• 32 Posts
  • 392 Comments
Joined 1 year ago
cake
Cake day: October 4th, 2023

help-circle

  • tal@lemmy.todaytoTechnology@lemmy.worldWorld's First MIDI Shellcode
    link
    fedilink
    English
    arrow-up
    5
    ·
    edit-2
    29 minutes ago

    The thing the guy is poking at is a synthesizer, a device that lets you compose music and synthesizes the audio.

    He got a service manual that showed some technical information about a similar synthesizer that indicated that some of the pins on one of the chips were used for a standard interface used to diagnose problems on devices, called JTAG. He guessed correctly that his similar synthesizer also used the same pins for this.

    He made some guesses about what functionality was present, and was able to identify the microprocessor and download the device firmware using this port.

    He then went looking for interesting bits of text in the firmware. What he ran across was something that appeared to be a diagnostic shell (I.e. you enter commands and can see a response) as well as the password to access it.

    He didn’t know how one reached the shell. He went digging in the firmware further and discovered that the device – which acted as a MIDI device over USB to a host computer – took in special MIDI commands that would go to this shell.

    Now he had a way to access the shell any time he had one of these synths plugged into his computer via USB – he didn’t need to physically connect to the diagnostic pins on the chip.

    One feature of the shell permitted modifying RAM on the synthesizer. It wasn’t intended to let one upload executable code, but he uploaded it into some unused memory and then overwrote the frame pointer on the stack used by the shell program to point to that code (which a processor uses to know where to continue executing after running a subroutine) and then returned into his code, which let him get to the point where he could not just upload code to the microprocessor but also run it.

    He wrote his own transfer program for high-speed data transfer over USB and modified the in-RAM code that displayed video.

    This then let him upload video to part of the display and display it at a relatively high frame rate, which is the anime video shown in the last section. I believe that the laptop in the foreground is showing the original frames.

    My understanding from two articles recently posted here is that it is a fad for hardware hackers to play this “bad apple” anime video on all sorts of old and low end devices.



  • I agree – and before DnT, there was P3P, which also would have done it – but it is what it is at the moment.

    I’m mostly exasperated with it because I wipe all cookies each browser restart, which is a much more-reliable and less-obnoxious solution than the EU’s regulatory approach of trying to convince the remote end not to make use of its ability to set them. If you do that, you get the cookie banner every time on sites that show it, which means that the cookie banner regulation has made my experience rather worse. And unfortunately, some sites show the banner to non-EU-based users – we don’t elect EU representatives, but we still get some spillover from their policies.

    There’s some Firefox plugin that will try to hide the cookie banners:

    https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies/

    EDIT: Yeah, from the description on there, the author is doing exactly what I am with the “not retaining cookies” approach, and smacking into how poorly that interacts with the cookie banner regulation:

    The EU regulations require that any website using tracking cookies must get user’s permission before installing them. These warnings appear on most websites until the visitor agrees with the website’s terms and conditions. Imagine how irritating that becomes when you surf anonymously or if you delete cookies automatically every time you close the browser.




  • For users, this tight integration was incredibly convenient.

    In Firefox, I have had any search starting with “gm” set up to do a Google Maps search. So “gm Omaha” will go to Omaha.

    That is, I create a bookmark that’s aimed at:

    https://maps.google.com/maps?q=%25s
    

    and then in the Bookmark Manager, set the keyword to “gm”.

    Kagi – which uses bang prefixes to do searches on external sites – appears to have done the same thing on the service side with “!gm”. So “!gm Omaha”. (They normally have their own, OpenStreetMap-based map thing, but if you want to do Google Maps, that’ll do it.)

    EDIT: For some reason, the Lemmy Web UI seems determined to convert “%s” to “%25s” in the URL above, and I can’t seem to find an escape sequence that avoids that. It’s intended to just be “%s”.



  • Kagi lets you blacklist individual domains yourself, but I think what OP is asking is “is there a search engine that identifies and blacklists AI generated content itself”.

    I think that the answer is probably that yes, probably all search engines try to block spam websites of any sort, AI-generated or no, and will do so all the time, or at least downrank them. Trying to present relevant, useful material at the top of the results is basically the business that search engines are in.

    Now, do any do so to a level sufficient to fully eliminate them? I’d guess not. SEO spammers have been trying to pollute top results with their hits for about as long as search engines have been around, and trying to cheaply bulk-generate content that looks like something that the user might want is just the latest form this takes. My guess is that that’ll be a cat-and-mouse game for some time to come.


  • Big picture here, I’m not sure how much point there is to putting heavier bollards in.

    I don’t believe that we’re going to seal off every area that a car can reach or someone can plant explosives at and that has a bunch of people in it in the US.

    It’s also not clear to me that there is a rash of people intent on a repeat job, trying to physically attack vice in New Orleans. Sounds like the perpetrator had a lot of problems and kinda was lashing out at the world solo.

    If we do get more incidents, then we’ve got more data points, okay, maybe do something then.

    There are a lot of ways to kill a bunch of people at once if you’re set on it and willing to be creative. You can maybe hit some of the most-egregious ones, but you won’t get all of them.




  • While it sucks, people like me (and there’s a heavy majority of Californians like me) will get lower rates because we live in cities with low wildfire and low flood potential.

    It doesn’t sound to me like this is the situation.

    Insurers can offer whatever they want, but if they want to be able to sell to non-high-risk people, they will also have to complete a sufficient number of sales to high-risk customers.

    The rule will require home insurers to offer coverage in high-risk areas, something the state has never done, Insurance Commissioner Ricardo Lara’s office said in a statement. Insurers will have to start increasing their coverage by 5% every two years until they hit the equivalent of 85% of their market share. That means if an insurer writes 20 out of every 100 state policies, they’d need to write 17 in a high-risk area, Lara’s office said.

    That will cause them to need to set lower rates in higher risk areas than they normally would to be able to complete sufficient high-risk-area sales. That will decrease competition to provide coverage in low risk areas, which will raise insurance rates there.

    I’d expect this to be causing people who live in low-risk areas to be subsidizing people who live in high risk areas via higher insurance prices in low risk areas than would be the case in an unconstrained market.

    That is, this is a good deal relative to an unconstrained market for people living in high-risk areas and a bad deal relative to an unconstrained market for people living in low risk areas.


  • The longest recording centers on Jabbar’s interpreting scripture to mean that “poetry, like rapping” could gradually lure people “into the things that God has made forbidden to us: the intoxicants like marijuana, alcohol, sedatives, opioids, stimulants and others”.

    “Then there’s the way that music entices us to illicit sex, vulgarity, violence, betrayal, arrogance, burglary, cheating, ingratitude to our spouses or others in general,” he continued. Suggesting music was “Satan’s voice,” he added: “It drives us to waste our wealth, sever the ties to kinship – and even idolatry by calling us to worship … the artist themselves.”

    The music is enticing people to violence. This must be stopped. The only thing to be done about this is to try to kill as many random people as possible.



  • That said, game studios are getting out of Russia as well.

    Yeah, I’ve noticed that, but I do wonder how much of that is “we legally moved headquarters, but subcontract back into Russia”.

    Like, you listed DCS:

    https://en.wikipedia.org/wiki/Eagle_Dynamics

    Following Tishin’s death in 2018,[14] Eagle Dynamics moved its headquarters to Switzerland, with multinational employees and contractors in Russia, Belarus, Ukraine, the United States, Canada, Germany, the United Kingdom, Italy, Spain and elsewhere.

    I remember reading some articles a bit back about Rolls-Royce subcontracting British nuclear submarine software back into Belarus and Russia.

    https://www.telegraph.co.uk/news/2024/08/02/britains-nuclear-submarine-software-designed-russia-belarus/

    Britain’s nuclear submarine engineers use software that was designed in Russia and Belarus, in contravention of Ministry of Defence rules, The Telegraph can reveal.

    The software should have been created by UK-based staff with security clearance, but its design was partially outsourced to developers in Siberia and Minsk, the capital of Belarus.

    I’d kind of think that scrutiny is probably less on video games than on defense contractors doing classified work on nuclear submarines, and if it can happen in the latter case…


  • I kind of wish that there was a bot that could auto-validate that at post time for communities that want it.

    Doesn’t even have to be a hard ban on any changes (like, I think that cleaning up garbled ISO entities in titles or stripping trailing website names from titles is entirely reasonable), but just compare title and submitted title, and if they differ, add a top-level comment with the original title.

    On Reddit, I remember that /r/Europe eventually took a pretty strict line on that after people kept editorializing titles.


  • The only thing that piques my interest there is, if that guy intended a larger explosion – and maybe he didn’t, maybe he just wanted to get the thing in the news than to do a lot of damage – how he couldn’t pull it off, if the guy was a Green Beret.

    investigates

    It sounds like his MOS was communications, not an 18C (engineering specialist). Maybe they just leave explosives to the guys with that MOS.

    https://nationalguard.com/special-forces-qualification-course

    The engineering specialist clearly deals with this:

    18C Engineer Sergeant Course

    This course trains and qualifies NCOs in the basic skills and knowledge required to perform duties as an engineer sergeant on an SFOD-A. Special Forces engineer sergeants are experts in employing offensive/defensive combat engineer capabilities to include demolitions, explosives and improvised munitions, construction, homemade explosives, target reconnaissance, and target analysis. Soldiers learn to read blueprints as well as design and construct theater-of-operations buildings, complete with plumbing, electrical and HVAC systems; field fortifications and Special Forces Tactical Facility construction; advanced demolition techniques utilizing U.S., allied, foreign and civilian demolition components; firing systems; calculation; and placement of charges, expedient charges and range operations. They can recruit, organize, train, and advise or command indigenous combat forces up to company size.

    What a communications specialist would do:

    18E Communications Sergeant Course

    This course trains and qualifies NCOs in the basic skills and knowledge required to perform duties as a communications sergeant on an SFOD-A using some of the most sophisticated communications equipment in the Army. Special Forces communications sergeants learn U.S., allied and selected foreign communication systems found throughout the world and are capable of employing and accessing SF, joint and interagency communications. Communications sergeants have a thorough understanding of radio theory; basic electricity; radio telephone procedures; signal-operating instructions; communication security; power applications; information operations, electronic warfare and advanced communications procedures; satellite theory; the use of satellite radios such as the AN/PSC-5C/D, AN/PRC-117G and BGAN antenna and the radios’ modes of operation; Demand Assigned Multiple Access (DAMA), High Performance Wave-Form (HPW) and point-to-point operations; satellite communications links, encryption and decryption; computer technology, including computer systems networking, troubleshooting, assembly and applications (computer applications A+ training and NET+ training); network computers in a LAN and WAN configuration; server/routers setup; and FM, AM, HF, VHF and UHF radio system maintenance. Communications sergeants prepare the communications portion of area studies, brief backs, and operation plans and orders. Other duties and responsibilities of the SF communications sergeant include communications planning such as transmission site selection, signal support in the Special Forces group, MDMP, mission planning, and preparing a signal annex. They can recruit, organize, train, and advise or command indigenous combat forces up to company size.

    https://www.facebook.com/TimKennedyMMA/posts/anyone-know-matthew-livelsberger-aka-matt-berg-an-18z-former-18f-and-18e-alleged/1139468214210975/

    This page – I have no idea whether it’s accurate – has a screenshot of his bio, says that he was an 18E (communications), 18F (intelligence), and 18Z (senior leadership) at different points in time. It also has some comments that the explosives seem unexpected for a Green Beret, so it’s not just me wondering about that:

    I don’t get an 18E using fireworks and fuel as an explosive. There are many different more powerful and easy to manufacture for someone who was an operator

    I think after my first deployment I learned enough about HME to start a demolition business. No one with any knowledge of explosives would have used this.


  • You seem to forget that in the first Trump term, he didn’t control all branches of government.

    No, but he controlled enough to do plenty of policy in the direction that he’d been implying, and didn’t.

    “He’s probably not going to do it” is a ridiculous position to take.

    You are entitled to your opinion. I do not agree with it, and feel that I’ve spent enough time looking into the details of his first term to have formed my position on a fair bit of what he’s done. I also think that if you think that it is outrageous for sources that you agree with on other matters – like ProPublica – to say similar things, it might be worth considering whether they might have a reason to say what they are saying.

    I think that the only reason that Trump’s statements are afforded much weight is because other Presidents have generally not engaged in this kind of stuff, certainly not to his degree, have worked to build the credibility of Presidential statements. I would judge Trump in the light of the credibility of his own past claims, which are exceptionally poor.

    The election is over, and Trump is going to take office, so at this point, politicking isn’t going to affect that. In four years, we can revisit this and look back at predictions and see whether this time around the US has become a dictatorship or whatever. My prediction is that Trump Term Two will look a very great deal like Trump Term One, with the same flood of outrageous statements and same plain Jane policy.


  • I don’t expect him to. We already had one Trump term. It was filled with him making numerous over-the-top claims as political theater to score points and media time, and then not doing them.

    His signature item was The Wall, which he led supporters to believe would span the southern border. This isn’t even a new one – Bush Jr played this one (in a somewhat-less-over-the-top fashion) with the Secure Fence Act. Trump changed the wording to “Wall” and recycled it.

    His second-most prominent item was “tear up NAFTA”. This one I was ready for, because I’d seen Ron Paul – who has a bunch of constituents who have had people who don’t like NAFTA sell them on the idea that NAFTA needs to go away – give an extended speech about how NAFTA is terrible. What said constituents did not pick up on was his quieter comments saying that NAFTA was bad…because it wasn’t “free enough” – i.e. that Paul was advocating for fewer barriers to trade. Trump had, in several of his first speeches, say that NAFTA was a terrible deal and that we’d only keep it if he could negotiate a much better one. I went out and looked at the Trump whitepaper on NAFTA. Long on giving the impression of dramatic change – all caps letters on the front, very short on concrete specifics. Sure enough, The Trump administration slightly liberalized it, gave one notable-but-limited handout to swing states in slightly increasing the percentage of domestically-manufactured parts required in an American car, renamed the thing “USMCA” so that “NAFTA” was gone, and proceeded onwards. Trump did not do what he was working hard to give voters the impression that he was doing, engage in major protectionist policy.

    He worked heavily to give the impression that he had killed TPP and TTIP. Negotiations for these FTAs had failed prior to him entering office, but he made an enormous deal out of directing that they be canceled.

    Point is that what Trump’s first term consisted of was an overwhelming flood of political theater designed to appeal to low-information voters who have some really bad ideas about policy to convince them that that policy was being enacted while doing nothing of the sort. While I am not at all happy about this, think that instead of misleading and pandering to them, I’d like to see democracies explain why a policy makes sense, it beats actually doing them.

    I saw Bill Kristol, a conservative commentator who deeply dislikes Trump, call it correctly in the first days of the first Trump term, called it “misdirection”. Trump can’t control what the media prints. But what he can do is put stuff out there that is so irresistible for the media to cover that they only talk about that instead of the actual policy, and as a result, actual policy doesn’t actually get eyeball time and criticism. True, to accomplish that, he had to make what he is saying pretty outrageous, enough to get undiverted attention from the media. But he’s calculated that being able to influence media coverage is worth it.

    Steve Bannon had some infamous quote on the point:

    The Democrats don’t matter. The real opposition is the media. And the way to deal with them is to flood the zone with shit.

    The Trump model is to engage in constant outrageous political theater such that he has freedom of action on policy, keeps the media out of it. His statements and promises are often self-inconsistent, misleading, and often outrageous. His actual policy is pretty boring mainstream Republican stuff, though.

    I think that there are a lot of problems with this approach. It validates voters who are pushing for said policies, might encourage them or normalize those positions. I think that it erodes the trust placed in Presidential statements, which I think may be important at various times. It’s not the vision I have for democracy – I’d like to inform voters rather than lie to them.

    But one thing it doesn’t do is actually enact said promises.