Hi,

I'm trying to find a way to show who owns the Empeg when it boots up.

My current thinking is this:

* Rename current /sbin/init to /sbin/init.empeg
* Compile the generic screen display program (from the developer site)
* Store said program in /sbin
* Write a shell script to display some bitmaps at startup, sleep 5 (ish)
* run the normal init

I can't see an issue with this except that it'll need to be repeated each time I upgrade to a new release of the empeg software.

Hopefully this will scare the thieves and I might even get it back!

Interested in thoughts.

Cheers,

Paul

Paul Haigh, 6GB, Blue
Reg: 4120 - Serial 00254

Let me go on the record that I think this would be a spiffy idea for an official feature, and it should require next to no effort at all. Just have a text-area be defineable in Emplode, that (if defined) will get displayed for 5 seconds at startup, so you could have something like:

      Empeg Car Stereo
Property Of:  Derek Balling
If Found, Call xxx-xxx-xxxx

Excellent anti-theft potential.

...isn't 5 seconds a little excessive? Would be nice to display in place of the empeg logo, but I for one don't want to wait any more then I have to for my radio to start...


...proud to have one of the first Mark I units

Nobody says that the music can't start playing in the background while the "branding" is still being displayed. Let the music start immediately (or as soon as it CAN anyway), with the "branding" being displayed for 5 seconds, and then kicking over to the standard visuals.

Another thing, is that, at the same time as you add that feature, you want to add a feature that says "I cannot make a change to the empeg without this password". That way people cannot just download the software and erase your branding via a software downgrade or re-sync.

D

This sounds like a good idea, but we can't currently control the 'player' software (not having source is a bit of a bugger).

So, I was attempting to circumvent the need to alter the 'player' software for my own means.

I don't think that we could start the real init program in the background.

Hmmm.. I might play around with that.

However, once a theif has their hands on the empeg you'll never see it again, regardless of the branding on it, since they'll just trash it.

Cheers,

Paul.

Paul Haigh, 6GB, Blue
Reg: 4120 - Serial 00254

On the topic of the source code... if someone came up with a good "look", I suspect we could convince the guys to make it part of the official codebase, at which point, they can tweak it in the necessary manner.

On the topic of "getting the empeg back"... I harbor no illusions that it would suddenly get returned to me (although, I do believe that the branding increases the likelihood of that happening), but what it really does is prevent the thief from enjoying the stereo himself (without having to admit that he stole it every time it powers up *G*)

D

Ok, Looks like I've got a little project for one weekend soon!

Paul.

Paul Haigh, 6GB, Blue
Reg: 4120 - Serial 00254

I think this is a good idea, and as the serial number of the unit is hardwired and can be retrieved from /proc then it should be easy to display the serial number at startup, eg. overlaid on the penguin logo.

Ideally, I would like to see a menu option similar to the 'About' box, called 'Owner' or something, that will display the owner's name and contact details, but that would require access to the player source.

Geoff
---- -------
Reg No. 554, s/n 00064 - It's mine I tell you.... all mine :)

All these things will go into future versions of the software - they're on the to do list. We already have a method of disabling stolen units, though.

Hugo

Hi there !

Okay, i NEED this feature badly, please make it user definable ( The Text that is written, how long how big, etc ... )
If you are talking about disabling stolen units, i only can imagine RDS to be used for this in a sensible way, if you need partnes for that RDS broadcasting stuff, contact me, i am close to 2wcom, a company that splitted from Rohde & Schwarz, handling RDS Stuff, knowing all broadcasters etc ...
( my email adress contains "2wcom" which should give you a hint :) :)

Bye: Nils

P.S. GO for it :)

How about on the boot up screen:
Stolen from: Owner X
Initializing GPS...
Initlaizing cell services...
Dialing local police...
Please wait here for friendly government services..
Thank you, have a nice day.


Even if it doesn't do those things, might be enough of a shock to minimize future burglaries.

-Hoagy.

Beautiful, Hugo.

Has anyone considered using the "info" line (i.e. when info is toggled "on") as opposed to the full screen? Perhaps a "short info" versus "long info" option under emplode in future implementations.

I raise the issue because I, for one, am proud to point people to Empeg's site and don't care to over-write the boot screen's opening logo.

Bleys

"If you would judge, understand." -- Seneca

I perfer it to be on the info screen. Maybe the file can be set from EMPEG.

I would argue that it would be better on the power up screen if someone did steal it and decided to return it. It could be optional

I would argue even further that EMPLODE should be tied to the EMPEG via serial number.

Empeg Kicks Ass
S/N 00203
http://www.iretro.com

>>I would argue even further that EMPLODE should be tied to the EMPEG via serial
>> number.


I disagree. I think this would cause I problem if I want to work on the playlists on multiple
computers. Wouldn't linking Emplode to Empeg make only one computer work with it.




Reg_2845 Serial #00173

It isnt the greatest idea.. but it wouldnt stop you from using it oon multiple computers.. you wold just need to have your Empeg serial number.



Empeg Kicks Ass
S/N 00203
http://www.iretro.com

...which is printed on the outside of the case....

Thief nicks empeg.

Starts empeg, checks version number (he's nicked one before)

Downloads correct emplode version and he's in business.

PS: I am still waiting for the "PIN based protection system" originally promised.

It does need it, you know.

so YOU are the ONE that stole my empeg *g*


Mark
wait for mk III with a USB Host/slave
(USB->Ethernet)(USB->COM 1-8)(USB->You name it)

well i meant a software serial number.. not the empeg one :)

ok.. i agree..
1.)PIN based protection..
2) PIN can be set from EMPLODE
3) if the person enters the wrong PIN number the unit shows the screen with the owners name and return information and maybe a smiley face?

ok./. now it gets funny?

4.)you need the lock the PIN nummber for EMPLODe to connect so the theif doesnt download the software and reset the PIN number..


5.)EMPEG also keeps your current email onboard. EMPLODE gets email address first.. EMPEG asks for PIN number before EMPLODE can connect. Thief puts in wrong pin nummber. EMPLODE E-mail's owner!



Empeg Kicks Ass
S/N 00203
http://www.iretro.com

Unless PINs are optional and OFF by default Empeg opens itself up for a host of "I forgot my PIN" support problems when the next unit hits the masses. Right now we're a fairly compact group of people who have at least half a box of clues. Don't expect the masses to be the same way...

Also, as owners move and units are privately bought/sold, verification of identity (by Empeg) will become a problem -- which raises issues on how to determine a real "I forgot my PIN" request from a bogus call from a thief who did his homework on who he stole something from. (Publicdata.com sells access to public information such as license plate records, etc -- so a cunning thief could actually socially engineer the situation given the proper information about where he/she illegally obtained something...)

Take it from someone who has built (from ground zero) the tech support and network operations centers for two start-up companies, so far -- you DO NOT want these kinds of headaches. It drives me nuts when users indicate they forgot their password and I have to spend 3 minutes to change it for them; my organization receives such requests an average of 5 times per day for machine login IDs and voicemail -- from a company with 400 people in it. That's 400 people with two passwords each for a combined total of 800 passwords. 5 requests a day means 0.6 percent of my userbase has password problems.

Now reverse engineer that based on whatever number of units Empeg intends to sell to the masses. Let's call it 15,000 this year just for kicks. 15,000 x 0.006 is 90 morons a day with PIN problems.

The worst part of it is that I live in Austin, TX -- where most of the average joe users have computers and have some sense of how to use them. Fear it when audiophiles in BFE with little computing experience shift to MP3s and lose their PINs...

-- Bleys

"If you would judge, understand." -- Seneca

Damn, that was well-put. It is so absolutely true.



-- Tony Fabris -- Empeg #144 --
Caution: Do not look into laser with remaining good eye.

Always remember... 1/2 of the people are below average...


and average is pretty damn dumb!


Stan

there is an easy solution for verification.. i stated in a post above.


Empeg Kicks Ass
S/N 00203
http://www.iretro.com

JeepBastard:
Regarding email verification: Email addresses change more frequently than postal addresses ... and as we all know email can be spoofed, sniffed, etc. It's neither a secure nor reliable mechanism for PIN recovery... It's also rather draconian for Empeg to expect its userbase to notify it of an email address change. And keeping that database current incurs similar support problems to the ones I mentioned regarding PIN recovery: people will forget to notify Empeg and then how does it all work???

The point of my post was to indicate the hidden costs that would be incurred by Empeg and, thus by end-users who will ultimately shell out the cash to support those costs.

Basically, I don't think it's fair for us to -EXPECT- (and that's the key word) Empeg to incur costs to itself to solve a problem that, fundamentally, is ours, not Empeg's. If some methodology is devised that works out for everyone, I'm all for it! However, I see a bunch of holes in the PIN solution and they seem to incur overhead costs to Empeg -- which will be pased directly to customers. I think we can all agree that THAT would be a Bad Thing.

-- Bleys

"If you would judge, understand." -- Seneca

I've been reading this thread in the e-mail daily summaries, and let me propose a solution that may solve peoples' problems.

1.) When someone actually places an order for their unit, they are also required to enter a challenge/response for identification. They can choose the question and answer, so it should be easy for them to pick something that they feel secure in their ability to answer later. If they want something simple like "Where was I born?", that's their business, it could also be "Who was that redheaded girl I had a crush on in 8th grade and never told anyone about?"

2.) There cannot be a back door to the PIN system. If you forget your PIN and want it reset, you need to send it to Empeg, pay them some money, and let them work whatever magic is necessary. If there's a backdoor, it WILL be discovered, and the system is for naught.

3.) Emplode CANNOT function without the use of the PIN (if enabled), nor can the upgrade tool, lest someone flash their unit with code that has the security hacked out.

4.) Obviously, the empeg unit cannot have the PIN in any "Reversable" algorithm. MD5 or the like would be a good choice here.

5.) Obviously, to get to a command prompt would also require use of the PIN, so that someone couldn't simply replace the hashed PIN data on the empeg unit with their own "known" hash.

6.) There would have to be some wrangling done when the flash IS upgraded, so that the PIN information survives intact. Not sure how much of an issue that is or not, depending on where stuff is stored.

Unfortunately, this is impossible. There's always a way around any protection scheme and in this case it would simply be the "prot" link inside the empeg, which write-protects the first blocks of flash (note: careful! If this link is fitted you can trash your empeg to the point where theonly way to get it working is to desolder the flash chip and put a new one on).

The problem: this is, for most intents and purposes, an open box, running an OS for which source is provided. Any attempt at serious protection runs into the same problems you have with, say, protecting a laptop - most stuff can be hacked around. Security key on the laptop? Just open it up and find the link to fit that defeats it - how do you think the manufacturer deals with these events?

The average car stereo thief is more likely to be put off by the fact that it has *any* protection, rather than some magic uncrackable protection - I suspect they're not going to try *very* hard to get round it.

Point (5) simply isn't possible - how are we supposed to stop someone getting a command prompt? The unit boots linux (source available) which then runs init (our own). Say we protect init - you take the HDD out, mount it on a linux PC, rename init and presto - it boots a shell. Protect the shell itself? Well, the source is available...

Realistically what would happen is this: thief steals stereo. Thief finds they can't use it without code. Thief opens unit and removes hard drives, bins the rest of the unit, and sells these generic computer components.

There's a balance between making the protection a pain for the user, and making the thief suffer. It's too easy to make the legitimate user suffer and not bother the thief at all.

Hugo

i dont want to make using the EMPEG difficult:

I think the ooriginal thought of this thread was:

Add a name and address information plus reward info thingie to the boot screen , or INFO on the menu so that if the theif feels nice. He might return it instead of trashing it. even though the chance would be slim.

It is also good if you left it some place and a nice fellow picked it up and discovered your name and ws able to return it to you.



It would also kick ass to impress your friends!


Empeg Kicks Ass
S/N 00203
http://www.iretro.com

The whole idea of theft protection through software is pointless. Someone steals your empeg, it's gone. Period. You're not going to get it back.

Make the display show the owners name and address, and what do you think is going to happen? The thief is going to call you up and say "I'm sorry I stole your stereo, I'll mail it back to you..." Not likely.

Make the empeg completely inoperable by anybody but the authorized owner (probably not possible, but just suppose) and do you think the thief will say "Gee, I can't make it work. Guess I'll have to return it..." Oh, yeah, that could happen.

Perhaps there is some small-minded satisfaction to be gained in the knowledge that if you can't enjoy your empeg any more, at least the thief won't either, and won't be able to sell it because he can't make it work. But give some thought to just how big an inconvenience that is going to be to the thief. Let's see -- he invested two or three seconds smashing your window, another one to two seconds pulling it out of the dash. Gosh -- it's enough to make a hard-working stereo thief go into another line of business, finding out he wasted five seconds stealing something he can't make use of.

As far as these elaborate schemes involving PIN numbers, serial numbers and emplode software that only works with proper authorization, requiring great technical expertise and perhaps help from Hugo to change -- why bother? The average stereo thief probably couldn't boot up a Windows computer, much less dig into a Linux operating system to defeat some complicated anti-theft counter-measures. Just have the empeg display the contents of an easily editable (by the owner) text file on boot up and let it go at that.

No protection scheme, whether it be hardware or software, will be of any benefit whatsoever to the owner should the empeg be stolen.

tanstaafl.



"There Ain't No Such Thing As A Free Lunch"

you shouldnt underestimate any theif. you never know , they maybe be capable of finding out what to do. Some more polished theives may have even seen it in a magazine or take it to someone who DOES know what to do with it.

Also , i'd like the name to pop up oon start because what if you just happen to LOSE the unit somewhere? Or the unit is sold to some car shop that cant do anything with it and decides to return it to you?

I think some chance of return is better than none at all



Empeg Kicks Ass
S/N 00203
http://www.iretro.com

Better Idea!

Place a dongle on the serial port. Have the code look for the dongle on startup and if it sees it then do nothing. If the dongle is missing then only display the following and not allow the unit to operate at all.

THIS UNIT STOLEN FROM
richard head
Please call 123-123-1234
Reward for return

The dongle can be just pulling the DTR high on the serial port, or a basic stamp that issues a response from a challenge. bury it in the dashboard, Voila. Thieves are pretty stupid (They're thieves, they arent smart enough to get a real job) and they wont go looking for hardware buried deeper in the dashboard.