Bring On Supercon!

October 31, 2026 by Elliot Williams 3 Comments

In just under a week from today, almost 700 hackers will be getting together in Pasadena, CA for three days of scheming, soldering, and socializing. If you’re able to join us, you absolutely should – there is no substitute for attending a hacker convention in person.

But even if you can’t make it to Supercon, you’re not shut out. We have an absolutely killer slate of talks, and we’ll be streaming at least one stage’s worth during the event. Watching a good talk isn’t just entertainment, but it can plant new seeds of possibility in your brain, or give you new perspectives on something that you thought you already knew. A super talk can launch a thousand hacks.

It’s a funny part of our culture, that even though we all have the Internet where the printed word and the video reign supreme, many of our best ideas are still transmitted the old fashioned way: one person who has thought deeply about a topic gets up in front of a room and lets loose. Maybe it’s because presentations require so much preparation that they’re so powerful? I don’t know, but I do know that I’ve seen a number of Supercon (and other!) talks that have literally changed the way I see the world. A good presentation sticks with you.

Hackaday strives to be the equivalent of the newspaper of record for everything going on in our scene. If there is a cool hack out there, we want to showcase it so that everyone can draw from it. In just exactly the same vein, we are stoked and honored to be the stage for the next round of great talks. Whether you’re there in the audience live with us, or watching along at home, and whichever of the topics you’re interested in, we hope that the signal gets out to you.

Hackaday Podcast Episode 393: Epaper, Tamagotchi Hacks, And Supercon Talks Galore

October 30, 2026 by Jenny List No comments

This week’s podcast comes from Europe, as Elliot Williams is joined by Jenny List, who wishes to apologies for the poor sound quality from her headset microphone. The news this week is our Supercon conference which is upcoming, we’ve released more speaker details.

We start the hacks with a follow-up to an exciting development. We’ve seen e-paper screens driven at high frame rates, but do the techniques used shorten the life of these displays? Then we have Tamagotchi hacking, re-using an old mobile phone as a flight controller, the oldest Windows app to run on Windows 11, and probably the prettiest mini TV studio rack you will ever see. Pushing Bluetooth out to 12 kilometres is the cherry on the cake.

In quick hacks there’s a swash plate-less helicopter, Commodore 64 keycaps, and the history of the mouse, before our can’t-miss look at infra-red transmission, and a forgotten Google VR headset.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments, or drop us a line on the mailbag.

Download yourself a little podcast, won’t you?

Continue reading “Hackaday Podcast Episode 393: Epaper, Tamagotchi Hacks, And Supercon Talks Galore” →

This Week In Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, And A DHS Directory Dump

October 30, 2026 by Mike Kershaw 6 Comments

Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing list instead of the private security list. This week has been slightly less exciting overall, fortunately, but Akamai’s security team published a pointed essay titled “TLP Is Not a Suggestion”, and it’s hard to argue with the timing.

When a researcher finds a serious bug, the usual process is “coordinated disclosure”. The developers get time to build a fix, and downstream vendors get advance notice under embargo so patches and protections are ready the moment details go public. The Traffic Light Protocol (TLP) is the vocabulary everyone uses to say who may know what: TLP:RED for named recipients only, TLP:AMBER for an organization and its clients on a need-to-know basis, TLP:GREEN for a trusted community, and TLP:CLEAR for anyone. It has no legal teeth whatsoever. It’s not classified data in a legal sense. It works because everyone involved agrees to make it work.

Akamai’s complaint isn’t really about the original php2shell leak, but about what came after: vendors and researchers racing to confirm, reproduce, and publish first. According to Akamai, a researcher published a reconstruction of the bug before the patch existed, and exploitation attempts started before most admins knew there was anything to patch. They draw parallels to Heartbleed in 2014, where a handful of companies got early notice and then advertised that they were already safe while Linux distributions were caught flat-footed, and to Meltdown and Spectre in 2018, where a six-month embargo collapsed six days early.

In the rush to publish, it’s also become less clear what the actual severity of the bug is in the real world. It clearly exists, and is of concern, but groups are still struggling to prove a complete exploit path, with several challenges showing results but nothing definitive so far.

Their advice boils down to “protect first, publish second”: push the detection rules and virtual patches, tell your customers privately, and save the blog post for after the official advisory. With AI tooling shrinking the time between “details exist” and “working exploit” to hours, the cost of a broken embargo is going up, not down.

Continue reading “This Week In Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, And A DHS Directory Dump” →

Exploring What’s Left Of Google’s VR Dreams

October 29, 2026 by Tom Nardi 13 Comments

You’re likely familiar with Google’s Cardboard, and the legions of cheap virtual reality headsets it spawned. By sticking a smartphone to the wearer’s head, all these headsets needed were some basic optics to provide a surprisingly effective VR experience. You may even know about Google Daydream initiative that came a few years later, which not only improved the basic Cardboard design but brought with it new software features such as VR-specific improvements to the Android operating system and a version of the Play Store dedicated to 3D games and applications.

But unless you’re a true Google devotee, what you may not know is that the search giant partnered with Lenovo to produce a stand-alone Daydream headset called the Mirage Solo in 2018. A full year before the Oculus Quest hit the market, the $399 device combined the guts of a smartphone with a 2560×1440 display running at 75 Hz, a pair of cameras in the front that let it see the world around the user in three dimensions, and a gyroscopic handheld controller to provide an immersive VR experience without having to be tethered to a computer. In addition to the standard consumer version, there was even a “Business Edition” of the headset specifically marketed to schools, offices, and hospitals as a way to deliver VR content without having to invest in any additional infrastructure.

So why isn’t the Mirage Solo better known? Because in classic fashion, just a few years after it was released, Google decided they were no longer interested in virtual reality and shuttered the entire Daydream program. The software components it introduced were stripped out of Android, the 3D Play Store was taken down, and the back-end mechanisms necessary to register new headsets were turned off. Almost overnight, the Mirage Solo became a stereoscopic paperweight.

Or at least that was the official story, anyway. I recently came across a Lenovo Mirage Solo at a thrift store for $25, and despite my initial Internet searches strongly indicating that it would probably be worthless, it seemed worth the gamble to find out for myself.

Continue reading “Exploring What’s Left Of Google’s VR Dreams” →

JPEG-XL Is Back On The Menu

October 28, 2026 by Zoe Skyforest 37 Comments

Many of the image formats we’re familiar with have been around for decades. We all know JPEG and PNG like the back of our hands, and GIF even had a bit of a resurgence when tiny annoying looping animations became cool again on social media. There has been a growth in newer formats, though, like WEBP, and AVIF, with various platforms and software companies adopting them for greater efficiency, performance, and image quality.

Amongst the new crop of formats vying for relevance is JPEG XL. It was touted as a format that improved on what JPEG could do in the lossy compression space, while also adding on a lossless mode. There were grand hopes that it would become a universal replacement for all existing raster formats on the Web. A major problem was that Google was seemingly against it, only to backflip—with the format now slated to hit the big time with renewed backing from the search giant. So what’s going on?

Continue reading “JPEG-XL Is Back On The Menu” →

How Bad Is That Bridge: A Government Database

October 27, 2026 by Zoe Skyforest 21 Comments

Bridges! We kind of expect them to just be there and do their job, ad infinitum. They are built into the landscape, and we often take them and the routes they open up for granted.

The reality, as any civil engineer will tell you, is that bridges are living, breathing things that require endless maintenance and monitoring to keep them safe, standing, and functional. A great example of this is found in the US Department of Transportation, and its publicly accessible register of bridge health reports.

Continue reading “How Bad Is That Bridge: A Government Database” →

The Fascinating World Of IrDA And Other Infrared Protocols

October 26, 2026 by Maya Posch 32 Comments

Infrared (IR) communication technologies are probably one of the most influential, yet also one of the least flashiest. The fact that IR communication tends to be highly directional and often limited to low data rate leads many people to scoff at it, deeming it barely worthy of more than making TV remotes work, perhaps along with some unloved industrial gear like the IR interface of electrical meters.

This is a shame, because TV remotes are a good example of why sometimes you want something that is directional, and anyone who has battled with Bluetooth pairing can attest to the value of things simply working by pointing it at the device. IR protocols also have the advantage of inherent privacy protection as walls and other obstacles will block the signal, unlike that of an exploitable Bluetooth device which happily advertises to your neighbors and passersby.

For reasons like the above – as well as their simplicity and hackability – IR protocols are worthy of a detailed look.

Continue reading “The Fascinating World Of IrDA And Other Infrared Protocols” →