• 5 Posts
  • 19 Comments
Joined 1 year ago
cake
Cake day: June 4th, 2023

help-circle












  • Let’s not forget… the reason this type of licensing exists is because large cloud providers were taking a large code base and selling them as services . Often, the main path for the creators to make any money from their code is to offer a paid, managed tier, along with professional services. They would end up competing, and losing, against those cloud providers.

    Not saying this kind of license is good or bad, but the reason is often not to stop self-hosting or screw contributors, but to maintain couple of the only pathways FOSS can bring in revenue.







  • Most products should validate their assumptions before they even start laying down designs, code, or hardware. If it’s super cutting edge (like this one) there is a temptation to question the feedback and get into ‘build it and they will come’ mode.

    But most of the time, testing with real users and validating the revenue model is the prudent path. Hopium is not a currency.






  • The RP2040 solution was pretty clever. And that’s just for line sniffing. He can still add clock or crowbar glitching into the toolkit to work around more advanced defenses. This is something that car ECU hackers figured out a long time ago. There’s no software solution to work around that bit of nightmare. FWIW, ChipWhisperer can do all of these, including the synchronous sampling method used to fake a clock signal right out of the box.

    As the piece mentions, setting a PIN can help, but all it does is annoy the user (who will likely choose something obvious and easy to remember) and transfer the problem to a simple dictionary attack.

    The minute you put the security component in a separate module, you’ve opened yourself up to line-sniffing and MITM. And as soon as someone has physical access to a device, all bets are off.