I don’t get these arguments. These tools aren’t weapons, and limiting legal access to pentesting tools will decrease corp’s and individuals’ ability to be proactive about security.

These devices can be manufactured relatively easily and making them illegal will essentially mean the only people doing security tests are criminals. Large tech companies, correctly, run bug bounties where independent security researchers can make income by reporting reproducible and exploitable bugs. The concept here is called offensive security and it’s extremely important for building better and more secure platforms. This situation will never be improved by limiting legal access to useful testing tools.

The responsibility should be on automakers and other companies that have massively insecure products, not on open source developers who are making products for security researchers.

Well that’s actually exactly what I’d expect

It seems like maybe the problem is that automakers were able to widely market vehicles that use wireless protocols that are relatively easy targets for attack. This was never properly secure.

Automakers should absolutely be held to higher standards (in general) than they are, and it’s not likely that banning specific devices is going to have any measurable outcome here. It’s pretty well known that people buy and sell malware, and people can just… make devices similar to a Flipper with cheaply and readily available hardware.

This is just dumb posturing to avoid holding automakers and tech companies accountable for yet another dumb, poorly thought out, design feature.

And obviously it doesn’t stop at cars. It seems pretty clear that snooping on any feature using RFID or NFC tech is only going to become more widespread. Novel idea: what about using… actual keys as the primary method of granting physical access? Lock picking is obviously possible but a properly laid out disc-detainer lock is pretty goddamn hard to bypass even with the proper tools, and that skill can’t just be acquired in the same way as with electronic methods of bypass.

deleted by creator

So this was the exact thing that pushed me over to the FOSS side the last time they did it. Nice to see the tradition of annoying users to the point of them abandoning Microsoft is alive and well.

deleted by creator

deleted by creator

deleted by creator

I set up 2FA via a hardware security key (a yubikey) for login, sudo etc. I then tried to switch security keys, removing the old pam files and adding a new one. But I didn’t tidy the pam files up before logging in, and there was effectively no way to log in, since editing the pam files required sudo access to edit in the first place. So basically the whole system required access to a pluggable authentication module that it no longer had any ability to recognize. It was honestly pretty funny. I did manage to recover my data by booting from a live system and decrypting my drive from there.

I’ve also accidentally removed my desktop environment twice while trying to update Python versions and then cleaning up old packages, but that’s kinda not that big deal and is just a facepalm moment.