Turning Glass Into A Touch-Sensitive Button

July 31, 2026 by No comments

Although generally glass isn’t associated with touch-sensitive surfaces, the addition of an ITO (indium tin oxygen) coating adds the exciting property of not only being transparent to the visible light part of the electromagnetic spectrum, but also of being electrically conductive. The logical result is that fine folk like [Sokol] simply had to use their newly acquired ITO-coated glass to make a button out of.

Here the easy option is of course to just use it as a capacitive sensor where the conductive ITO layer is used for the capacitive charge and the glass provides the insulator, but here we see it demonstrated how to create a pressure-sensitive implementation instead.

The measured conductivity on the ITO-coated glass in the video is pretty good, at just over 20 Ohm. This thus makes said capacitive button very easy to achieve. To make it a touch-sensitive button, two pieces of glass are used, with the ITO sides facing. Paper is used to create a spacer, after which the slight flex of the glass allows for the two ITO surfaces to touch, completing the circuit.

This is somewhat similar to how resistive touch screens work, with the position of the finger or stylus determined by the resistance between the two sides. In a hobbyist setup this would make it fairly easy to create a multi-position touch screen using just two pieces of glass and some firmware.

Continue reading “Turning Glass Into A Touch-Sensitive Button” →

A Complex Way To Push A Button

July 31, 2026 by 3 Comments

We’ve likely all looked at a simple problem in our lives and thought that it would be an easy fix, only to realize that the project is enormously more complicated than we first realized. Whether that’s starting a home improvement project, doing a quick repair to a bicycle or car, or trying to install an obscure piece of software on a Linux machine, the amount of time we budget for these tasks often ends up woefully underestimated. [Oscar]’s night light needs to have its brightness set every night, and it seems easy enough to get a microcontroller to automate that, right?

Well, upon opening the small device, the first issue is that there is no labeling on any of the parts, so simply adding a jumper on to existing microcontroller pins without damaging anything wouldn’t easily be possible. Adding a secondary microcontroller is the next logical step, but the power supply in the night light is extremely underpowered so using even the smallest Raspberry Pi or off-the-shelf Arduino was out of the question too. [Oscar] instead chose an ATtiny85, which solves the power requirement issue, but these are a bit more of a challenge to program without a USB device. From there, it needs a transistor wired in to the circuit to actually push the button for him, plus a few support resistors, so [Oscar] actually had a PCB custom-built to hold all of these components.

Even after all of that, the space within the night light enclosure made installing the PCB a challenge, but in the end he has a device which, when his home automation system powers on the plug for the nightlight, automatically boots up and pushes the switch the required number of times and then puts itself to sleep. We’d call that a success even after the colossal effort getting this inexpensive, small light working the way he wanted. There are some other low-powered solutions for problems like these too, as long as being battery-powered isn’t a dealbreaker.

Tiny Desktop Robot Has Radar

July 31, 2026 by 1 Comment

One thing our futuristic world is largely lacking in is droids and robot companions and the like. [solitary dev] is helping to rectify that problem by building a little robot called TongDou.

As [solitary dev] tells it, TongDou is a “tiny open-source desktop gremlin.” An ESP32-S3 serves as TongDou’s brain, buried inside a tasteful brass tube chassis. An OLED display is TongDou’s face, and he uses a pair of wheels driven by gearmotors for locomotion. A speaker plays back pre-recorded voice lines, while a 24GHz radar and an IMU enables TongDou to keep track of the space it’s moving through. They are publishing the design files on Github so other makers can build their own if so desired.

[solitary dev] hopes to develop TongDou into something to make a “workspace feel less dead.” It’s not dissimilar from the way studios used to use robots to liven up otherwise hackneyed movies and TV shows, and we could absolutely use some of that whimsy in the real world. We’ve featured other fun desktop companions before, too. Video after the break.

Continue reading “Tiny Desktop Robot Has Radar” →

NES Advantage Stick Gets Bluetooth Upgrade

July 31, 2026 by No comments

The NES Advantage was a cool bit of hardware back in 1987, bringing an arcade stick to the home console gaming experience. Naturally they don’t get much use these days, unless of course they’ve been modded to work with modern systems, as [Aaron] has done.

[Aaron]’s goals were straightforward. The stick should work with modern systems over Bluetooth, but the mod should not involve cutting the case or making any new holes. All controls, including Turbo and Slow Motion, still had to work, too, and there would be no adding extra buttons for configuration or control.

To achieve this, [Aaron] whipped up a custom PCB which replaces the original cable attached to the NES Advantage. Power is via a small LiPo cell, charged via a TP4056 and paired with a TPS63900 buck-boost converter. An ESP32-WROOM-32E interfaces all the original controls, reading the stick’s CD4021 shift registers to do so. It then either emulates a Switch Pro Controller over Bluetooth Classic, for use with a modern Nintendo Switch, or it acts as a standard Bluetooth Low Energy gamepad for use with PCs, SteamOS, phones, and other compatible hardware. All that and the stick can still work with an original NES if so desired, when placed in the Switch Pro Controller mode. You merely need to plug in an 8BitDo NES Retro Receiver and you’re up and running.

We’ve seen other fun retro controller builds before, too, like this classic Xbox controller modded to work with the Xbox 360. If you’re cooking up similar projects, we’d love to hear about it on the tipsline.

Hackaday Podcast Episode 380: 3D Printing The Rainbow, IR And IP Camera Hacks, And Americium 241 On The Loose

July 31, 2026 by No comments

Elliot Williams and Al Williams got together to compare notes on the most interesting posts this week on the site. As usual, there are just too many choices, so you’ll have to settle for just the few that can fit in a podcast. The guys were excited about 3D printing — both FDM and SLA — as well as a few camera projects. Ever wanted your own starship? They do, too, and you’ll hear about it along with portable radar and more.

Want to make flexible PCBs? Fill up a carbon dioxide tank? Or play Doom via regular expressions? Tune in, and you’ll find out about those stories and more.

Follow along with the links, and as always, tell us what you think about this episode in the comments! Better still, drop us a note in the mailbag, and you might hear your question on a future episode. You can record audio or send us a message, and one of the hosts will read it on your behalf.

Direct download in IR color-corrected DRM-free MP3.

Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:

Continue reading “Hackaday Podcast Episode 380: 3D Printing The Rainbow, IR And IP Camera Hacks, And Americium 241 On The Loose” →

Hacking A Commercial Colorimeter To Add RAL Color Code Support

July 31, 2026 by No comments

When you need to match paint colors, one of the tools you’ll reach for is a deck of reference colors. Another might be a colorimeter. But what if you want both? [hallko1234] created just that by reverse-engineering and then patching a CR4501 colorimeter.

It starts with a problem: every time [hallko1234] needed to check a color, he had to take a reading, write it down, run to the office, match it with a table, and then walk all the way back. That sounds like too much effort. The natural solution, of course, is to automate the process.

So he did. The CR4501 will happily give you its entire firmware over the debug port, after which it was time for analysis in Ghidra. Some hiccups, brickings and accidental erasure of calibration data later, he finally had a working version. The end result is a simple screen that, after every time you measure, displays the closest RAL color code and how close it is.

On the off chance someone else has the same colorimeter, he even made an online tool to install it for you.

This Week In Security: What’s In A Name, The AI Bugpocalypse Hits Everyone, OpenWRT Flaws, And Duress Passwords

July 31, 2026 by 8 Comments

The great thing about standards is there’s so many to pick from, right?. (Insert obligatory XKCD #927 here.) Several companies have developed naming schemes to refer to groups of attacks, and now Google has too.

Sometimes, malware, ransomware, or exploit groups name themselves: “Shinyhunters”, “LapSus$”, “Cl0p”, “Lockbit”, and so on. For the groups that don’t advertise their presence, identification and naming can be more difficult. Mostly state-run affairs that didn’t want to draw attention to themselves, these Advanced Persistent Threats (APT) groups were originally simply given numbers. APT28 refers to the Russian GRU Intelligence Directorate suspected of hacking the Democratic Party email servers, APT38 is a North Korean governmental agency involved in financial and crypto currency theft.

Multiple companies and agencies have developed naming schemes to make referring to threat groups easier, typically including a regional identifier as well. CrowdStrike naming uses name groups like “Bear” group for suspected Russian actors, “Panda” for China, “Spider” for unattributed crime groups, while Microsoft uses “Blizzard”, “Typhoon”, and “Tempest”.

Google, deciding there weren’t enough classifications already, now introduces “RELIC”, “CASTLE”, and “COMET”. Of course, each naming organization has dozens of other classification groups as well, but now the next time you hear about an attack being attributed to “Scattered Spider” you know it’s the CrowdStrike name for a crime group.

Critical OpenWRT DHCP Flaw Fixed

The Hacker News reports on a major release of OpenWRT which includes fixes to the odhcpd server, the embedded DHCPv4 and DHCPv6 server written by OpenWRT.

The bug is a straight-forward stack style attack where a buffer is allocated, but not length-checked against the data required to reply to a malformed request. OpenWRT runs on a wide range of devices, but one of the most popular legacy platforms still in use, the MIPS processor architecture, lacks most modern security protections against stack-based attacks, making this attack sting more than it might on other architectures.

The latest OpenWRT releases also fix issues in the uhttpd embedded web server, multiple issues in the LUCI web configuration interface that allowed attackers to inject cross-site scripting content and Linux kernel security fixes. If you run a direct OpenWRT build on your equipment, update! These bugs will have an extremely long tail however, with tens of thousands, or likely more, OpenWRT-based devices that will never see updates.

The company behind several of the findings, Hacker House, say they used multiple AI tools and both open and frontier models to discover the bugs, then manual review and testing to confirm before reporting.

Cisco to Stop Assigning (some) CVEs

Cisco has announced it is moving to a twice-monthly patch cycle. Additionally, Cisco will no longer assign CVEs to each bug in the release.

Cisco says this is in reaction to the rapid increase in bugs found by AI tools, and that “Assessing security risk CVE-by-CVE and applying point mitigations is no longer fit for purpose.” Cisco will still assign a CVE to a bug that “requires compensating controls” or is known to be exploited.

It seems like it will be business as usual for the most severe bugs, but it will be interesting to see what happens when exploits are found for bugs which did not get a CVE in a prior release.

Microsoft Suggests Three-Day Patch Race

Microsoft is now recommending a 3 day patch window for new patches. This is, to say the least, an “aggressive” schedule for applying new patches, given the recent track record of issues introduced by patches.

A update that crashes is inconvenient on a home computer — even more so if it’s your parent’s computer — but could be catastrophic when it brings down an entire corporate fleet. Most large organizations have their own internal patch schedules and internal testing requirements before patches are deployed, delaying the patch process further.

Systems like the CISA KEV database, a list of vulnerabilities known to be actively exploited, are in place to help identify the most important issues. With repeated record-breaking numbers of vulnerabilities pushed in Patch Tuesday and the decreasing support of the KEV and related vulnerability indexing systems, the load on IT departments and administrators is becoming impossible.

The AI “bugpocalypse” is finding record numbers of vulnerabilities, while also closing the timeline between bug to exploit to hours in some cases. The time between bug and exploit then drives the patch cycle, which means less testing. With less testing, the patches are less stable, leading to less trust in rapidly installing them.

Oracle Patches Almost 1500 CVEs

Moving directly from the impacts of the flood of Microsoft security issues, the July 2026 patch set from Oracle included fixes for 1499 security issues and 1434 CVEs over 334 Oracle products.

Oracle is also pressuring administrators to move to a monthly patch cycle, but acknowledges “transitioning to a monthly security patching cadence may require updates to existing operational processes”. Not to worry – there is a Oracle consulting service you can hire to help you patch your Oracle problems.

Linux Patches 323 CVEs in Two Days

After announcing over 400 CVEs in the Linux kernel last week, Linux mainters have announced an additional 323 in the last three days alone. The vulnerabilities cover Bluetooth, Ethernet, USB gadget mode, WiFi drivers, virtualization systems, SMB file sharing, and of course more.

One benefit to the architecture of the Linux kernel is that typically all the fixes will arrive in a single kernel update, but when almost every week brings critical updates and a new kernel, patch fatigue is a real thing. Either users stop applying every update, or the uptime and testing requirements of a company prohibits constantly updating and changing servers.

Duress Passwords Aren’t Necessarily a Good Thing

The security-hardened Android variant Graphene, is in the news this week for the use of duress passwords.

A duress password is a mechanism where a second PIN or password can be used to initiate a device wipe. The hope is that in a situation where you are compelled to unlock a device, providing a password which then wipes the device is a preferable option.

The legality of a duress password depends on the environment it is used in. The United States Customs and Border Patrol claims that by wiping a device during an inspection at the US border, Samuel Tunick destroyed evidence and property in violation of federal laws. The issue is compounded because the stop happened at a border, where many US laws against search, seizure, and the availability of a lawyer are suspended, even for US citizens.

The inclusion of duress passwords, and their cousin hidden encrypted volumes, can sound like a good idea, but can place users in serious danger when in situations with less strict rules of law. Having the ability to wipe data sounds great in isolation, but protestors, human rights workers, and other targeted groups have faced direct and physical threats under some regimes. Facing retaliation for wiping a device, or facing physical violence before providing an unlock code out of fear that it might wipe a device, can be a real risk for some.

FreeBSD Fixes a WireGuard Bug

FreeBSD has issued a security update pertaining to the WireGuard VPN implementation.

WireGuard is a modern VPN with excellent performance even on low-end systems, and which has implementations on basically every platform. The FreeBSD implementation, however, didn’t fully validate VPN packets, accepting packets without checking one of the cryptographic validation measures.

Attackers are able to inject data to a FreeBSD WireGuard implementation if they are able to guess some attributes of the connection, and able to fully modify the data in the VPN if they are able to intercept the packets.

The bug impacts any FreeBSD user of WireGuard. FreeBSD has released updated kernels.