mentioned in issue #5 (closed)

mentioned in issue ops#6 (closed)

Added https://git.devuan.org/neo900/www/blob/0022/content/0022-about-the-asn.1-vulnerability.html to the description (cc @joerg_rw )

- "(we'll come back on this in an upcoming installment)"
  in the spirit of not making unnecesary promises, remove

- "confirms the interest"
  "interest" sounds odd. Maybe "pertinence", "relevance", "importance" ?

- "that isolates the baseband chip from power supply"
  That's far from the only mechanism we have, and may not be our
  strongest. Maybe just remove "from power supply", maybe add
  instead "(modem)".

- "preventing remote activation"
  We can prevent activation by shutting it down, but that's not
  all, and possibly not the best we can do. Also, it's not only
  remote activation, but any untoward activity.

  Maybe use "detect and/or prevent suspect activity" ?

- (ASN.1 definition)
  Maybe add
  "ASN.1 is used in many protocols and data formats, including cellular
   telephony."
  http://www.itu.int/en/ITU-T/asn1/Pages/Application-fields-of-ASN-1.aspx

- "its likely"
  "it's likely" or "it is likely"

- "the same or similar"
  "more of the same" ?

- "Neo900 is not affected"
  The modem is part of Neo900 and the modem may still be affected.
  (We don't know whether it is or not because we don't know what's
  going on inside it. That's why we treat it with a healthy dose
  of distrust.)

- "hardware protection from remote activation"
  Again, that may not be the key feature in this context. (When
  you mentioned it earlier, you did so in the context of what you
  personally found endearing about Neo900, in a general sense.)

  Since the same topic appears - in more detail - in the next
  paragraph, maybe just strike this one, and remove "In fact,"
  from the next ?

- 'by "lawful" or illegal'
  Sounds a bit funny to my ear. I'm not entirely sure, but maybe
  this would sound better:
  'by "lawful", or by illegal'

- "only a rare combination"
  Hmm, not sure if we want to be so specific here. A rogue modem
  could also try to exploit other holes, e.g., bugs in protocol
  stacks.

  Maybe "But with Neo900, the attack surface is much reduced, and
  a compromised modem would only to subvert the CPU in the presence
  of subsequent major vulnerabilities."

- "null"
  Always these absolutes :-) How about this ?
  "we consider [...] negligible"

- "or in the comments."
  Does this still apply ?

- "GTA0x design"
  Hmm, not sure if we want to continue calling everything
  "GTA0x". How about this ?
  "designs from [...] Neo900, support".

• "preventing remote activation"

It's a quote from an already published communication.

@wpwrak : in How is Neo900 Affected? , what about:

The short answer is: although the modem in Neo900 may or may not be affected--we cannot know since all baseband chips are proprietary black box designs --Neo900 is designed to not trust this chip.

- "preventing remote activation", already published
  Yes, but a) we have many choices, and b) this may not be the best or most important in this context.
  I.e., you may live in an uneasy truce with the modem so far, but after having being subverted, it
  begins to act aggressively. We can detect this, and then decide on a response, which may or may
  not include cutting power to the modem.

- "How is Neo900 Affected?"
  Sounds good. Minor detail: the modem module may contain more than one major chip, i.e., a
  chip set. Alas, none of us has opened a modem module yet, so we don't know what exactly
  to call the module's innards. Maybe use "the modem" instead of "this chip".
 

One more:

- "only to"
  Sorry, that was packet loss between my brain and my fingers. It should have been "only be able to".

Oh, and there's a missing </b;> somewhere.

Thanks! Done.

Removed PR label

mentioned in issue #3

mentioned in issue ops#9 (closed)

Status changed to closed

mentioned in issue #11