djao

Schnorr wouldn't have helped in this specific case, since Schnorr is equally vulnerable to biased nonces (https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi.pdf).

EdDSA, which is essentially deterministic Schnorr, does solve the problem.

Also, the use of P-521 didn't specifically cause the vulnerability, but the bad interaction between SHA512 and P-521 did play a role. It is unfortunate that nature conspired against us to make 2^511 - 1 a composite number. The fact that you have to go up to 521 bits to get a Mersenne prime whereas the natural target length for a hash output is 512 bits is the fatal interaction here.

Now, to be fair, first-party MS Office also has this problem. The online versions can't handle absolutely everything that the desktop applications generate (although they do better than Libreoffice), and even compatibility between, say, Office 95 and modern MS Office is not 100%. I believe MS Office is architecturally incapable of complete compatibility, since its file format is basically a binary dump tied to the current version.

One of the many reasons why my particular industry has standardized on TeX/LaTeX/PDF is because it gets along much better with other humans in terms of file format compatibility over the time scale of decades.

Libreoffice tends to break on more complicated documents. For example this implementation of a CPU in Excel (https://www.theregister.com/2024/02/02/16_bit_cpu_excel/) doesn't work in Libreoffice.

With all respect, only a very small minority of Windows users actually *need Photoshop for work.* If you are one of them, I fully agree, you need Photoshop.

As for Word, I use Word (unwillingly) for work, and I am able to get what I need from just the web version. My "complicated" documents are typeset in LaTeX, not Word, and LaTeX is the standard in my industry.

1. Word works just fine in a web browser. Yes, it's not the full featured version, but I don't need the full featured version.

2. I know a lot of people even on Windows who use Gimp because they get more value out of using Gimp for free than paying for an Adobe subscription.

3. I don't really see much in the way of random problems on Linux, but even if I did, I'll take that over the constant problems caused by ads embedded in the OS.

I've not heard of build quality described as luxury. I think for most people functionality and bodily integrity is a basic requirement of a car, not a luxury item.

You're not buying a new car every day. As long as you have one good car, it doesn't matter very much to you how badly the other ones of the same model are built.

My car is 5+ years old and still working fine.

Even if you use a scheme where the password never traverses the wire, the schemes still require the server to know what your password is in order to perform the authentication. So a compromised server still leads to compromise of your secret credential. Public key authentication does not have this property.

It's a little bit more complicated than just sending a hash of the password, but there are ways to authenticate using hashed passwords without sending the password over the wire, for example https://en.wikipedia.org/wiki/Digest_access_authentication or https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

Even so, these protocols require the server to know your actual password, not just a hash of the password, even though the password itself never traverses the network. So a compromised server can still lead to a compromised credential, and unless you use different passwords for every server, we're back to the same problem.

If a man in the middle relays a public key challenge, that will indeed result in a valid connection, but the connection will be encrypted such that only the endpoints (or those who possess a private key belonging to one of the endpoints) can read the resulting traffic. So the man in the middle is simply relaying an encrypted conversation and has no visibility into the decrypted contents.

The man in the middle can still perform denial of service, by dropping some or all of the traffic.

The man in the middle could substitute their own public key in place of one of the endpoint's public keys, but if each endpoint knows the other endpoint's key and is expecting that other key, then an unexpected substitute key will raise a red flag.

As someone who knows people who died in a crash with another drunk driver, it is hard for me to accept your view. Certainly, at a bare minimum, the penalties for drunk driving that results in fatality should be much harsher than they are now -- at that point there is hard empirical evidence that you cannot be trusted to have the "skill and maturity" necessary for driving -- but we can't even bring ourselves to do that, not even for repeat offenders.

Eventually I am optimistic that autonomous driving will solve the problem entirely, at least for those who are responsible drivers. In an era of widely available self-driving cars, if you choose to drive drunk, then that is an active choice, and no amount of "social lubrication" can excuse such degenerate behavior.

The payload is simply remote code execution. But we'll never know the secret knock that triggers it, and we can't probe existing servers for the flaw because we don't konw the secret knock.

I imagine that we could in short order build ourselves a modified version of the malware, which contains a different secret knock, one that we know in advance, and then test what would have happened with the malware when the secret knock was given. But this still doesn't help us probe existing servers for the flaw, because those servers aren't running our modified version of the malware, they're running the original malware.

Maybe they didn't have time to test? They could have been scrambling to make it into timed releases such as Ubuntu 24.04 or Fedora 40.

I'm with you except the part where you say to "simply go in." I see no reason why I should go in. The aggravation of interacting with a dealer is not worth the pennies I might potentially save (but only potentially, and only if I do everything perfectly, and at the risk of losing my shirt if I mess up even slightly).

I want fixed price transactions. Dealers do not give this to me. Tesla does. Therefore, I go with Tesla. You don't have to. But you can't, and you shouldn't, advise me to do something that I plainly dislike doing. I have already made it clear that the money is not the issue, it is the principle behind the thing. Lack of fixed pricing is the precise thing that I find objectionable.

If a dealer, or anyone else, gives me a different price depending on my method of payment, then I am not going to be your customer. Full stop. I'm not going to try to game your pricing. I want to know that you are engaging in this practice, not so that I can exploit it, but so that I can avoid it.

The stable releases don't have this particular backdoor, but they're still using older versions of the library that were released by the same bad actor.

Tesla redefines luxury. Traditional luxury car snobs object mightily to this new definition. In a way, I can understand their view. If some new group of people comes in and redefines a word that you've been using for decades, then it's normal to be upset. For example, for me, crypto will always mean cryptography, but it seems that normal people think crypto means cryptocurrency now.

For now, let's get past this initial disagreement by using a different name. I've seen people use the phrase "techno-luxury" to describe what Tesla is doing and to distinguish it from the usual notion of luxury cars.

Luxury cars, as I understand it, are characterized by some or all of the following things: physical comfort, richness of sensory experiences, quality of materials and build, noise reduction, and at the very high end of the market, "quirks and features" such as automatically opening and closing car doors, refrigerators in the back seat, umbrellas inside the door jambs, and so on. There is a category of luxury such as Ferrari or Bugatti that emphasizes performance to a certain extent, but I really really doubt that many people will take their Bugatti out to the track for a day.

Techno-luxury, on the other hand, emphasizes entirely different quirks and features: app access, long-term climate control (4 hours+) for when you're sitting in the car a long time, in-car youtube, in-car netflix, in-car video games, autonomous driving capability, built-in dashcam viewable from the app, location tracking, valet mode and other security features, and so on. There is some overlap between luxury and techno-luxury, in that some traditional luxury cars have some of these features, but Tesla still does it better than anyone else if you are specifically looking for techno-luxury, which I am.

This is a straw man. We all agree that legally, one is allowed to pay the loan off early. The question is: do you lie to the dealer and say that you're going to finance, when you're not really going to finance?

I once got a long-term mortgage and paid it off in full within two months. The contract of course allowed me to do this without penalty. But in this case I told the underwriter that I would be doing exactly this. They were still happy to underwrite my loan.

Personally, I would rather tell the lender the truth in this instance. If they don't want my business as a result, then I want to know this information, because it affects my purchasing decision.

That may be strictly speaking true, but it conflicts with another equally important priority: I want to minimize interaction with dealers as much as possible, precisely because I find them reprehensible.

The point remains. If a Tesla is a privileged expensive purchase then so is the average new car. There is no possible way of refuting this statement. It is simply mathematically unavoidably true.

The point remains. If a Tesla is a privileged expensive purchase then so is the average new car. There is no possible way of refuting this statement. It is simply mathematically unavoidably true.

1. Leasing is like a car purchase but with mandatory financing where the true underlying interest rate can legally be obfuscated behind cryptic language that you can't understand. Quick -- is a "money factor" of 0.0074 an attractive interest rate?

2. Leasing is like a car purchase but with a mandatory trade-in (you are going to be trading back the car that you are leasing, at some point in the future when you return your lease). Unlike a normal trade-in, where you have your car as-is and you can ask around for its value, in a leasing situation you have to predict what the value of your car will be in five years. The dealers do this professionally. You do not. Guess who wins?

3. Leasing means it's not really your car. This is an issue most frequently for people who drive a large number of miles. Going over your mileage limit on a lease is very expensive.

4. If your circumstances change such that you need to exit your loan obligations by selling your car before fully paying off your contract, it's easier to sell your way out of a purchase / finance situation than a leasing situation. Ending your lease early is not an option, as car leases (unlike apartment leases) typically carry a heavy early cancellation penalty.

5. In places like the US, where leasing and purchasing are both possible, this enables a unique type of scam: a "sale" where the buyer thinks he's getting a purchase but the paperwork actually says it's a lease. So you're paying full price for the car and you don't get to keep the car in the end.

An apples to apples comparison means ... you should be picking cars that are roughly equal in price. You didn't. So it isn't an apples to apples comparison. You're contradicting yourself.

Look up what the word "average" means. If you are accusing Tesla buyers of buying privileged expensive cars, then you are necessarily also accusing the vast majority of new car buyers of the same thing. There's no way around it.

Toyotas and Kias are not representative of average new cars in America. Teslas are.

Even if you adopt that point of view, I still argue that not buying from a dealer at all is the best way to stick it to dealers, far better than becoming their customer and attempting to win at their game.

A Tesla Model S is definitely not the money saving option. The vast majority of Teslas sold are Model 3/Y.

Compared to an EV, which has only tires, wiper fluid, and wiper blades -- yes, ICE cars have a lot more required routine maintenance.

I've never bought cars in the UK, but as I understand it, the standard way to "buy" a car in the UK is not actually to buy one, but to lease it. Leasing is its own category of hustle, entirely different from purchasing.

The first problem is automatically avoided if you didn't finance your car in the first place, as I am suggesting. For the rest, if you drive your car until it has lost all value, which is what I do, and typically takes 20 years, then there's no further loss of value no matter how long it sits, and the risk from people driving it around is also lowered. If you really don't want to go through any hassle, then just sell the car to a junkyard as the dealer won't offer any meaningful trade in on a junk car anyway.

Even pre-tax interest arbitrage opportunities are rare, never mind after-tax arbitrage. Think about it. If you can get 5% by depositing money in a bank, so can the dealer. If the dealer can get 5% by depositing money in a bank, why would they lend to you at a lower rate? The only possible reason is if they've made enough money on the car sale (or indirect money such as future service profits) to subsidize the arbitrage loss. It's fundamentally wrong to think that you can somehow beat the system. What's really happening is that you just aren't aware of how you are ultimately the one paying for your so-called profit.

We then fundamentally disagree on the principles that comprise honesty and integrity. I do not agree that just because something is in a contract it is automatically honest and ethical.

Actually, yes, I have a Tesla and use it as my only car. I am intimately familiar with the repair costs. An ICE car is about three times more expensive to maintain and repair.

Tesla's service centers are on average overwhelmed with work, the vast majority of which is warranty work (therefore unpaid) simply because there is almost no required routine maintenance, and most Teslas on the road are newer than the four years that it takes for the warranty to expire. They are incentivized to build good cars in order to reduce the service burden on their service centers.

By that token, there is nothing dishonest about a dealer selling you an extended warranty. It's all fair in the contract.

It's a stupid game because it's really really rare for this kind of arbitrage to exist in the system, especially if you do the computation correctly and count after-tax income rather than pre-tax income.

In the rare instances where you profit, congratulations, I guess? I haven't ever heard of a single person who got rich off of car loan arbitrage. None. But I know tons of people who got rich off of never borrowing a car loan. A $700 per month payment stream invested at 5% over 30 years is half a million dollars. I'd rather have $500000 than a permanent car loan.