BougieYelp

Weblogs

Weblogs

nroottag - Turning any Bluetooth device into an Airtag

nroottag.github.io

From u/hackernudes on the YC forum thread:

Apple devices listen for BLE advertisements of a certain form to indicate a “Find My” network lost device.

The lost device advertisements mainly contain the public key part of a key pair.

The public key does not fit in the in payload of the advertisements, so it is stuffed into the address field. Edit: Only 46 bits of the full 224 bit public key is stored in the address field.

In general anyone can make a “lost device” advertisement as demonstrated by OpenHayStack. The requirement is the address field needs to be fully controllable.

BLE advertisements have a header that indicates what kind of address is present (specified by 3 bits: Public, NRPA, RPA, Random Static). The lost device advertisements are supposed to be “Random Static”, but the researchers found that Apple “Find My” listeners (“finders”) will accept advertisements for any address type.

They use this fact to generate the private key part of a public key that matches an existing host adapter BLE address. The host adapter BLE address cannot generally be changed unless user has root/superuser privileges. This step is computationally expensive. However, private keys can be precomputed (rainbow tables) because a large chunk of the address is a manufacturer code (OUI).

On warrantless domestic surveillance in the US

blankenship.io

A central point in the government’s mass surveillance program is distinguishing between “content” and “metadata”. Content is the actual communication, like Smith’s voice in a phone call. Metadata is information about a communication; the phone number Smith dialed. For example, when we send a letter in the mail, we could call everything inside the envelope “content”; the mailing address, return address, weight, date sent, date received, postage paid, who paid the postage, etc. could be called “metadata”.

o1 for $6

timkellogg.me

I found the bit about “budget forcing” interesing:

In s1, when the LLM tries to stop thinking with ”</think>”, they force it to keep going by replacing it with “Wait”. It’ll then begin to second guess and double check it’s answer. They do this to trim or extend thinking time (trimming is just abruptly inserting ”</think>”).

It’s so dumb but plausibly how “resoning effort” was trained into o3-mini-low →\rightarrow o3-mini-high.

and what about the $6 figure?

They used a small model and hardly any data. After sifting their dataset of 56K examples down to just the best 1K, they found that the core 1K is all that’s needed to achieve o1-preview performance on a 32B model. Adding data didn’t raise performance at all. 32B is a small model, I can run that on my laptop. They used 16 NVIDIA H100s for 26 minutes per training run, that equates to around $6.