It could be from a multi-part attack where someone combines an application-level RCE like php2shell, then sends the evil loopback packets to elevate to root.
AFAIK all the backdoors which have been found in some models are only accessible from the LAN side, and if you have an attacker inside the network, it's already too late.
> if you have an attacker inside the network, it's already too late.
It shouldn't be though. Just because my smart lightbulb has an RCE and is isolated on its own VLAN with the router doesn't mean it should be able to attack the router and escalate to access my devices on other VLANs. It should only be able to do damage limited within its own vlan.
> if you have an attacker inside the network, it's already too late.
Disagree, I think it's still a good idea to try to mitigate e.g. root escalations via this bug from devices within your network as well, as they could become compromised at any moment via other means and then promote themselves to root.
We had remote starters and heaters long before the Internet. Local communication ensures someone halfway around the world won't be able to control your car, but apparently it's too difficult (really?) or not invasive enough for their surveillance desires.
Remote starters generally had really poor range. I know, I've owned a few of them over the years. Often you need direct line of sight and have to be somewhat close, usually only slightly better range than the regular fob assuming you installed it right.
It was a terrible experience compared to being able to issue the command from anywhere. I can be in the middle of a shopping mall and start having the car cool down well before I get there, while before I'd practically have to already be on the right floor of the parking garage.
I think it will be annoying in the short term, but the cleanup this causes will be a good thing in the long term (and of course LLMs can also help with fixing bugs, even without source code.)
No it's far beyond average human code, and it's trained in RL environments on synthetic data etc now. The average human can't solve a millenium problem in mathematics but the LLMs are able to now. Anything with a verifiable output can be RLed on to make llms superhuman it seems, and the average human is not as persistent and thorough as e.g. gpt 6.1 sol at checking every edge case and hunting for bugs because that behavior is something that's just trained into the model. Frontier models perform farm above the average human at the categories of tasks they are RLed on like code and math.
> The average human can't solve a millenium problem in mathematics but the LLMs are able to now.
I think comparing the resources they spent at it would be a more apt comparison.
AKA if you tasked 150 mathematics departments to only focus about that problem, and stop doing things like teaching and researching anything else, you might get close to the amount of resources that these companies put into solving the problem to get a press release.
I've seen both of those (and others besides). I don't know how much code you've looked at but your negative directly contradicts my experience. Review that code. All of it. Be super critical because it looks good but that doesn't mean it is good. Those are two entirely different things.
Also: most tests are positive tests. Tests rarely observe the negative space: that which is there but shouldn't be there.
They definitely write off by one errors. One of the first serious work tasks I used AI for a few months ago immediately had an off by one error.
What they are really good at is writing boilerplate and reading API documentation / example code. Avoiding subtle errors is not what they're good at in my experience.
I have not checked the details recently, but it should still be possible to get an aftermarket "dumb TV" generic controller board to fit the panel, as LCD panels have a somewhat standardised controller-panel interface.
In case anyone was wondering, the -48V was chosen to reduce electrolytic corrosion and is the approximate voltage of a 24S lead acid battery. Later, PoE inherited this voltage standard.
The important part about corrosion protection is that the voltage is negative with respect to the ground. The absolute voltage is more for distance, and low enough to be safe. Nice read for those who are interested: https://pe2bz.philpem.me.uk/Comm/-%20Telephone/Info-901-Tele...
The system is so robust that for a long time in remote locations there was only one wire, with the return line simply being the top wire of a barbed-wire fence. Couple that with a party line and you could service a lot of remote customers for a very low cap ex.
reply