WYGIWYG

  • 0 Posts
  • 11 Comments
Joined 2 years ago
cake
Cake day: September 24th, 2024

help-circle




  • The protocol is reasonably private. Trying to find exact sources of a piece of traffic is about as hard as it can be. Reading the contents of the traffic is also at a very high bar.

    The downside is, it still needs visible nodes to connect to, and the VAST majority of us only actually have access to TCP routed networks for that purpose. The only way you’re talking to that reticulum node in Norway from California is because BGP is delivering your crypto stream for you.

    If you have a small neighborhood and you’re all like-minded, you could use reticulum over HaLow or LoRa network adapters to create a private, IP-less mesh and it could go as far as you can find more people willing to run the hardware. HaLow has enough bandwidth to stream video, LoRa is mostly only good for text. Of course, If someone is doing something like video, it won’t take much to saturate everyone’s connection. It’s not like someone could run a Plex server and everyone could be watching it in the neighborhood at the same time; that 30MBPS can only handle a couple of decent-quality streams.






  • The updated post contains the full story, and it goes as follows: Back in February, when AMD asked Paul to bring down the blog post temporarily, the company said it would issue a standard CVE, fix the software, and attribute the findings to him, though a bounty payment was out of the question. Paul agreed (a decision he now regrets), though he asked what kind of timeline AMD would follow, suggesting the industry-standard 90-day window until he posted the public disclosure again.

    AMD replied saying that it would “likely need a longer embargo, as additional tools beyond Ryzen Master appear[ed] to be impacted and [would] need releases.” That was an interesting statement in several ways: first, it raises the question exactly why AMD would need so long to publish what was seemingly a one-character fix, replacing “http” with “https” in the code. Second, if the issue was bad enough to require so long to solve, then arguably Paul’s work would merit some recompense. Third, as Paul pointed out, if this issue looked this pressing, why didn’t it have a higher priority?

    Nevertheless, he ended up agreeing on a 100-day window, and asked AMD the equivalent of “wassup?” before the clock ticked its last tock, only to be asked for extra time again, being told that “multiple tools are affected by [the bug]”, and that “[AMD’s] customers request additional time once [the fixes] are made available.” Eventually, AMD reached out stating that a fix would be ready on June 9, totaling 124 days after the initial finding.

    “the company said it would issue a standard CVE, fix the software, and attribute the findings to him, though a bounty payment was out of the question.”

    Nah, they should pay him…