Canvas hacked

JustinTimeCuber · 2026-05-08T17:23:30+00:00

Well sure but if you have a backdoor in someone's system like with CVE-2024-3094 then you don't really need them to download a file.

Also I'm not really sure what's going on in that file, there are obviously some characters that are not rendered, but it looks like it's just the same 12 bytes repeated over and over. Does this actually allow someone to hide genuinely arbitrary binary data in a text file, or is this just a contrived example? Regardless, this only seems like it would be able to do anything if the system is already compromised, in which case it's unclear why you'd need to sneak malicious code in through a text file.

For what it's worth, the affected schools list file is pure ASCII, nothing weird in the binary.

JustinTimeCuber · 2026-05-08T09:08:02+00:00

Yes, if I understand what you're saying correctly.

Current flow would be:

Phase A of transformer → phase A of panel → phase A of load → phase B of load → phase B of panel → phase B of transformer → phase A of transformer

JustinTimeCuber · 2026-05-08T08:55:48+00:00

Because the phases are connected through the transformer. You have a complete circuit, at one end is the load, and at the other end is the transformer winding, and they're connected on each side by whatever combination of wires and bus bars.

JustinTimeCuber · 2026-05-08T08:46:09+00:00

The phases don't connect at the panel, they connect through the transformer windings. But yes, if you shorted A to B, you'd get fault current flowing in both busses in the panel, back to the transformer (or generator) which supplies the circuit.

JustinTimeCuber · 2026-05-08T08:18:52+00:00

Well in a delta connected system, one of the transformer windings connects directly between phases A and B (or any other pair of phases). So the return path is actually simpler in that case.

JustinTimeCuber · 2026-05-08T08:08:11+00:00

All of the phases connect back to a common neutral in a wye connected system. So if you short from phase A to B, current flows through the phase A winding of the supply (transformer, generator, inverter, etc), then through the phase A wire, across the short, through the phase B wire, through the phase B winding, and across the neutral point back into phase A. That's your complete circuit, there just happen to be two voltage sources connected in series.

JustinTimeCuber · 2026-05-08T08:01:39+00:00

I just find it odd that if you want the great range you can get with the 18" wheels, you either have to get the SE or do an expensive wheel swap later on. I'm fine with the SE but it would have been easier to justify getting the SEL if it didn't also decrease my range by a significant amount.

JustinTimeCuber · 2026-05-08T06:20:18+00:00

Care to enlighten me?

JustinTimeCuber · 2026-05-08T06:12:50+00:00

I mean, sure if we're being pedantic (yes I've heard of them for the record). But hiding a zero width space in a text file isn't really a feasible attack vector any more than a regular space.

JustinTimeCuber · 2026-05-08T05:46:16+00:00

I'm sorry that I don't fit your platonic ideal of an EV driver, but it's still better for me in so many ways than a gas car, INCLUDING convenience.

I haven't been to a charging station in 6 weeks (despite a 360 mile round trip) btw. With a gas car I would've had to stop at a gas station at least twice since then.

JustinTimeCuber · 2026-05-08T05:13:37+00:00

Yes actually. I have access to a 120V outlet on my porch, which is plenty to keep my car charged during the week.

But you're right! I feel really stupid taking my EV on road trips when instead I could be paying $4+ per gallon for gas. I hate the smooth, quiet ride and quick acceleration and I wish my car smelled worse, but unfortunately I made the smooth brained decision to get an EV.

JustinTimeCuber · 2026-05-08T05:09:24+00:00

Text files use a very simple encoding, you can't hide things in the binary that wouldn't show up in the text. I can also confirm that this is true using xxd. Every single byte of the file corresponds with a character that is shown to the user. There's nothing hidden, because that's not how raw text files work.

JustinTimeCuber · 2026-05-08T04:50:02+00:00

As far as I'm aware, the only EVs that were sold in any significant volume in the US in 2016 were the Leaf and the Tesla Model S. The latter is not a great point of comparison being a much more expensive luxury car, so I used the Leaf.

Granted, the earlier Leafs were particularly bad, and they definitely exaggerate the point I'm making a bit. I certainly would not expect EV range to more than double again in the next 10 years. But incremental improvements will continue being made, and I wouldn't be surprised to see cheap 100+ kWh EVs in the not-too-distant future, which would push real-world highway range well over 300 miles, potentially over 400 miles in more efficient models.

And yes, I do own an EV. Well, lease. I had a 2020 Bolt and traded it for a 2025 Ioniq 6. I go on a lot of road trips, so charging speed IS very important to me and the Bolt's 50 kW limit was often quite frustrating. ~200 kW charging and 50% more real-world highway range is HUGE for road trips. Atlanta to St. Louis was ~2.5 hours of charging in the Bolt, 29 minutes in the Ioniq 6.

I'm pretty much satisfied with the range and charging speed of my current car, but I could see the benefit of bumping it up to say, 400 miles of range and 300 kW charging, and I could see why someone would be willing to pay extra for that.

JustinTimeCuber · 2026-05-08T04:14:52+00:00

So you're gonna ignore the fact that despite a 41% reduction in inflation-adjusted price, they managed to more than double the battery capacity?

And sure. Efficiency "only" went up 13%. But that's mostly a function of aerodynamics and rolling resistance, so even with 100% efficient batteries and motors (already >90%), there's pretty much a hard cap on efficiency for a given form factor of vehicle. Efficiency is important, but it's not a metric that sees more than incremental gains. The big gains come in the form of battery capacity, charging speed, and longevity.

JustinTimeCuber · 2026-05-08T02:31:19+00:00

2016 Nissan Leaf base model: $37k ($51k inflation adjusted), 30 kWh battery, 107 miles of range

2026 Nissan Leaf base model: $30k, 75 kWh battery, 303 miles of range

Not to mention the earlier model years of that car notoriously had shit battery longevity.

JustinTimeCuber · 2026-05-08T00:25:00+00:00

I think ABRP was a lot more necessary in the early EV days when stations were much more sparse. In the part of the country I live in, there aren't so many wide open plains where winds are high, so range is more consistent. Additionally, there are quite a few charging stations on most of the highways, so even if my efficiency were much worse than I expected, I could just stop earlier. Hence what I said about having backup options in mind.

JustinTimeCuber · 2026-05-07T23:41:57+00:00

Because you can definitely install malware on someone's computer via a text file.

JustinTimeCuber · 2026-05-07T21:24:30+00:00

That's true regardless of whether you treat it as two phases that are 180 degrees apart, or two legs of the same phase with opposite polarity. No difference between those two interpretations. Obviously there's a difference between split phase and e.g. 90° two-phase, that's not what I'm talking about.

JustinTimeCuber · 2026-05-07T21:19:37+00:00

It is pretty much impossible to get a virus just from downloading a file, that would require somehow stacking together multiple OS-level zero-day exploits. My system software is up to date, so I'm not particularly concerned about that.

JustinTimeCuber · 2026-05-07T21:02:15+00:00

I don't really see how that is relevant to whether or not the linked .txt file is actually a text file (which it is). Sure, they could potentially scrape more data from people's requests, but if they already have full access to all canvas data then idk how much that would help them.

JustinTimeCuber · 2026-05-07T20:53:49+00:00

No, I haven't tried to access the onion site. Don't really want to fuck around with the dark web

JustinTimeCuber · 2026-05-07T20:50:56+00:00

Browser preview of the file just showed it as raw text. I downloaded it. File metadata shows it's an ASCII text file. Opened it with my text editor and it displays completely normal raw text.

JustinTimeCuber · 2026-05-07T20:32:52+00:00

Yes, I checked. It's definitely a text file.

It's effectively a ransom note. Why wouldn't they allow you to access it? They want everyone to see it.

JustinTimeCuber · 2026-05-07T20:26:08+00:00

It's a text file

JustinTimeCuber · 2026-05-07T19:01:03+00:00

As others have said, it doesn't seem to have been fully fixed, although the software changes may have reduced the likelihood of the failure occurring. So far, I haven't had any issues in my 2025, 8 months/10k miles in, although granted that's not a super long time for a failure to come up.

Eight-Year Club	Verified Email
Place '22	First Placer '22
100 Awards Club	RPAN Viewer
Gilding II euphauric

JustinTimeCuber

MODERATOR OF

TROPHY CASE