Skip to content

Comment on Every part on a bicycle is safety critical

Comments

Modern bikes allow novel attacks too. I wrote a blog post about how to downgrade the firmware of a Shimano Di2 groupset and doing a replay attack to shift someone elses bike.

https://grell.dev/blog/di2_downgrade https://grell.dev/blog/di2_attack

https://grell.dev/blog/di2_attack
must be within a couple of meters of the bike

The range of radio transmitters/transceivers can be increased, and accidental transmissions from various things could affect it.

Choosing to allow any kind of remote control over a manned vehicle is a risk. There can be benefits, but winning a race may not be worth giving up your life.

Similarly, I don’t want IoT devices and won’t connect them when I have to buy them. I’d prefer to keep my thermostat and appliances safe, and a neighbor can turn them off if I forget.

Right, I agree. I think it is just lazy from the manufacturers to not wire the shift levers to the derailleurs. It should have a similar weight because you need additional cables but can get rid of the batteries within the shifters. Your main battery will last about 50% longer too. The only downside is the added work to wire them when assembling the bike. After that you can pretty much forget about the wires though.

Once I had the proper tool, I wired mine. They are all internal so I don't think I'll need to replace during the lifetime of the bike.

this is why if I was a sprinter a the TDF I'd 100% be on a mechanical groupset (assuming the sponsors allowed me to) a missed shift on a sprint means losing 100%

You can use an electronic groupset as well. There are benefits to it. Shimano says it's not possible, but you can just connect the shift levers with a wire to the rear derailleurs [1]. They will not respond to wireless signals afterwards. I tried to do the replay attack and it failed. That way you get the best of both worlds.

[1] https://bettershifting.com/installation-guide/connect-12-spe...

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.