Hacker News Reader

Agreed. This comes off as self-absorbed and entitled - 'how dare the security team not recognize my ascended morality and technical genius! Suppose an evil hacker does plan to disrupt the event - the only thing that stops a bad guy with a Flipper Zero is a good guy with a Raspberry Pi running wireshark!'

Adafruit is headquartered in New York and selling raspberry pi is a big part of their business. Reading this as self absorbed or entitled is disingenuous. They're worried about their business & asking why these brand names are singled out is a legitimate question.

You know, dynamite is a brand name. Sometimes for security's sake it's easier to call something what everybody calls it.

Small-scale user programmable portable radios does not convey what Flipper Zero does.

If the intent is to ban that entire category, then that should be explicit for clarity 's sake.

Literally not a single prospective RPi customer would have even known Mamdani banned them from his inauguration party if Adafruit hadn't gone out of their way to point it out. And literally not a single one of those prospective customers would have cared, similarly to how nobody cares that "strollers" are also banned.

This is the stupidest thing to get mock-offended by.

Political Theater

>There's no legitimate purpose in bringing any of those to a high-profile political event.

I've carried a flipper zero with me to use as a copy of my key when I misplaced my original.

What key?

All modern automotive and smart apartment keys can't be cloned that way. You can't do simple replay attacks.

Are you talking about some cheap office RFID badge or something?

Because if you have any important keys for things you own that can be cloned with a Flipper, you should be upgrading them to prevent that.

My modern apartment uses RFID keys to get in the front door. I use my flipper as a backup for when I misplace my keys

Oof. Sorry it's so insecure.

Anyways, I'm sure you can understand why a political event, where many of them do rely on RFID access badges for certain personnel to enter certain areas, would not want someone with a device that can clone badges.

If you go to a political event like that... just take your actual key. Not a device that spoofs your actual key. What you're proposing is essentially saying you have a legitimate reason for carrying around a lockpicking set, because you use it to enter your apartment when you forget your keys. It's pretty understandable there are high-security places that won't let you in.

Did your landlord buy their locks on sale from Aliexpress? Major lock manufacturers switched to encrypted credentials 20 years ago.

"There is no legitimate purpose in misplacing one's original keys."

There's no legitimate purpose in bringing crayons and a coloring book, or a box of paperclips, either.

We should probably see to it that nobody brings any of those things in, as well.

This isn't an exercise in cataloging all worldly items. The criteria for the list is very obviously:

[no legitimate purpose] + [identified as a potential threat or disturbance vector] + [described in a way useful for laypeople who will be consuming said list]

The fact that these items were thought to satisfy your item number two, while more dangerous items did not, indicates that someone's feeding bad information to security, or alternatively, that was not the criteria. There is also some indication of Mr. Robot style fantasies about the power of individual computers.

What do you think is missing?

If there was a legitimate purpose for banning SBCs (there is not), then all computers with wifi would have to be banned. The external fact is that raspis are not a security risk. The internal contradiction is that raspis are computers. It's their whole selling point - they're ordinary PCs.

Also need to ban any Android phone models which can unlock the bootloader.

I don't think you understand the threat profile of a large public event. The typical threat to events like this are idiots who mimic crap they see on YouTube. Public safety isn't an exercise in evaluating every theoretical threat, because that list is too long to address with limited resources. It is an exercise in evaluating which threats are most commonly to be exploited, and the easiest to protect against. This is how you most effectively protect an event with limited resources. It is different than the theoretical threat evaluation that someone doing computer science might think about.

Raspberry pis are not a "likely threat," because they are not a threat. It's hard to get away from that fact when evaluating the absurdity of the ban.

Idiots running script-kiddy exploits on any device is a threat. The list says "Raspberry Pi" because of the utility in communication to the parties reading the list, not because it is technically accurate.

Cops are going to turn you away from this event if you carry in something that looks like circuit boards and wires.

A raspberry pi is a computer. It had HDMI ports on the back. You can put one in a box. Come on, man.

And? There’s a lot of things that people could theoretically do. The few seconds that someone is going through event security isn’t going to stop a competent attacker, nor is it reasonable to expect them to be able to do that.

The point is to stop the most common attackers who are sloppy idiots.

No incompetent person could feasibly use a Raspberry Pi to do any harm, and I invite you to find any examples to the contrary. It is easier to abuse a phone.

This is the point.

It is solving for the wrong problem. An idiot with a Pi or Flipper Zero isn’t the actual threat any more than Star Simpson was.

And if you don’t agree the stupidity that Star was put through was absurd, then we simply won’t agree on the matter.

There’s a difference between security/intelligence and theater. Too many people mistake the two, because they’ve been trained by folks like the TSA to mistake theater for security/intelligence.

You are all spot on with in terms of a technical information security evaluation here.

Unfortunately, the reality is there are not enough information security specialists in the world to hire them as event security for every large public event. And even if there were, the logistics of such an event would not allow for enough time for a proper information security screening.

What you're asking for is not theoretically wrong, it's just impossible to implement.

I agree.

My argument isn’t that every event can and should build an intelligence apparatus. That would be impossible, though it would actually provide security. I agree.

My argument is that banning flipper zeros does not do anything to improve security, even if they wish it did. If they actually cared about security, it would cost them a lot more time and money. Instead, they’ve chosen theater. I don’t even have a problem with this necessarily, if it makes some people feel safer; I have a problem with anyone pretending it is security, and not theater.

When someone is given a placebo during a clinical trial, they are informed and unblinded after the trial so that they do not think they were on the actual medication; this is because otherwise, they would draw the wrong conclusion from the trial for themselves.

This is theater; that’s okay, maybe, but let’s not pretend it’s something it isn’t.

Anyway, I think we’re repeating ourselves, and I’m happy to agree to disagree.

You're really missing the forest for the trees here. It's arguable which one has more theoretical exploits. This is an issue of practicality. Phones are allowed because it's normal for everyone to have one in their pocket and impractical to ban them.

With respect (I mean that in earnest), I think you may be the one missing the forest for the trees.

Nobody is arguing we should ban phones. The argument is that banning flipper zeros doesn’t accomplish anything meaningful toward security.

Yeah, they are probably a disturbance at best. Like pets, large signs, beach balls, and alcohol alcoholic beverages, which are other things on the list.

"security" is a lot more broad than just "preventing terrorist attacks"

You don't need to be a super l33et h4x0r to disrupt an event -- you could knock around a beach ball or turn off a display with the IR blaster on a flipper zero. Not everything is life or death.

What’s more likely? That they were banned due to misunderstandings of what these devices are, or that they were banned they are “causing a disturbance”? Can you find an example of such a case? I’m not sure why this feels so important to defend.

There are several definitions of security, but the most relevant (in this context) are:

1. the state of being protected against or safe from danger or threat.

2. the safety of a state or organization against criminal activity such as terrorism, theft, or espionage.

3. procedures followed or measures taken to ensure the safety of a state or organization.

I fail to see how these devices fall into those definitions. I also don’t see how beach balls do either.

So if your argument is changing to: it isn’t security, but rather preventing people from getting in each other’s way (large signs, strollers, beach balls) I once again don’t see how that applies.

I agree those items have nothing to do with security either.

I'm not changing anything -- my root comment in this thread specifically mentioned "disturbances". Mitigating disturbances to the proceedings of an event is plainly a part of event security. The "threats" evaluated in event security are not solely to life and limb but also to the proceedings of the event itself. I didn't think this required elaboration; I thought most people would be familiar with this function of event security.

It is obvious how a beach ball could’ve a disturbance. What precisely can I do with a pi that would cause a disturbance?

Any of the same infrared or RF shenanigans that are done with a flipper zero, and potentially mess with the equipment of organizers or media.

So… basically cloning somebody’s keycard without them knowing could cause a disturbance… ok.

LF keycards aren’t very common today.

Idiots runnings script kiddie exploits on their Android phone is also a threat. And?

Absolutely. The difference is that phones are in everyone's pocket.

Again, public safety has nothing to do with the elimination of risk. It is a practical exercise in the mitigation of risk.

> Again, public safety has nothing to do with the elimination of risk. It is a practical exercise in the mitigation of risk.

Sometimes. Sometimes, it is theatre.

> There's no legitimate purpose in bringing crayons and a coloring book, or a box of paperclips, either.

Do you genuinely think that a parent with a small child does not have a legitimate reason to bring crayons and a coloring book to an event for adults or are you being hyperbolic? Cause this suggests either bad-faith or a profound lack of clarity about the issue and neither is good for your argument.

Good point. There's probably no legitimate reason for non-voting children to be present at such a political event, either.

And by way of the process of excluding these children, the motivation for bringing other items without legitimate use like crayons, coloring books, and paperclips will be greatly diminished.

It's win-win. Thank you for the excellent insight!

Voting adults can’t necessarily afford or arrange childcare which is a legitimate reason to bring their non-voting children. Effectively all non-voting children will one day be voting adults. Exposure to politics before participating in politics is valuable not only for them, but for everyone who will be eventually governed partially by their vote. Legitimate reason #2.

Regardless of the lack of vote, non-voting children are still governed by elected officials, giving them legitimate reason #3 to interact with politics, even if they can’t do so in the form of a vote yet.

You’ve picked a poorly thought out hill to die on.

That's a very well-reasoned argument. It is perhaps a shame that it's been placed against the most absurdly sarcastic train of thought I could come up with ("Coloring books have no legitimate purpose at such an event, and therefore nor do children"), but your take remains well-reasoned nonetheless.

---

I won't be in NYC tomorrow. But if I were planning to go then there'd be a good chance I'd pack my usual way for a short-duration trip: A backpack with a laptop, a change of clothes rolled up tight, and a Raspberry Pi.

Some people bring things like cards or a [coloring] book, but those are not my preferred styles of distraction.

SBCs like that don't take up much space. They pack fairly well and give me something out-of-band to goof around with when I'm traveling and bored, where my usual household distractions don't exist.

I get some pretty creative systems stuff done on them sometimes by creating some whimsical problem, working out the steps for a solution, and then implementing it and seeing how it plays out -- in the field, away from my usual pile of resources. It's fun for me.

There's almost certainly some manner of Pi already in my bag right now, left over from my last trip -- probably housed in one of those cheeky red-and-white plastic cases that the Pi Foundation offers.

It would not be a huge loss if I had to dumpster it like a forgotten nail clipper at the airport after 9/11, but it sure would be surprising. It's not a particularly devilish device and has never attracted any sort of attention, and I would never have reasonably expected it to do so.

>There's no legitimate purpose in bringing crayons and a coloring book

Presumably there might be children (or very bored adults) at the event?

Perhaps so.

But that's not a legitimate use.

And the crayons' delicious nature can be used to distract and bribe the constabulary.

But there isn’t a risk either if you bring them. It’s about potential damage.

And the winner of the "could you be more obtuse award", ladies and gentlemen

Next it will be smart phones which can do many of the things these devices can do when rooted the right model.

Not hard to make a walking stick that can do wireless shenanigans, that gets overlooked by all.

Oh well, be mobile free zoning soon at this rate.

If your walking stick looks like it will be used as a weapon then you can safely assume you’ll have it removed upon entry.

Events like these will have disclaimers like “admittance is subject to the discretion of our security staff”.

The point of the list of prohibited items is to make it easier for attendees to know the kinds of items theyre allowed to bring. What it isn’t, is an exhaustive list of anything that could be used for bad intentions.

Nobody going to take a walking stick of an old man or some disabled person using it to walk, not unless it looks like it can pull apart into a sword. But security today and discretion does leave much in the wind.

They should have just said any computers other than mobile phones, by drilling down they enable security to fail at their job as people could bring another SBC and go its not a raspberry Pi and that highlights the crux.

Concern is this sets a standard moving forward that does not single out one SBC from others unfairly, which is what they are doing here.

> Nobody going to take a walking stick of an old man or some disabled person using it to walk, not unless it looks like it can pull apart into a sword.

Which is just a more verbose way of saying exactly what I said ;)

> They should have just said any computers other than mobile phones, by drilling down they enable security to fail at their job as people could bring another SBC and go its not a raspberry Pi and that highlights the crux.

That would cause problems for reporters bringing laptops.

What you’re missing is that this is a tech forum filled with a tech-literate people and a higher than average number of autistic and other neurological tendencies to be “technically correct”. Which isn’t who the target audience of the inauguration party will be.

Their messaging is fine for the people it’s targeted for. It wouldn’t be fine for a Defcon event, but this isn’t that.

> Concern is this sets a standard moving forward that does not single out one SBC from others unfairly, which is what they are doing here.

Different parties have different admittance codes. Some will list drugs, some will list attire (eg no trainers), some will say “no food or drink” while others might say “no disposable bbqs”. This isn’t any different to any other party or location which have their own rules for entry.

You might be right that this sets a precedence, but Occam’s Razor suggests you’re over reacting given the nature of the event and its target audience

> Nobody going to take a walking stick of an old man

Okay Gandalf :)

Gandalf used a staff and the one I knew never used one :)

We really should ban phones at events like concerts and parties, where people don't want to be recorded, people on their phones dull the vibe...

A mayoral inauguration? Personally I wouldn't ban it, but like rPIs, I don't see why it's a big deal either way. Your event, your rules (within reason).

People are dangerous - maybe just ban them.

People are disease vectors: children are especially horrifying.

Ah yes 2020, we know it so well.

I don’t disagree with you in general, but:

> Presumably, the cops are aware of previous disruption with these specific devices, or threats thereof. And it's not like they're going to say exactly what, nor should they, lest it give people ideas...

I don’t think this is necessarily true. The TSA bans all sorts of crap solely because they feel like it, and not in the name of any kind of actual security. It is entirely possible that the NYPD “heard” these terms in media and got spooked, so here we are.

I don't think the NYPD thinks "beach balls" or "large items that could obstruct views" or "flipper zeros" are spooky or scary. I think they think they're potential annoyances in a large crowd.

>Presumably, the cops are aware of previous disruption with these specific devices, or threats thereof.

You're presuming a lot for a single board computer that's less powerful in every way than your laptop - even as a blunt object. Sometimes authorities make arbitrary and capricious rules: that's why they are celebrating an inauguration, not a corination. If things like this never happened, we would have no need for regular elections. :-)

> beach balls are prohibited too.

Clearly these should be banned based on capability. Am I allowed to bring a yoga ball?! /s