I hope Zhang doesn't feel too bad for accidentally setting this in motion. The fault lies entirely with the manufacture's poor security practices and the overreaction of the corrections officials, but I bet there are still going to be people pointing fingers at him saying "you shouldn't have hacked that laptop and published your findings! Now all these students lost their laptops because of you!"
It does sound very much like an overreaction, from the manufacturer of these devices.
"The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. "
When a critical part of a security system is defeated, saying “that’s okay we have other layers of security so they probably can’t do much” would be IMHO pretty horrible security practice. Taking the laptops away is horrible, but from a security perspective it’s not over reacting.
Eh, true. But then both sides of the political spectrum would have been up their asses had they just said, "relax, its no big deal." Not something you want to hear from a prison (even a not-for-profit prison).
It doesn't even help you get to the end of the exploit chain. To boot anything they still needed to tap the touchpad USB lines and attach preimaged external USB storage. It's a goof but it's not a goof worth making 1200 incarcerated people's lives harder.
The bios password is known now, and you can't change it locally. Security practices aside, it does sound like collecting them and doing an update is required.
The secure boot password was stored as a SHA-1 hash. The machine was designed in a way that the password effectively can not be changed. Those are poor security practices.
These devices must now all be treated as if they’re rooted. That’s a gigantic security problem. Casual analysis here says “well it would be hard to install a new OS, so it’s not a big deal.” That is a terrible security assumption. We don’t know what other changes could be done to a rooted device, but anybody with a sensible security mindset would assume something undesirable is possible.
So, the outcome might be harsh, but it is NOT overreacting to promptly deal with secure devices becoming easily rooted.
> I bet there are still going to be people pointing fingers at him saying "you shouldn't have hacked that laptop and published your findings! Now all these students lost their laptops because of you!”
I wonder if they’d be in prison if they were given a free education and laptops before whatever life choices they made that sent them to prison.
So many official idiocies get justified as "an abundance of caution." One might almost hope the phrase itself would become a warning sign of impending mistake; allowing officials to avoid the predictable disasters that follow.
I've always taken the phrase to mean "I have no idea what I'm doing, so I'm going to throw the baby out with the bathwater and hope things come out okay".
Original title uses “students.” I haven’t counted the characters but I wouldn’t be surprised if the original title exceeded HN’s length limits, and “folks” was used to shave a few letters off to shorten it to <= HN’s limits.
Someone more dedicated than I can count the characters. I personally think this isn’t even worth the time I’m taking to write this comment.
Folk is as old as folk. As Lou Reed said when asked about folk music he said, “let me tell you about folk music, the folk are listening to rock and roll”.
I'm not opposed to "folks" in the abstract, but I would honestly say the opposite of what you just said: "people" is entirely neutral, while "folks" is often used specifically to signal which side of the culture war the speaker is on.
It's a shibboleth that says to others that you've been told that "people" has negative connotations and you are willing to adjust your speech based on what you've been told, but said negative connotations are not actually present in any dialect of English I've ever heard spoken.
I didn't say "folks" was exclusively used that way—it's just a normal neutral word in some dialects—but I've been specifically told by some people (like OP) that they started using "folks" even though it's not common in their native dialect because it is more inclusive of all identities than "people" is.
Used that way it's a shibboleth. Used by DeSantis it's a part of Southern U.S. English.
I've even seen people spell it "folx" in writing to make it clear that they're using it as a shibboleth, since as you note it can be ambiguous in the absence of other dialectical markers.
I'm not saying anyone should modify their speech. I'm saying some people in the US are modifying their speech based on what they've been told the connotations of the word "people" are. As I noted above, there are no such connotations in standard American English, so the speech modification is purely performative.
Re: foreigners, this whole discussion is very US-centric, when I say "dialects" I'm talking about different varieties of US English, not anything outside the US.
OP is directly asking me to modify my speech with some ridiculous link to Obama. And then you said it signals one side of "the culture war" and you're just completely vague about what war you're talking about and which side it signals. You do mention "folx" which I have only rarely encountered and I figured was one of those dumb socially engineered unhuman words that nobody (particularly the people it refers to) actually uses such as "latinx". But the title of the post doesn't even use "folx".
Do you use folks naturally, or do you use it because you've been told people is offensive? In neither of those cases is the OP asking you to modify your natural speech; he is fine with the first case, and in the second case he is telling you not to modify your speech based on what others have said about it!
If you naturally use it because you genuinely believe people is offensive, then he's absolutely telling you to modify your speech, but that is because he thinks you are wrong and you are the problem and he directly disagrees with you and he's not shy about it, which I think is fine. There's no pretence at neutrality there, and if you are neutral then he's not saying what you think.
There is nothing wrong with the word "people", I didn't use it only because I was trying to meet size restrictions and was too dense when I posted this to remember that the word "inmate" exists.
All the strange culture war accusations are made even stranger by weird assumptions like this -- I don't know a single human being who has a problem with the word "people". I'm sure someone out there does, but I would conjecture that the vast majority of people -- even the folks you think of when using the word "culture war" -- have no problem with it
Like I said, I have no issue with people using "folks" as a sub-in for "people", and I wasn't trying to implicate you at all in the rest of my comment. I was just responding to this comment from OP:
> People while also all including tends to bring with it the identity war with it.
I agree with you that I don't know anyone who has a problem with the word "people", but I do know several people (now including OP) who believe that some people do and make an effort to use "folks" to appease those (as far as I can tell fictional) people.
“persons," Middle English, plural of folk (n.). Colloquial sense of "people of one's family" is from 1715. In Old English in plural use it meant only "peoples, nations."
I forget where I first heard this, but whenever someone uses the word "folks", you can often replace that word with the word "idiots" and get the actual underlying meaning of the speaker.
Now not all speakers using it mean it that way, but it's a lazy word to use to group people, and the othering of people it implies seems to equally apply. The condescending tone really shines through.
If you intend on continuing to use this word to address people, know that at least some of us are making this conversion in our heads at all times.
That’s pretty cynical, and maybe not the smartest way to communicate. A similar argument can be made for “people”, and it already was made in this thread before I commented. A speaker can’t be expected to walk on egg shells because there are cynics in the audience who refuse to accept neutral and common usage of words. If someone chooses to interpret a word differently than it’s definition and normal usage, it reflects on them and not the speaker.
> Calling people “folks” all the time is lazy and insulting.
No it’s not. “Folks” means “people”, it has for more than a thousand years, and it’s used most often with the exact same intent. You’re making negative and incorrect assumptions.
If you say so, though I can’t say I’m super convinced by your opinion; it doesn’t seem like you’ve made a reasonable case or brought any evidence. To be fair, it is legitimately hard to argue with the dictionary and all of history, but I wish you good luck communicating with others! BTW, did you intend for that to be a self-own?
> Students said they were given little information about when and if the devices would be returned, and many wondered if they’d lose access to the work saved on the laptops, which need to be placed into a dock to upload or download information. Students enrolled in community colleges also expressed concern that they lost access to their devices immediately before winter quarter finals.
Not exactly a non-story… one women’s prison was put on lockdown so the laptops could be seized. I get that a lot of Americans like their carceral state really carceral, but the article makes it pretty clear that just having the default password doesn’t get you a lot with a device that has no usable ports.
If you follow the Twitter thread, the secure boot password was stored as a SHA-1 hash. So someone eventually brute forced it, and it's "N%(dU32p'".
But, the prisons can't just change the default, because the design is that it writes the bios setup, including the default password, back to the device at power down.
So, there didn't really appear to be any other option for the prisons other than collecting them all and sending them back for a fairly big update.
The article quotes the manufacturer as saying that even with the password there's basically no risk of the devices being misused:
> The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet.
It sounds like one very valid option they had was to just change the password as part of the regular maintenance and replacement schedule on the very reasonable assumption that no one would be able to attach a USB port to their laptop within the confines of the prison.
The author didn't attempt it, but it seems pretty clear 4 of the pins on the exposed docking port would be a USB bus. So all you need really is a usb stick, some wires, and some patience.
The particular connector used even looks like you could directly insert/wedge thin gauge wires, no soldering required on that end: https://imgur.com/a/7T3agdg
Which could have been handled gracefully over time without disturbance if the person would have responsibly just contacted the IT of the prisons, instead of publishing the method and password in the wild.
Just a few hours after it was starting to be brute forced, I'm sure I saw somebody finding the password being used in youtube presentation, perhaps for a related model or bios setup, and that solved the problem much quicker. They privated the video soon after so I didn't get to watch it, just saw the thumbnail.
I'm surprised more electronics doesn't do it. Maybe it costs to much to manufacture clear casing to consumer spec. Maybe there's no demand among the NPCs
My question is -- why was a prison laptop on sale on Ebay in the first place? If they're soooooo concerned about security, maybe don't have these out in the wild?
I'm betting a prison employee stole that from work and sold it on the sly to make an extra few hundred bucks. Probably breaks some rules, no?
> The laptop that Zhang bought came from a state whose corrections department contracts with a Milwaukee-based nonprofit to dispose of its old laptops. But instead of recycling the devices, the organization resold them, selling out of 100 Securebooks after Zhang’s post went viral.
AKA "prisoners". If only we could find a way to harness all these euphemism treadmills for electricity generation, then that might provide an actual social benefit
80 comments
[ 0.22 ms ] story [ 132 ms ] thread"The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. "
Sure, they can commit crimes with it.
But prisons obviously don't care about their charges committing crimes or they would take serious measures to prevent violence.
This was one of the layers. It absolutely did not necessitate gathering up every single one at once.
So, the outcome might be harsh, but it is NOT overreacting to promptly deal with secure devices becoming easily rooted.
That's something better suited for DMs
I wonder if they’d be in prison if they were given a free education and laptops before whatever life choices they made that sent them to prison.
Knowing the shape of that distribution would be interesting.
And sure, some are situational but at least from my school XP people were bunking because they thought they were too cool for school™
"Folks" is meant to elicit closeness or empathy.
Both have their uses. Choice of usage predates Obama by a wide margin.
Someone more dedicated than I can count the characters. I personally think this isn’t even worth the time I’m taking to write this comment.
Replacing "folks" with "students" makes it 80.
I'd wager the title was changed to ensure that people didn't imagine that the students were children.
That is, quite literally, one of its common definitions… as in most English dictionaries side against you here.
Also that “Obama-era” connotation preceded Obama by at least a full Obama.
People while also all including tends to bring with it the identity war with it.
I use folks as a 1:1 to avoid the above.
It's a shibboleth that says to others that you've been told that "people" has negative connotations and you are willing to adjust your speech based on what you've been told, but said negative connotations are not actually present in any dialect of English I've ever heard spoken.
Used that way it's a shibboleth. Used by DeSantis it's a part of Southern U.S. English.
I've even seen people spell it "folx" in writing to make it clear that they're using it as a shibboleth, since as you note it can be ambiguous in the absence of other dialectical markers.
Re: foreigners, this whole discussion is very US-centric, when I say "dialects" I'm talking about different varieties of US English, not anything outside the US.
If you naturally use it because you genuinely believe people is offensive, then he's absolutely telling you to modify your speech, but that is because he thinks you are wrong and you are the problem and he directly disagrees with you and he's not shy about it, which I think is fine. There's no pretence at neutrality there, and if you are neutral then he's not saying what you think.
All the strange culture war accusations are made even stranger by weird assumptions like this -- I don't know a single human being who has a problem with the word "people". I'm sure someone out there does, but I would conjecture that the vast majority of people -- even the folks you think of when using the word "culture war" -- have no problem with it
> People while also all including tends to bring with it the identity war with it.
I agree with you that I don't know anyone who has a problem with the word "people", but I do know several people (now including OP) who believe that some people do and make an effort to use "folks" to appease those (as far as I can tell fictional) people.
“persons," Middle English, plural of folk (n.). Colloquial sense of "people of one's family" is from 1715. In Old English in plural use it meant only "peoples, nations."
https://www.etymonline.com/word/folks#etymonline_v_33264
Now not all speakers using it mean it that way, but it's a lazy word to use to group people, and the othering of people it implies seems to equally apply. The condescending tone really shines through.
If you intend on continuing to use this word to address people, know that at least some of us are making this conversion in our heads at all times.
If you are addressing others, use better words to describe them. Calling people "folks" all the time is lazy and insulting.
No it’s not. “Folks” means “people”, it has for more than a thousand years, and it’s used most often with the exact same intent. You’re making negative and incorrect assumptions.
Meh, whatever. Different strokes for different folks.
Not exactly a non-story… one women’s prison was put on lockdown so the laptops could be seized. I get that a lot of Americans like their carceral state really carceral, but the article makes it pretty clear that just having the default password doesn’t get you a lot with a device that has no usable ports.
But, the prisons can't just change the default, because the design is that it writes the bios setup, including the default password, back to the device at power down.
So, there didn't really appear to be any other option for the prisons other than collecting them all and sending them back for a fairly big update.
> The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet.
It sounds like one very valid option they had was to just change the password as part of the regular maintenance and replacement schedule on the very reasonable assumption that no one would be able to attach a USB port to their laptop within the confines of the prison.
That happens too often in this world.
The particular connector used even looks like you could directly insert/wedge thin gauge wires, no soldering required on that end: https://imgur.com/a/7T3agdg
Just a few hours after it was starting to be brute forced, I'm sure I saw somebody finding the password being used in youtube presentation, perhaps for a related model or bios setup, and that solved the problem much quicker. They privated the video soon after so I didn't get to watch it, just saw the thumbnail.
>This thread is going viral, thank you all for the like and repost! Update on the password, they literally just shared the password in a video
[0] https://twitter.com/zephray_wenting/status/17617384499655026...
I'm surprised more electronics doesn't do it. Maybe it costs to much to manufacture clear casing to consumer spec. Maybe there's no demand among the NPCs
You can get a prison TV, radio, remote - https://www.ebay.com/sch/i.html?_nkw=%22Clear+Tunes%22
Typewriter - https://www.ebay.com/sch/i.html?_nkw=Swintec+2410
I'm betting a prison employee stole that from work and sold it on the sly to make an extra few hundred bucks. Probably breaks some rules, no?
> So how does a prison laptop end up on eBay?
> The laptop that Zhang bought came from a state whose corrections department contracts with a Milwaukee-based nonprofit to dispose of its old laptops. But instead of recycling the devices, the organization resold them, selling out of 100 Securebooks after Zhang’s post went viral.
AKA "prisoners". If only we could find a way to harness all these euphemism treadmills for electricity generation, then that might provide an actual social benefit