Ok, so there are tons of mediawiki installations all over the internet. What do these operators do? Set their wikis to read-only mode, hang tight, and wait for a security patch?
There is nothing to do, the incident was not caused by a vulnerability in mediawiki.
Basically someone who had permissions to alter site js, accidentally added malicious js. The main solution is to be very careful about giving user accounts permission to edit js.
[There are of course other hardening things that maybe should be done based on lessons learned]
There are already tools and techniques to validate served JS is as-intended, and these techniques could be beefed up by adding browser checks. I've been surprised these haven't been widely adopted given the spate of recent JS-poisoning attacks.
Well, admins (or anybody other than the developers / deployment pipeline) having permissions to alter the JS sounds like a significant vulnerability. Maybe it wasn't in the early 2000s, but unencrypted HTTP was also normal then.
That's a fair point, but keep in mind normal admin is not sufficient. For local users (the account in question wasn't local) you need to be an "interface admin", of which there are only 15 on english wikipedia.
The account in question had "staff" rights which gave him basically all rights on all wikis.
> Well, admins (or anybody other than the developers / deployment pipeline) having permissions to alter the JS sounds like a significant vulnerability.
It's a common feature of CMS'es and "tag management systems." Its presence is a massive PITA to developers even _besides_ the security, but PMs _love them_, in my experience.
What surface conditions do you ride this in? I spent this morning on my Specialized Levo (1) and ran down the entire battery over the course of about 2.5 hours, covering 36 km and 1400 meters of elevation, much of the downhill being at "mach chicken", with drops, doubles, locked up dirt surfing, etc. There is 0% probability I would take this long range e-bike to that terrain. Which is fine. But I'm pretty sure your frame wasn't designed to carry this 22 pound battery or anything like it, so are you exclusively riding this on buttery smooth Dutch roads?
> I'm pretty sure your frame wasn't designed to carry this 22 pound battery or anything like it
Presumably bike frames are designed to carry larger riders? 22 pounds is well within the normal range of "adult". Apparently most bike frames are designed for riders up to 120kg - so the OP could easily be 40+kg below that.
Bicycle frames are highly optimized to have the loads concentrated at specific points, namely the seat, bottom bracket, and wheels. The lugs are heavy, and the tubes are very thin almost everywhere else. This appears to be putting load at focal points along the thin wall regions. Every time you hit a bump, the battery hits the frame, like hitting the thin wall of a soda can with a hammer.
If there's anything I have learned with age it's that regulations have bizarre unintended consequences. The incentives are too numerous and too precariously balanced to muck with without tipping someone's seesaw right into a volcano.
They built their own mobile core, does that help with resolving your "Big If"? I'm not a cellular guy, I don't know which pieces of the stack cover which attack vectors: I'm genuinely asking.
Do they own the enodeBs or the RAN? How many hops does it take to get to their core? Not sure how MVNO works maybe they have encrypted VLANs to their systems. Not a RAN guy.
We don't own eNodeBs/gNodeBs (the RAN). We operate as an MVNO. It is worth calling out that we operate as a full MVNO though, which is different from many MVNOs in the US currently, who tend to fall on the lighter end of the MVNO spectrum.
The primary difference is we run our own mobile core entirely.
Can you elaborate on the hops question? Not sure I quite understand what you're asking since there are a few ways to interpret "hops".
> They built their own mobile core, does that help with resolving your "Big If"?
Not really, but I too am uncertain about how to think about it.
Here's my long-winded but still limited understanding of the main vulnerabilities that are unique :
NETWORKS: If I build a network, and I build it out of switched Ethernet, and I control the premises completely, then I can generally trust that the data flowing through it isn't being secretly logged or tampered with. Moving away from this simplicity, my distrust of the network increases rapidly.
A cellular network is pretty much the opposite of this simple one-man, one-room, wired network, so I distrust it completely.
There is only one credible solution here: all traffic over the network must be end-to-end encrypted and authenticated. That means TLS/DTLS/QUIC/ESP/Wireguard with key-pinning and/or correctly implemented and maintained PKI. Assume that any and all traffic that is not E2E-encrypted and authenticated is subject to some combination of mass surveillance and/or individually-targeted attacks.
CELLULAR DEVICE HARDWARE: For historical reasons, modern smartphones contain [at least] two CPUs:
1. The main "application" processor, an ARM64 SoC running an OS and applications made by Google or Apple. They've put substantial efforts into hardening these OSes and applications against remote attacks.
Whether they're doing "enough" is another question; whether you should trust them is another question. But they're at least trying pretty hard to prevent rando malware-for-hire attackers from pwning your device via over-the-air vulnerabilities.
2. The "baseband" processor, a ghastly fossilized thing that runs a stack of overly-complex firmware dating back to 2G days, and controls access to the cellular network. It is probably developed by Qualcomm, which along with Samsung has a near-monopoly on baseband processors for modern devices sold outside of China. Qualcomm in particular is litigious and complacent about security issues (https://news.ycombinator.com/item?id=38620067), and almost everything about the processors and their firmware are closed-source and non-public.
The baseband processor is insecure both due to inattention, as well as treachery. The end user of the device does NOT control it in the way that the end user controls the main processor. Some nebulous combination of the baseband vendor, the carrier, and the government controls it (e.g. https://news.ycombinator.com/item?id=46848303).
So the baseband processor is an untrustworthy thing that should be walled off from the rest of the system, and only allowed to communicate with the rest of it via narrow and well-defined interfaces. However, this was not the case for many years: the baseband processor has had way too much access to the system.
In recent years, this situation has improved somewhat: recent Pixel devices with Google Tensor SoCs (and maybe others) have the baseband isolated via an IOMMU. https://grapheneos.org/faq#baseband-isolation
---
Okay, so can "Cape" do anything to assuage my concerns about _any_ of the above issues? Honestly, not very much. ¯\_(ツ)_/¯
Cape can't increase my trust in the cellular network. Cape can't increase my trust in the baseband processor on my device.
Cape can only do a couple things to make the baseband and the network Slightly Less Evil: shuffle IMSI frequently to prevent IMSI-based tracking, and don't let random scammers call up and SIM-swap me.
Came here with a similar comment, pasting here to avoid another top-level comment tree.
====
I bought a mac mini a year ago for $599. Personally, I'm pretty sure I would pay another $50 if it said "Made in the USA" on it. Maybe $80. Not sure I would pay $100.
But I worry this will prove to be like when Daimler bought Chrysler and shipped the Crossfire fully assembled except the rims, which were bolted on in the US so they could say it was "made in the USA". They only sold 76,014 and now Daimler extracted itself from Chrysler, so maintaining them has become a bespoke hobby.
Crossfire was an interesting car - looked at them for a bit, but needed a 4-door..
If I was in the apple ecosystem (I prefer PCs with Linux, Android), I would pay $100-200 more for a mac mini made in the USA if there were actual benefits, like most of the additional cost went to paying domestic labor, better parts availability, better repairability, etc.
Well, um.. Forgive me for not being in the market for a showerhead in the last few years and / or not knowing about this one company that I didn't see at Home Depot/Lowes when I did buy a couple of them?
I admit I'm probably an outlier, but in terms of durable goods, I'd pay 30-50% more for lots of things if they were "made in the USA" or "made in Canada" (any western country) and it meant something - like, better parts availability, repairability, documentation, support, etc. Not all of them, but something - AND, it was paying domestic imports / reducing imports.
I'm not living paycheck to paycheck, but I'm not wealthy.
I haven't heard of the brand either, they just happened to actually run the experiment. I think you'd just have to pretend that both options are presented in a hardware store next to each other: identical product, company, warranty, support phone number, etc. Are we really buying the more expensive one just because it's made in USA or will we just say that we will do that and act in our own best interests by saving our money?
> and it meant something - like, better parts availability, repairability, documentation, support, etc.
But remember, this bit isn't related to the country that assembled the product, it has much more to do with the company and brand doing the post-sales support, marketing, and the rest of the customer-facing stuff. The Mac mini isn't getting a better post-sale experience just because it's going to be assembled in Houston. The product and company are identical.
Finally, I think it may be worth recognizing that there's a growing perception that Chinese products are the best ones, just like how people felt about many American products built in the post-WW2 era. I would subscribe to this perception that Chinese products are more likely to be good than products made in many other countries. They just have the ecosystem and the most expansive, skilled high volume manufacturing on the planet.
You’re not alone. I’m a self-funded startup founder and I still buy Made in USA goods (clothes, appliances, tools, supplies, equipment, etc). For me the price isn’t the main factor, it’s simply that I want to support the countries I like. Been doing this for 10 years now. Based in London so I also buy Made in England things too. Never ever support authoritarian regimes!
For anything more complex than a shower head, a made in USA label often implies some trickery with final assembly of imported components, like the crossfire example above. Researching the supply chain for every single purchase is too tedious and exhausting for many of us otherwise willing to vote with our wallets.
> The OP didn't really frame how this question came up.
Hey, OP here. Valid. It's a pre-seed, pre-revenue start-up going through the motions to get the company on the right footing ahead of seeking funding. We have a company Workspace domain, but one of our advisors is a grizzled old CFO and did not enjoy seeing one his formulas borked by a difference in how Excel and Sheets handles xlookup().
You're welcome to not read, but as someone who grew up in a certain era, it's pretty cool to see the old things. The webpage he's serving reminds me of all sorts of early internet things, where the knowledge was real and we were just pushing it onto this new thing. The actual site: https://sparc.rup12.net/ has a vibe similar to https://johnlind.tripod.com/, which is incredible. The knowledge is timeless.
> Best viewed with Netscape Navigator 4.0 or higher
reply