Where are we now?

[levi]

There is still a lot to be gained by not having any open sockets, and on something like a Zaurus which has at best a simple web browser I suspect, JS cracks aren't a concern. But on anything that does run a full featured web browser, and has a software repo that could theoretically be abused, ensuring the kernel isn't exploitable limits the damage that bad software can do.

 

[theredbaron]

getting hacked is less about kernel exploits and more about your crappy scripting and sloppy administration.

but isn't it a bit vain to think someone would be interested in hacking your beloved ultra portable mini computer?

my zaurus is on kernel 2.4.18 November 2005. never been hacked. never will be. also never crashed. and I run everything as root. and no password for WiFi. no shit.

"Hacked" may be the wrong word, lets go with exploited. You don't have to be "vain" to be afraid of being exploited, just a normal person, who uses the internet normally. Just being on facebook, with javascript enabled, and no adblock is enough sometimes. Everybody is worth something, if only to be used to mine crypto.

You can give up a lot of usability for security. Hell, you can be secure with windows XP, if you don't mind a lose of usability (granted, more a lose then with linux, but still). However, for general user's, updates are very much needed for protection. Even on linux. Granted, Linux has a much better starting point, but it is exploitable, amd updates fix this.

The only reason your 2005 system is secure is through obscurity. Linux for users just isn't a big target, but it is getting bigger everyday. Treating linux as an iron fortress maybe fine for you, but it isn't going to cut it for new / normal computer users

 

[matzesu]

Well, the Pyra will mature from its Updates, like the Pandora did years ago:
When i got my Pandora, not even the Low Power Mode worked, so i had to shutdown it every thime i ditnt used for a longer perioud, but whit every Update, whe got much more features..

So it should be on the Pyra, as i think its debian works, and charges the Batterie, but everything is still in a pretty early stage, so when you decides to not update your pyra, it will stay in its early stage

I dont worry about hackers on this thing, but i want some nice features..

 

[RZR]

I thought it was the other way round, they automated cracking everything and once they're in they ask themselves whether that box is interesting.
The other day someone died because the attackers thought they had cracked a University but they had disabled Hospital systems. RIP.

I could never say I haven't been cracked, I can only say I'm not aware of having been cracked. Most computers nowadays come precracked from factory.
And most phones come precracked by so many companies that I wonder how they work at all.
Fortunately not so for the Pyra.

IME comes to mind. Of course, they also got Windows installed, which is spyware. So we're buying compromised hardware with spyware pre-installed.

Now with IoT there's a 'new' tendency: botnet for DDoSing at will. Fueled now with crappy as hell (cheap as hell) hardware from alibaba/aliexpress/banggood. IPCams (OCTV cams, baby cams...) come to my mind, which actually run Linux, but factory set insecure/compromised, often in a clumsy/easy way (ie.: telnet/ssh service running with factory set default password or preset service to call home on reset...).

Scary as hell hardware, but also cheap as hell for home-brew projects if you know what you are doing. But obviously not for the user these are being targeted for.

Or another favorite of mine, crappy as hell hardware sold by EU companies that put too much confidence on their chinese suppliers:

Monsieur Cuisine Connect : micro caché, Android non sécurisé... les dessous du robot cuiseur de Lidl

Le tout nouveau robot-cuiseur connecté de Lidl fait un carton en France depuis début juin 2019. En voulant s'amuser à détourner son écran tactile, deux personnes ont découvert plusieurs éléments curieux dans le fonctionnement de l'appareil. Avec leur aide, Numerama met au jour l'existence d'un...

www.numerama.com

Smart mixer from Lidl France has ‘secret’ microphone

A new “smart” kitchen mixer that has just hit supermarket shelves in France is causing controversy after it was discovered to have a “secret” microphone that could be vulnerable to hackers.

www.connexionfrance.com

Doom anyone??

 

[Askarus]

IME comes to mind. Of course, they also got Windows installed, which is spyware. So we're buying compromised hardware with spyware pre-installed.

What I'm dislike more is that most Android phones come without root access.
At least you have access to most things under Windows.
But on their phone which is the most important device for a lot of people nowadays, people don't even have admin rights.
They buy a 1000+ € device and are not even allowed to install or remove the software they want.

On Windows it's meant to be done but if I want to, I could rename the "MicrosoftEdge" folder and the software won't start anymore.

 

[ClockworkCoder]

I don't plan on ever buying anything "smart." To me it's code for either spyware or an attack vector.

And who the ... wants to use voice commands for their food mixer!? "Alexa, play spotify" (cacophony of household devices simultaneously spring into action)

 

[fahrstuhl]

Cryptominers and ransomware are legitimate risks for normal consumers, and installing the latest patches helps a lot to protect you from them. Granted, nobody will target the Pyra or desktop Linux on ARM because there is no worthwhile userbase to make this kind of attack work. But security through obscurity is a bad protection.

I still think the best thing for security would be an ARM port of Qubes. Desktop Linux is lacking behind on app sandboxing compared to Android.

 

[Bosbeetle]

I dread the day that they start to implement voice commands in scientific equipment but no doubt they will.. (already seen microscopes with a tablet as input )

"OK mic zoom in on cell, set pixelsize to 100nm and increase 'smart gain' to 50, start experiment"


btw I did hear that there is quite a big group of programmers that use voice to program it started with the blind community, but appearently if done right it is faster.

 

[matzesu]

I imagine, every time a Pyra News thread gets derailed, the Pyra Release will be delayed 2 Months (tm),,

This whole Closed Source/Open Source OS discussion whouldnt be needed if everywhone gots his Pyra allready..

Im looking forward for the Day when this Boards will get filled whit the Questions of new Pyra Owners..

 

[RZR]

What I'm dislike more is that most Android phones come without root access.
At least you have access to most things under Windows.
But on their phone which is the most important device for a lot of people nowadays, people don't even have admin rights.
They buy a 1000+ € device and are not even allowed to install or remove the software they want.

On Windows it's meant to be done but if I want to, I could rename the "MicrosoftEdge" folder and the software won't start anymore.

And from October on, on Linux, you will be able to rename the "MicrosoftEdge" directory too, provided you decide to give it a try

I don't plan on ever buying anything "smart." To me it's code for either spyware or an attack vector.

And who the ... wants to use voice commands for their food mixer!? "Alexa, play spotify" (cacophony of household devices simultaneously spring into action)

But you, most likely, have a router provided by your ISP, which routes all your web traffic that is, conveniently, administered exclusively by your ISP.

 

[Askarus]

I don't plan on ever buying anything "smart." To me it's code for either spyware or an attack vector.

And who the ... wants to use voice commands for their food mixer!? "Alexa, play spotify" (cacophony of household devices simultaneously spring into action)

I don't mind "smart" devices as long as they are open source and I built them on my own.
To be honest, I do want my home to be "smart" to some extent.
Home Automation makes your life much easier.

It's super easy to use HomeAssistant on a RaspberryPi4.
Combines with Rhasspy and NodeRed you can build a voice controlled Home Automation that runs without the need to access the internet.
Everything runs local and is open source.
If you want, you can even use one of their open source apps and access your devices from the outside.
If you don't want to open up your network, Home Asistant supports running as an hidden onion services.

 

[ClockworkCoder]

The reason I quoted "smart" is because it's marketing jargon which means little to nothing in almost all contexts in which it's used, except to imply that you'll be connected to some remote server(s) outside of your control.

Open source IoT devices on the other hand are usually multitudes more clever.

 

[JDTAY]

Today I learned that there's no Oktoberfest this year due to COVID-19. I googled it just to see if it would affect Pyra production. Apparently it usually starts halfway through September? Why not call it Septemberfest then?

 

[λ the β-Redex Reducer]

The reason I quoted "smart" is because it's marketing jargon which means little to nothing in almost all contexts in which it's used, except to imply that you'll be connected to some remote server(s) outside of your control.

A great example of the word "smart" being misleading marketing nonsense are smart meters. Supposedly they're often actually stupider then non-smart meters but they're called smart because they can transmit wireless signals. That's like saying that a loud idiot is smarter than a mute genius because the loud idiot can talk.

We refused a loud meter (I will call them that because thier defining characteristic is being loud on the wireless) back when they were pushed on everyone and it looks like that was a good choice. Loud meters are not meant to be good for consumers, they're meant to be good for the power company. Though they may be marketed as if they're meant for the consumers' benefit if your power company is run by weasels.

 

[matzesu]

The Bavarians dosnt call it September Fest because it was meant to celebrate the Birstday of a Bavarian Princes or a Marriage or something which was in Oktober, but as the September where a lot more warm and sunny in Munich, they decided to putt the Fest in September..

 

[RZR]

I dread the day that they start to implement voice commands in scientific equipment but no doubt they will.. (already seen microscopes with a tablet as input )

"OK mic zoom in on cell, set pixelsize to 100nm and increase 'smart gain' to 50, start experiment"


btw I did hear that there is quite a big group of programmers that use voice to program it started with the blind community, but appearently if done right it is faster.

"Enhance....
...
...give me a hard copy right there"

 

[PowerGod]

Polaroid technology was one of the most futuristic things I ever seen.
It is still impossible to reach that type of quality with a smartphone and a portable printer, despite all the years of developments.

 

[levi]

On Windows it's meant to be done but if I want to, I could rename the "MicrosoftEdge" folder and the software won't start anymore.

Be careful not to assume you can still do anything you used to do. As far as I'm aware, the account I use on my local windows machine has admin rights, but I was still unable to change a batch file I'd written in the dim and distant past to launch a program in order to fix a bug. I'm not sure if I tried the same in the cmd.com terminal, but at the very least windows seems to assume that changing anything in your program/ files folders is a silly thing to do, and tries to stop you. For me at least, the bug wasn't a showstopper, so I ended up leaving it.

 

[PowerGod]

Be careful not to assume you can still do anything you used to do. As far as I'm aware, the account I use on my local windows machine has admin rights, but I was still unable to change a batch file I'd written in the dim and distant past to launch a program in order to fix a bug. I'm not sure if I tried the same in the cmd.com terminal, but at the very least windows seems to assume that changing anything in your program/ files folders is a silly thing to do, and tries to stop you. For me at least, the bug wasn't a showstopper, so I ended up leaving it.

You'll just have to enter the folder with admin rights.
If you have UAC active you have to manually select or confirm to use admin rights every single time you need them, even if your user is already an administrator.

Oh, also, specifically about "Program Files" folder, the user has no write access to it (unless using admin rights), but all the modifications to the files inside that folder goes to another folder, the VIRTUALSTORE, located inside the user appdata folder.
That folder has priority over the main "Program Files" (when NOT using admin rights), so the same file could be different on both of them, and only the one in virtualstore will be used.

 

[Yogendra]

Today I learned that there's no Oktoberfest this year due to COVID-19. I googled it just to see if it would affect Pyra production. Apparently it usually starts halfway through September? Why not call it Septemberfest then?

No October rest = no beer = clear head = sanity