lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 15 Apr 2019 10:04:00 +0200
From:   "Enrico Weigelt, metux IT consult" <lkml@...ux.net>
To:     Nick Crews <ncrews@...omium.org>, enric.balletbo@...labora.com,
        bleung@...omium.org
Cc:     linux-kernel@...r.kernel.org, dlaurie@...omium.org,
        derat@...gle.com, groeck@...gle.com, dtor@...gle.com,
        sjg@...omium.org, bartfab@...omium.org, lamzin@...gle.com,
        jchwong@...gle.com
Subject: Re: [PATCH] platform/chrome: wilco_ec: Add telemetry data char device
 interface

On 13.04.19 00:45, Nick Crews wrote:
> The Wilco Embedded Controller is able to send telemetry data
> which is useful for enterprise applications. 

What kind of "enterprise applications" exactly ?

> A daemon running on
> the OS sends a command to the EC via write() to char device,
> and can read the response with a read() request.
> Both the request and the response are in an opaque
> binary format so that information which is proprietary to the
> enterprise service provider is secure.

In other words: a direct backdoor for the "provider", who can do
anything he wants remotely on the user's machine, w/o the user having
a chance of seeing what's actually going on ?

Seriously ?!

In some of your previous mails (*1) you indicate that it sends some
diagnostics information (eg. "dock is not working"). WTH does that
have to be "proprietary", IOW: encrypted = kept secret from the owner ?

If I *own* such a device, this is some information, I *need* to know,
I *deserve* to know, and it is *my* data, as it's a state of *my*
device. And that's some kind of information that *nobody* else has
any business with that. Period.

Seems you folks (Google) still didn't learn the fundamental difference
between ownership and just a license to use. And the recent multi
billion fines against Google still haven't been enough, so I'm looking
forward Mrs. Vestager's next strikes.


I'd like to remind you of the famous words of JR. Oppenheimer:
""Now I am become Death, the destroyer of worlds."
(quoted from the Bhagavad Gita, when he recognized the desatreous
consequences of his work)


--mtx

-- 
Enrico Weigelt, metux IT consult
Free software and Linux embedded engineering
info@...ux.net -- +49-151-27565287

Powered by blists - more mailing lists