This is what annoys me most when people talk down security by obscurity. Sometimes it is not even security, but logs sanity. I usually ask them if they prefer to have more or less useless logs. Still waiting for someone to want more (except researchers)
Security in depth is made of (ideally independent) layers. Obscuring things is one such layer.
I do not know how what the legal context is in your country, but you may need to have a device that uses public roads licensed to do so. In case of any legal issues (accidents, mostly) not only you would not be covered by your insurance, but your situation may worsen for having operated it. Something to keep in mind.
This is definitely something to be aware of. Installing this firmware definitely invalidates the StVO (though I can always flash the original firmware back). Personally I am morally sound with replacing the firmware of the display unit as the critical functionality is still handled by the motor controller (for example, the brake lever sensors are wired to the motor controller directly, and the display must report the throttle position constantly to not trigger a shutdown); the display unit would need to contain intentionally malicious code to cause problems.
From a security perspective I greatly prefer a client-server approach: you have an unsafe frontend where you care about ergonomy and aesthetics, and a backend which provides an API which handles the security.
Two different worlds and often two different kinds of developpers
I think we actually don't disagree there, but we have a different understanding of the term "server-side". Anything related to security must happen on the server since safety measures in scripts running client-side can be defeated.
SSR (Server Side Rendering) provides the browser with a page that is created on the server (and possibly enhanced/hydrated on the client).
Having a separate backed and frontend allows for separation of duties: the client is responsible for the user-facing content and the backend deals exclusively with data flows. This allows to have several independent clients, machine to machine connections etc.
Whatever arrives to the server is untrusted, and the API (or other interfaces) only verify raw data (a JSON for instance) and there are excellent (backend) frameworks for that.
Mixing the visual content with the data is possible (Django does that for instance) but from a security perspective less efficient (again - separation of duties). It also requires to possible double the work to have an independent API.
In other words, if you separate the two you do not care about security on the front at all, and the one who builds the back can focus on their expertise.
Since I cannot find any mention of this in the French press and after asking a few friends who have children in high school (hopefully this is lycée, a tad too late to push people to reding) -- it is very likely not a nationwide experiment at all
A friend of mine briefly managed a "celebrities and ovni" kind of newspaper. His first decision was to distribute papers to generic people asking them to highlight the words they did not understand. He then proceeded to having these words added to the spellcheckers so that they are flagged as incorrect.
His time was a nice success for the newspaper and a sad addition to the average stupidity of the world.
I am French. When working for a large US company, I visited SF several times between 1998 and 2008. It was usually great, especially in the earlier years.
Then I went to visit with my kids in 2019. Oh man, what a change. The city felt really, really different. Even the guy who was giving us a tour had some nostalgia in his voice.
That's not a renewal. It's fairly standard for EU countries to require being outside the country to apply for a visa or residence permit when it is your first one, or (in some cases) when changing the type of visa or permit. But renewals never need you to leave.
Security in depth is made of (ideally independent) layers. Obscuring things is one such layer.
reply