Sal

3

And in that world, doing a private disclosure made a lot of sense because you did a lot of hard work to find it, and it wasn’t easy for somebody to replicate. This was valuable and dangerous knowledge that had to be communicated in a responsible fashion.

Private disclosure still makes sense to me when you add LLMs into the mix. It is possible that an LLM outputs some plausible-sounding story that over-estimates the actual risk and impact of the exploit. If this story is publicly announced to people who use the software but are not capable of assessing these risks themselves, this can easily have a negative unnecessary consequence - for example, people may bring their server down until an expert or developer provides an assessment or fix.

This is a source of noise, and I don't agree that this is better than private disclosure. Via public disclosure one is applying a lot of pressure to the developer(s) to prioritize whatever is being disclosed, which may not always be the nicest thing to do, especially if the impact is not as significant as the LLM suggests. This may not have been what happened in your case (I don't know the details), but I am thinking about the idea of the average person disclosing publicly LLM-discovered vulnerabilities.

Salamander @mander.xyz 3w ago

All volunteer efforts are welcome, and using AI tools to support volunteer work is completely reasonable to me.

I personally value well-crafted human-made art more highly than AI-generated art. If someone wants to invest the time to create original icons and donate them, I am always very happy to see that!

That said, requiring unpaid contributors to meet a craftsmanship standard before they are allowed to help does not seem constructive to me. Volunteer communities usually work best when people contribute with the time, skills, and tools they actually have available.

A middle-ground alternative to AI-generated work is searching through Creative Commons assets, but even that still takes time to source, filter, adapt, and integrate. Expecting volunteers to always provide fully custom artwork or spend significant additional time curating assets does not seem like a fair expectation to me.

1

Salamander @mander.xyz 3w ago

Here is the homepage, and that is not what it says: https://meshtastic.org/

3

Salamander @mander.xyz 3w ago

I promise you I am not lying to you. I may be mis-understanding you.

Here is the source code for Meshtastic firmware: https://github.com/meshtastic/firmware

But I am assume that we have a different understanding of what is and what isn't open source.

9

Salamander @mander.xyz 3w ago

Don't worry, I wouldn't ban you for this.

Yes, the physical modulation implemented by LoRa transceivers is proprietary.

It is not entirely correct to say that the "mesh" itself is proprietary. Meshtastic is open source, even if it relies on proprietary radio hardware. In principle, one could take the Meshtastic codebase and adapt it to a different physical layer.

It is perfectly reasonable to reject a technology because the full stack is not open. That said, once you look closely at most modern digital and RF hardware, you are extremely likely to encounter proprietary ICs, firmware, or physical layer implementations somewhere in the stack.

1

Salamander @mander.xyz 4w ago

I'm not familiar with Canadian suppliers, sorry. I have bought directly from them in the past, but I'm not sure about shipping to Canada.

3

Salamander @mander.xyz 1mo ago

Yes, you have many options. It depends on how much "from scratch" you want to go.

The simplest method is to purchase a module with the radio transceiver + microcontroller, flash it, and assemble it. If you don't want any sensors, you can for example purchase from RAK the kit a kit with a 'RAK19003' base board + 'RAK4631' module (nRF52840 micro-controller + SX1262 transciever) . For Canada, you would pick the 900 MHz version that operates in the 915 MHz band. (https://store.rakwireless.com/products/wisblock-meshtastic-starter-kit?variant=43884035113158)

For an enclosure, you can look up 'Project box' or 3D print a case.

If you want to go even more "from scratch", you can buy a module without a micro-controller (Waveshare core1262, Ra-01SH, Wio-SX1262), and interface with these using a micro-controller via SPI. At this layer it starts to become more of a hassle if you want to implement Meshtastic, because you will need to either copy an existing configuration, or modify the firmware so that it matches the way that your electronics are connected.

Then, if you do not want to purchase a module, you would buy the transciever directly (for example, the SX1262), and assemble your own module. You can look up the schematic of the basic modules to get an idea of what this looks like. For example, you can see the Waveshare Core1262 schematic here: https://files.waveshare.com/upload/c/c1/CoreSX1262_Sch.pdf

If you do not want to rely on an already existing LoRa transciever, but instead use a more general radio transciever, that is also possible. But, more expensive, and is unlikely to match performance. This is something that one might want to do if you already have an SDR transciever connected to raspberry pi and want to use it to interface with LoRa (still, it is much easier to connect a LoRa device over USB). I would not recommend building a meshtastic device from more general transcievers.

Salamander @mander.xyz 1mo ago

About the immortality of the crab

Salamander @mander.xyz 4mo ago

Since my work involves sensors, I set up a continuous testing setup on a raspberry pi and got its IP whitelisted. I ssh into it when something is annoying to do in the Windows laptop.

Salamander @mander.xyz 4mo ago

I'm surviving, and definetly not the fittest.

Salamander @mander.xyz 4mo ago

I think that the TinyTapeout concept is super cool (https://tinytapeout.com/). In the past, it was not really feasible to design and manufacture a semiconductor device as a hobbyist... Unless maybe an extremely wealthy one.

Now, we have open source design tools, open process design kit, and the ability but small part of a manufactured wafer.

There are also now multi-project wafer runs for photonic chips at reasonable prices for startup/academia. I think these developments are pretty cool.

Salamander @mander.xyz 4mo ago

Thanks a lot for the examples! I have been looking through these, and, as far as I can tell:

In SSL stripping, the site would appear to your client as HTTP, not HTTPS. If that's the case, I think SSL stripping is blocked when using 'HTTPS-Only' mode
For DNS spoofing, the visited site would show up as insecure because they would not be able to generate a valid certificate for the target website

I still have not had the chance to look into leaky metadata. But, generally, I think metadata issues can in part be addressed by not generating much metadata.

Probably the biggest vulnerability is the captive portal. There is no way to verify you’re connecting to an official Starbucks router. I think that when connecting to a public router it is wise to assume that it is malicious.

2

Salamander @mander.xyz 4mo ago

I'm curious about an example that comes to your mind as you say this. In your view, what is a privacy risk associated with public WiFi use that is not easily mitigated?

Salamander @mander.xyz 7mo ago

By hand. We are only two people, and we usually clean after we cook/eat. When one is cleaning only 2 plates + a pot/pan at a time, it is easy to use little water. Spray of soap, metal scrub, sponge scrub, and then turn the tap on to rinse for a few seconds. Utensils get individually scrubbed and then all rinsed together for a few seconds.

Maybe when we have kids a dish washer will make sense.

4

Salamander @mander.xyz 7mo ago

AGUCUAGCAUAC

Salamander @mander.xyz 7mo ago

I have been happy with my Garmin. It is functional without having to connect to anything, and data can be easily exported to a computer for more advanced processing. It is a handy GPS receiver that lets me monitor heart rate and log running metrics.