• 0 Posts
  • 18 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2023

help-circle


  • They don’t have the votes to pass a law, they do have the votes to stop laws from being passed. Further, the Republicans just killed a rule that allows 30 senators to block all bills by challenging executive decisions. The Republicans killed the rule to roll back a Biden admin decision to allow California stricter emission standards. Every challenge requires a mandatory 10h of debate. There are about 100 years worth of Trump admin decisions Dems can challenge to block the upcoming budget bill.

    Will they do that? Probably not, because they rolled over on the CR when they could have easily filibustered it.

    And yes, Schumer knows about this, he wrote an open letter warning Republicans not kill the rule.

    This is what I hate about the Democrats. They’ll happily roll over, yet I guarantee you the Republicans will abuse the hell out of this rule if a Dem president gets into office.



  • Slow? Not necessarily.

    The main issue with that much memory is the data routing and the physical locality of the memory. Assuming you (somehow) could shrink down the distance from the cache to the registers and could have a wide enough data line/request lines you can have data from such a cache in ~4 cycles (assuming L1 and a hit).

    What slows down memory for L2 is the wider address space and slower residence checks. L3 gets a bit slower because of even wider address spaces but also it has to deal with concurrency issues since it’s shared among cores. It also ends up being slower because it physically has to be further away from the cores due to it’s size.

    If you ever look at a CPU die, you’ll see that L1 caches are generally tiny and embedded right into the center of the processor. L2 tends to be bolted onto the sides of the physical cores. And L3 tends to be the largest amount of silicon real estate on a CPU package. This is all what contributes to the increasing fetch performance for each layer along with the fact that you have to check the closest layers first (An L3 hit, for example, means that the CPU checked L1 and L2 and failed at both which takes time. So L3 access will always be at least the L1 + L2 times).




  • Just reread it and no, it’s not a BT vulnerability. The “erase flash” command is something that has to be done by software running outside the BT stack. You can even see that inside the slides. The UsbBluetooth software is connected to the device with the flawed bluetooth chipset.

    The vulnerability is that if you have this chipset and compromised software, someone can flash the chipset with compromised flash. They even say that it’s not an easy attack to pull off in the article.

    In general, though, physical access to the device’s USB or UART interface would be far riskier and a more realistic attack scenario.

    In otherwords, the attack is something that can only be pulled off if there’s also a security vulnerability within other parts of the hardware stack.


  • cogman@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    80
    arrow-down
    3
    ·
    4 months ago

    I just re-read the article and yes, you still need physical access.

    The exploit is one that bypasses OS protections to writing to the firmware. In otherwords, you need to get the device to run a malicious piece of code or exploit a vulnerability in already running code that also interacts with the bluetooth stack.

    The exploit, explicitly, is not one that can be carried out with a drive-by Bluetooth connection. You also need faulty software running on the device.



  • cogman@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    34
    arrow-down
    1
    ·
    4 months ago

    Security wise, unless you are being specifically targeted by someone, you are almost certainly fine. And if you are being specifically targeted, I think someone hacking your ESPs is the least of your worries. A malicious attacker that knows your physical location can do a lot more scary things than just spying through ESPs.


  • cogman@lemmy.worldtoTechnology@lemmy.world*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    181
    arrow-down
    16
    ·
    4 months ago

    You’re fine. This isn’t something that can be exploited over wifi. You literally need physical access to the device to exploit it as it’s commands over USB that allow flashing the chip.

    This is a security firm making everything sound scary because they want you to buy their testing device.


  • The amount of power AI and Crypto require is orders of magnitude the amount of power required by pretty much any regular application. The company I work at uses somewhere around 2000 CPU cores worth of compute at AWS (and we have ~100 microservices. We are a fairly complex org that way).

    Generally speaking, an 80CPU core system takes up ~200W worth of power. That means my companies entire fleet operating eats about 5kW of power when running full bore (it isn’t doing that all the time). My company is not a small company.

    Compare that to what a single nvidia A100 eats up. Those GPUs take up to 400W of power. When doing AI/crypto stuff you are running them as hard as possible (meaning you are eating the full 400W). That means just 12 AI or crypto apps will eat all the same amount of power that my company with 100 different applications eats while running full bore. Now imagine that with the model training of someone like chatgpt which can eat pretty much as many GPUs as you can throw at it.

    To put all of this in perspective. 5kW is roughly what a minisplit system will consume.

    Frankly, I’m way more concerned about my companies travel budget in terms of CO2 emissions than I am our datacenter usage.