Hacker Newsnew | past | comments | ask | show | jobs | submit | trustingtrust's commentslogin

>Hardware security very often relies on “security through obscurity”, and it is much more difficult to reverse-engineer than software, but this is a flawed approach, because sooner or later, all secrets are revealed.

The later works when you are not as big as Apple. When you are as big as Apple, you are a very hot target for attackers. There is always the effort vs reward when it comes to exploiting vulnerabilities. The amount of effort that goes into all this is worth thousands of dollars even if someone is doing it just for research. If I was doing this for some random aliexpress board it would be worth nothing and probably security by obscurity would mean no one really cares and the later part works here. But I wonder what Apple is thinking when they use obscurity cause people must start working on exploiting new hardware from day 1. You literally can get one on every corner in a city these days. Hardware Security by obscurity for example would be fine for cards sold by someone like nvidia to only some cloud customers and those are then assumed obsolete in a few years so even if someone gets those on eBay the reward is very low. iPhones on the other hand are a very consumer device and people hang on to their devices for very long.


I restarted my phone because I thought my network was down blindly believing HN can never be down. Then I opened another website and realised this is one of those times that the website was actually down.


Same but even after seeing another site was working I still wondered if it was my Pi Hole / DNS cache acting up or something.


It was down for a while last week too...


A lot of 4G modems connected via pcie still are USB interfaces internally. So the usb 2.0 limits on these are still there (though that is not much of a problem in general as 4G speeds are low). With 5G if you connect to a usb3 port for tethering I wonder if the speeds are above the usb2 limits or if this driver is still limited to usb2. Because with 5G modems, most of the devices that use it as a backup likely use pcie speeds. Would be a waste to use usb2 speeds


Almost nobody cares about saving batteries. Those are replaceable and cheap to replace every couple of years.

Innovating more battery life and leaving 20% battery life on the table sounds extremely pointless for what costs 20-30$ a year but lets you use the device all day instead of just shutting before the end of the day.


I'm an "almost nobody". I care about saving batteries. I get all the dead disposable vapes my friends will give me so I can recycle the batteries in them. Lithium is a limited resource and one day we're not going to have more to dig up out of the ground. There are others like me out there, I just need to find them.


Lithium is not a limited resource in the same way that Iron or Coal or Silicon are not limited. There is so much of it that we really cannot run out.

Cobalt, Neodynium and the other rare earth metals, though, those are highly valuable; and the processes to manufacture them are usually toxic. So do it for the rare earth elements, but don't do it for Lithium.


The lithium is not disappearing though.

At some point in the future, we can start mining old landfill.

But yes, it's easier (and more efficient) to recycle before putting them in landfill.


> Those are replaceable and cheap to replace every couple of years.

If you specifically seek out devices with cheap replaceable batteries, sure. But this isn't the case with a lot of devices.


The cost to replace the battery on iPhones, which most people would consider to be “difficult to replace” is only $100 directly from Apple. Really seems like paying an extra $100 every 2-3 years is a decent deal for something that has 20% more battery.


> Really seems like paying an extra $100 every 2-3 years is a decent deal for something that has 20% more battery.

Maybe if you have a lot of money to waste, but people should have the option to choose


They do on modern iPhones? You can pick: 20% less battery life, and your battery likely won't need to be replaced for 5-6 years, or 20% more and you'll get normal battery longevity.

Also, we're talking in the context of a $1000-1200 phone for the base config. 10% of that cost for a replaced battery does not seem outrageous to me.

As someone else pointed out, the cheaper phones Apple sells have correspondingly cheaper battery repair costs.


You seemed to be arguing that no one needs this feature and it doesn’t need to exist. Not everyone buys the latest iPhones straight from Apple, I’m typing this on someone’s old iPhone 7 and it works fine. The battery life isn’t great but maybe if Apple had implemented this feature earlier it would be better. Replacing the battery would probably cost almost as much as the phone if I did it via Apple.


I'm not sure what you're arguing for here? I'm not aware of any phone that offered a charge limiting option (Android included) 7 years ago. And replacement parts for super old phones remain relatively high in comparison to the value of the device. This is just like cars; at some point it isn't worth fixing/repairing it.


I'm just arguing that having the option to limit battery charge is probably a good idea


Does apple reslly replace the battery, or do they transfer your OS to a refurb and give you that? I'm very wary of apple repairs.


Even better - for some models it's $69 from Apple, and around $50 from third-party providers.

Source: I replaced my iPhone battery last week.


Replacing an iPhone battery is cheap, especially compared to replacing the whole phone: at the Apple Store it’s either $99, $69 or $49 and I’ve had other stores do it for like $40. That’s not too bad for a once every couple years cost.


Yeah but then you have to buy an iPhone.

That's not snark. I want things from my phone that an iPhone can't give me.

The battery replacement ecosystem in Android land is pretty dismal.


It depends on your definition of dismal. Any phone repair shop can open phones and replace batteries. There are also disassembly videos for most models on YouTube. I looked at them, ordered parts and replaced the battery on my Samsung A40 when it started to discharge too quickly. I also replaced the camera after a hard crash on the floor broke the autofocus. Maybe not having Samsung shops makes all of that dismal but I actually prefer to have many small independent shops around the country.


Market fragmentation among Androids means that nobody stocks parts for anything and the margins are so low, a lot of shops will only do the brands they want to.

I couldn't find anyone to replace the battery in my Google Nexus phones, every time I tried, in a major metropolitan area. Ended up having to do it myself.

You can walk into nearly any cell phone shop in the world with an iPhone and walk out with a replaced battery because the staff know them and they stock parts for them.


I'm not sure that the problem is fragmentation inside an operating system. It's how widespread some brands are. I never had such problems with any Samsung phone I owned, even a Sony Xperia one years ago. I guess that it means that Apple, Samsung and even Sony (back at the time) are more mainstream than Google and for shops it's not worth to keep spare parts of Google phones. To be fair, the last time I had to replace a screen of a Samsung because it dropped down flat on the screen instead of on a corner, I had to wait one day for the replacement part to arrive to the shop. I put the SIM in the old phone or in my tablet and went back the next day. I'm not replacing the screen myself, it looks to require some extra skills compared to a battery.


It's always cost me around $40 to have an Android battery replaced at a "We repair phones" sort of place. That includes the cost of the battery.


Cheap for the wallet, but not the biosphere. Unless you mean to imply that people would get new phones less frequently?


It’s cheaper for the biosphere than replaceable batteries were, because you just switch out the battery and don’t need the plastic case for the replaceable part.


It's well-established that iPhones have longer average lives than Android phones.


Really? If that is true, I wonder how much is due to the fact that the phones are more expensive so people take care of them more or delay their next purchase. It's not because the actual quality would be better.

If you pull statistics you also have to filter out the sub 150 dollar Andoid phones which may well have shorter average usage life.


> Really? If that is true, I wonder how much is due to the fact that the phones are more expensive so people take care of them more or delay their next purchase.

Even if it were the case, it does not matter. What does matter is the amount of matter that ends up in landfills. As a matter of fact, we should be pushing for better built, longer lasting devices even if it means spending a bit more in the short term.

> It's not because the actual quality would be better.

Second-hand iPhones are all over the place here in a way that Samsung Galaxies are not, even though they are more popular. You can argue that it is not a proof of high quality, but it is at least a proof that build quality is high enough that 4 years old devices are on average in a good enough state to retain a high resale value.

> If you pull statistics you also have to filter out the sub 150 dollar Andoid phones which may well have shorter average usage life.

Which precisely is the problem. “But they were cheap” is a terrible excuse as we keep burning more non-renewable resources and shovel up heaps of electronic waste in landfills. Besides, we need to look at cost per year, not cost per device as a cheap device you have to change often is more costly over the long term. I am not saying only Apple devices can have high build quality, but it seems nobody is pushing OEMs towards that direction in Android-land.


Software support is an important one, and Apple has managed to slow down the RAM baseline inflation that Android seems to experience every other year. Even people who regularly upgrade usually trade in their old phones because they still have enough value to bother, so a lot more phones get used all the way to the end of their support.


> If that is true, I wonder how much is due to the fact that the phones are more expensive so people take care of them more or delay their next purchase.

Delay because it's more expensive? How about delay because it's good enough? My iPhone XS is just fine thank you. There's no point in upgrading it yet.


How is that all that damaging? I’m sure those batteries are recycled in basically all cases and yes, I’d expect battery replacement does indeed forestall replacement for many phones.


The most common processes for recycling lithium ion and lithium polymer batteries are not environmentally friendly. They consume a lot of water and energy and produce toxic byproducts the require further processing and energy to be rendered safe.

https://pubs.acs.org/doi/10.1021/acsenergylett.1c02602


byproducts that require


Let the user choose! Some people tether their phone a lot and use the battery only when out. For them 80% max is OK.


My Oneplus 5T got replaced because it has a small crack in the screen so it's impossible to disassemble without breaking the screen. I used ACC to only charge that to 90% so I could get three years out of the battery instead of just two.

I'll probably get a fairphone next so I don't need to worry about this. But the people with glued-in batteries definitely have to.


most recent phones and laptops have batteries that require advanced tools and chemicals to remove and replace


Laptops also? I didn't realise it had gotten this bad anywhere but in Macbooks.


Pretty much all thin modern laptops, Surface Pros etc use copious amounts of glue for different parts. With the worst offender iirc being the Surface Laptop which can't be opened at all without damaging the keyboard.


I have always felt there has been a learning curve for Go and Rust when it comes to syntax for me. I have used C C++ Java and Python and PHP for a long time but whenever I start Go or Rust, over time I lose interest thinking this is too complicated and difficult for me (no idea why).

Is there anyone in the same boat and are there ideas how I can make myself get good with at least one of these trending languages ?


I found rust very simple to pick up because there's a lot in the language that really helps you to write the code the way rust needs it to be. The language design is really good that way, and the compiler helps a lot. What's tricky is to understand the underlying concepts like it's module structure, ownership, etc.

Writing practical code is harder if you're not used to it because it enforces discipline that a lot of coders in other languages don't care about like the mutability of a variable. For me it just clicked because that's something I always struggled with in other languages and it frustrated me that I wouldn't know how a variable was supposed to be used. The fact that in rust that concept is built into the language makes me excited. If someone doesn't care about that kind of thing then I can see it being very frustrating.

With Golang, I would strongly recommend ignoring all advice. People kept saying it's easy to understand, that it's like python, or that it's like a better C. Forget all that, try to approach it from the ground up as it's own separate thing, dive into what interfaces, slices, etc. actually are. Then write a bunch of practical go code like a webserver, then a lot of go idioms become a lot more obvious. I really feel like there were some lanuage design decisions made where one thing exists because of another feature, so writing some code makes those links obvious as opposed to learning each feature independently.


For me Go is one of the easiest languages to learn (even if there are some low level bits like closing bodies etc.) just because you always know what goes in and comes out of a function.

When doing Ruby after only using Go for years it was (and still is) very tricky for me to deal with error handling and figuring out what kind of object I'm dealing with.


> when it comes to syntax for me

If your issue is that the syntax is too complex then you've got a problem since semantics are usually way more complex to grasp than syntax.


My assumption is that the parent poster uses the word "syntax" for "syntax and semantics". It's a common trend.


Go and Rust have certainly a different learning curve. Go is supposed to be incredibly easy.

Rust's learning curve is waaay steeper than that


First of all don't try to learn both of them at the same time you just add unnecessary anxiety. And as others have said, Go is much easier to learn that Rust, both the syntax and the underlying concepts are simpler. Just go through the Go playground tutorial on the site or try rewriting some of your C/C++/Java code. It is not as good a replacement for most Python and PHP code in my opinion.


I find a good IDE that you are already familiar with from other languages/environments goes a long way. Pick your poison, but for me because I'm already using IntelliJ for Java at work and Android Studio for open source projects, I was able to get into Go relatively easily recently using IntelliJ.

The linter/autocompletion/auto-fix/refactoring/etc made it much simpler to a avoid having to rote-learn the syntax for functions, lambdas, structs, etc. To go with that, the error handling becomes much easier to learn because the editor is able to tell you when you've got the wrong number of return values / wrong type of values.

Yes, the compiler does all of this, but the way it happens in real time using the same keybindings/UI/UX that I use for my day job makes it all that much easier.


Good news! If you’re familiar with Python, Go is at its heart not that different. It has fewer features and the syntax is similar, which makes it easy to learn.

Try the interactive Go Tour, and review the Learn X in Y Minutes page for Go to get familiar with the new features. Then try building a fun toy project in it. Go makes it easy to build web servers, so maybe a REST service is a place you could start.


Funny you say that. As a PHP developer, I found Go to be the easiest to pick up.


Hah, you’re describing almost exactly my feelings the few times I’ve tried to learn Swift…


Not true. I live in India and have traveled to smaller villages in the south and some in the north. People have started to avoid cash altogether because of few reasons. They do have UPI they just don’t like it cause they like cash. There is never any issue with UPI, it’s just an excuse.

Cash creates a problem of giving change that end up dissatisfying the customer or the customer just leaves. Only after UPI people understood this so now they want you to buy it as payments are not a hassle. Rickshaws in cities have lost interest in random hires. I have waited 45 minutes for rickshaws. Everyone is on Uber or Ola cause they will show up and say cancel the request and give me little less money instead. Pretty common. So they don’t have the option to say no to UPI. They try to give you reasons why it’s not working but they just want cash for obvious reasons.

UPI also allows people to have multiple accounts in family to accept payments. This way they can avoid any tax payments as small amounts in small villages are not scrutinised by the income tax department.

UPI has created more and easier transactions. Small village or big town, I’ve never seen a shop without a QR code in the last year or so.


>> There is never any issue with UPI, it’s just an excuse.

When we talk in absolutes like this, it sounds like technology worship.

I am not out here to denounce UPI or to say it is fraught with issues. Acknowledging limitations, edge cases, or the reality of some of the citizens for whom UPi is not the solution goes a long way in ensuring inclusive tech.

I am in the Silicon Valley of India and the monthly salaries I pay to household help are in cash. I would so prefer to switch to digital myself if they had that option. We can't simply deny the reality they live in because we love the new tech or the people that promote it.

The suggestion is to assume that there are people who cannot use UPI and other shiny new tech, and make accommodations for them to lead their lives, rather than push for all digital and exclude some people.


this is a very common chip that’s sold everywhere for as low as 4$ for that entire dongle at retail. If you touch the controller, at full speed it gets crazy hot on this one. The part I struggled with was that I was trying to install openwrt when raspberry pi 4b was new and use this as the wan port as my isp was limited to 40mbps. But the chip got so hot that eventually I gave up after putting on a tiny heatsink because the plastic casing simply offers no heat output. Mine didn’t have this SPI chip on it so both Linux and openwrt (with drivers) worked fine and it showed up as an additional Ethernet port in ip link. The usb cables are so thin I couldn’t leave it just like that cause at any point it would break and it eventually did break I think I don’t know where it is now. I ended up getting a tp link usb adapter eventually but in general usb Ethernet for anything other than just quick management of some console is not recommended if you want to do serious routing in my experience. The tplink one comes with Realtek which is just ‘okay’. Pcie Ethernet intel cards offer cpu offloading. I’m not sure if that can be achieved over usb. Heat is another problem as the casing is the limitation on it which is not a problem on pci cards or motherboards.


A lot of 5G deployments shifted to Nokia after Huawei ban and Nokia also dominates a lot of GPON FTTH deployments for end to end solutions.


Not suprisingly, most people commenting in this thread have no idea about Nokia and what they are doing. They are really big and somehow succesful company, but no one can escape recession.


Agreed. I think just like everyone in this world, they hired aggressively when money and contracts were there and firing now that it's slowed down. Majority of their networking has been from Alcatel Lucent over which they built their own products but I feel good management can take them to the top. They don't make groundbreaking networking products but they do offer solutions people are willing to buy which telecom companies in North America would love to invest in if done right. It's sad they couldn't capitalise on Huawei ban that much.


Depends on your definition of big: https://g.co/kgs/8Zh7NM


They did allow it previously. They no longer do. I wanted to close it because I don’t want people to find me on GPay and make payments or ask to. It’s become inconvenient as I use a different UPI method. Just because a few don’t care doesn’t mean everyone else shouldn’t either. And any privacy policy must include as a good practice to be able to delete the account as well.


Could there be a law affecting this?

Even in the US, while you may be able to delete a financial account, the company is required to keep the records for a number of years (7 maybe?)


I thought so too. I was able to delete a Square Cash account a few years ago when I was in US and they gave the same explanation that we are required by law to maintain records for some time. However, they did delete my account.

I do not believe any such law exists in India for UPI accounts. I do believe however that Google has chosen not to allow deletion of GPay accounts for some reason other than the law.

Also GPay requires location access to work at all. So its not just payment information, it is location information along with payment information.


How do you expect a company to fight fraud without knowing where a transaction happens?

Seems like you have a pet theory and don't want to consider others

https://www.khaitanco.com/sites/default/files/2022-01/Data%2...


I am not saying they shouldn't retain data. I am saying they should allow me to delete the account which they did until some time ago. I checked the laws linked and it doesn't say anywhere you can't delete the account. So for example if I was to delete my account my contacts don't see me on GPay anymore. If google keeps the data of both location and payments on their servers for whatever time it's required (Square did the same) then it's fine as laws required that. But until they don't allow me to delete the account the contacts keep seeing me as active on the app. This is not about privacy of payments it's about not allowing to delete the account which seems a generalised privacy problem of not allowing deletion of accounts.


> But until they don't allow me to delete the account the contacts keep seeing me as active on the app.

So your question is not exactly accurate. Are you expecting Google to reach into other people's accounts or other apps to delete your contact info? If I write your email in a keep note, should they delete my recording of that information?

Has Google tied pay to your general Google account, such that they are not separately managed? i.e. you have to delete your Google account, since there is only one anymore


Can confirm the hardware vendor that I work for does the same. root password is given and customers are asked to change. No one wants to. Heck I would prefer if they disabled root login completely and used keys instead. But thats now it is. Some customers even enable login from web with those passwords. The stupidity is crazy.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: