I waddled onto the beach and stole found a computer to use.

🍁⚕️ 💽

Note: I’m moderating a handful of communities in more of a caretaker role. If you want to take one on, send me a message and I’ll share more info :)

  • 249 Posts
  • 1.13K Comments
Joined 3 years ago
cake
Cake day: June 5th, 2023

help-circle





  • I don’t use Brave, and don’t recommend it to people, but it seems like the $60 is intended as a donation/“vote-with-your-wallet on how we monetize” type product rather than something that is actually worth that much.

    It doesn’t change all of the OTHER problems with Brave, but it might be a step in the right direction when it comes to monetization? Pay once vs. LLM/crypto/injected ads

    https://account.brave.com/?intent=checkout&product=origin

    Brave Origin is a paid version of the browser for users who don’t need all the features that support Brave as a business, but still want the privacy that only Brave offers. Origin users will continue to benefit from our industry-leading privacy, adblock, and speed (via Shields), as well as regular software updates, Chromium patches, and security and privacy improvements. Origin is available on desktop and mobile versions 1.91.x and above.

    • Support our mission & open-source work
    • Minimalist browser UI centered on Brave Shields
    • Maintain core adblock, privacy, & speed
    • One-time purchase can be activated multiple times across all your devices


  • The way BLE (Bluetooth Low Energy) works is that each device has various registers (called GATT characteristics) that, if you’re connected to the device, you can write to, read, subscribe to notifications for, and so on. What’s important to note is that to connect to a device, you don’t need to (necessarily) pair with it. You can often just connect with a device and immediately start reading and writing data to characteristics. Pairing establishes encryption, but a connection can be made without it.

    To my surprise, upon reading the characteristic 9e9daaeb-3a10-4fe8-b69f-7397aff77886, I was greeted with the full version string. This means anyone can just connect to any Katana V2X over Bluetooth and start sending CTP commands to it, reading information, changing settings, etc.

    I thought of the implications for a bit. The speaker has a microphone. An attacker could, theoretically, upload a custom firmware that effectively turns the speaker into a covert monitoring device, listening in on conversations and forwarding them to a receiver over Bluetooth.

    What was more interesting to me was the fact that the speaker is, in a standard setup, connected to a PC over USB. It’s by all means a trusted USB device.

    What if we wrote custom firmware that forced the speaker into acting as a keyboard, sending keystrokes for opening up the terminal and executing arbitrary commands? We would turn the speaker into a Rubber Ducky, but remotely, without ever having to plug anything into either the speaker or the PC.








  • That’s a bit of a stretch?

    People who pay for Kagi likely tried the trial and found the results to be far enough better than google/microslop that they are willing to pay for the ongoing service. Or they want to support a business model that isn’t based around the advertising industry, so that someday Kagi can realistically compete with the incumbents. I don’t need to search for things often enough to justify the cost, but I know people who use it for work and consider it to be worth the cost.

    Meanwhile people who bought NFTs thought that they could sell a copy of a digital image for lots of money.




  • The article speculates that this isn’t intentional by Motorola. I’ve also seen mentions speculating a compromised library

    Secondly, we can speculate as to what’s going on – and that’s what the following is, speculation and conjecture. While many would quickly, understandably, point the finger at Motorola here, my gut says something else is going on, and that it might not be a decision Motorola actually planned out. The redirect through a seemingly fake website and affiliate code of an influencer that has no obvious ties to Motorola is just too bizarre to ignore.





  • They’re somewhat sandboxed, likely to be up to date, and it behaves similarly across different machines. It’s nice for GUI programs that don’t need access to the wider system, and it won’t mess with anything else that I already have installed. I guess it would have similar pros and cons as containerization with Podman/Docker?

    I get the vast majority of my GUI programs from Flathub. I didn’t know there was a controversy with it, other than just wanting a different way of doing things.