.
Once the data is in Home Assistant, I can also look for correlation with wearable health info. Does purifier running improve sleep? Does changing thermostat set point improve sleep?
Setting up almost never takes more than a few seconds for me. I have Apple home, it’s almost always scan a QR code, wait a few seconds for wifi and done.
Also it’s fun to mess with.
What I like about IoT is the idea of hacking them :-). Of course I don't want connected devices running proprietary firmwares anywhere near my LAN.
Also one thing is that when a company sells an IoT device, maybe they mass produce it and it's cheap. Whereas if you wanted to build it yourself, it would be harder. Getting relatively good and cheap hardware and putting your own software on it is nice!
It is convenient to be able to monitor air quality from your phone, sourced from a device that is designed to improve it. Because then you can see how much of an impact it is actually making, move it to a different location with better airflow, etc.
I have the non-wifi version, and have to use a separate device for it.
One of the nice things about air purifiers, unlike owning a boat or leaving a stove on, is that its never going to surprise you in a bad way. You don't need to really monitor anything, it will just purify some air. Do you really want to be bringing that under the umbrella of the stuff you monitor? Maybe this is an irreconcilable difference and we cannot see it the other person's way.