Hackaday Podcast Episode 383: QR Codes, Caving Gear, And The Old School Way To Learn Electronics

In this week’s episode, Hackaday Editors Elliot Williams and Tom Nardi start things off by getting excited about the recently announced 2026 Retrocomputing Challenge. From there the conversation will cover efforts to improve desktop 3D printing with lasers, an expensive grill with an ESP32 controller and an open source firmware, open source tools underground, and some impressive techniques to squeeze a bit more utility out of the common QR code.

You’ll also hear about turning PVC pipes into flat stock, old school Radio Shack electronic kits, and VR soldering demos. Stick around to the end of the episode learn about the latest developments in over-the-counter hearing aids and the 1-bit CPU that’s enjoying an unexpected fandom nearly 50 years after its release.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download in DRM-free MP3.

Continue reading “Hackaday Podcast Episode 383: QR Codes, Caving Gear, And The Old School Way To Learn Electronics”

This Week In Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, And Comcast Senses Movement

Apple has started sending some users push notifications warning that they have been targeted with specific malware. No specific information about the threat Apple detected is available. While multiple iOS attacks were released in spring of 2026, they all target much older versions of iOS and older hardware versions.

Users in 110 countries have received notifications recently, warning them they may have been targeted or already impacted by malware such. Apple typically uses the crash reporting mechanism for system apps to track new attack trends. The majority of users will likely never see an alert from Apple because malware with state-level capabilities like the Pegasus family is extremely expensive to develop. However, commercial availability means that some governments have deployed them against political opponents, protesters, human rights lawyers, and journalists.

If Apple pushes a security alert, it will show up as an email and a standard system notification, but also as a notification inside the Settings application. While email and notifications can be spoofed as part of phishing attempts, to date there is nothing which can generate false alerts inside Settings.

Almost universally in these cases, Apple recommends enabling “Lockdown Mode“, which adds extra protection to devices at the cost of decreased battery life and slower performance. Lockdown mode disables custom fonts on web pages, accelerated JavaScript, restricts message attachments over SMS and iMessage, and disables other common paths used by malware to steal data. Android devices offer a similar feature since Android 15 that is less comprehensive but can still provide additional safeguards for users directly at risk.

Attacking Airplane Networks

With research that will surely result in some breathless reports, researchers presented at Usenix 2026 an attack against the communications bus of a Boeing 737.

The ARINC 429 bus is a communications architecture for planes, similar to the CAN bus used in cars. Once you are connected to that bus, it can be vulnerable in the same ways cars can be vulnerable to data manipulation. In the Usenix paper, researchers discovered that one access port to the airplane communications system is easily reached from the outside of the plane, though “easily” in this context means “by airplane maintenance technicians”. The paper represents over a decade of work by the team in obtaining and building a test lab of avionics equipment to represent an actual airplane, culminating in an embedded device described as “the size of a quarter” that plugs into the communications port and provides remote access over WiFi.

It needs to be emphasized, given other recent news, that this is a piece of hardware being added to the plane which communicates over WiFi, and not a way to attack an unmodified plane via passenger WiFi!

Once part of the ARINC bus, it seems access is basically unfettered: the team describes being able to reprogram the autopilot, feed the pilot displays false data, and being able to modify the temperature and weight data shown, which could lead to miscalculations in take-off speeds with obviously catastrophic results. Fortunately, the researchers have also been working with Boeing since 2020 to address the issues being found, and the practicality of the attack in the wild remains largely theoretical. The research team has recommended removing the external ports in future aircraft, and blocking access to them physically, like with epoxy, in the current designs.

If reading security research papers is your kind of fun, be sure to check out the rest of the papers that were part of Usenix 2026.

Continue reading “This Week In Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, And Comcast Senses Movement”

Art of 3D printer in the middle of printing a Hackaday Jolly Wrencher logo

3D Printering: Why Is My PLA So Brittle?

Over the years poly(lactic acid) (PLA) – also known as polylactide – has become a popular thermoplastic for a variety of reasons. One of these reasons is that it’s easily produced from a renewable resource, i.e. lactic acid, with the resulting polymer even being compostable if you assume that your compost pile hits a steady 65°C or more, well above the polymer’s glass transition temperature (Tg).

That said, PLA by itself is a pretty crummy material, being exceedingly brittle and inferior to common alternatives like PET(G) in many metrics. Over the decades much research has gone into figuring out this material, its amorphous and crystalline states, as well as how to use plasticizers, copolymers, mechanical manipulation and PLLA/PDLA blends to produce more useful variants of PLA.

Today’s spools of thermoplastic filament that gets marketed as ‘PLA’ are the result of such engineering, though with plenty of remaining issues, as anyone who has struggled through a spool of brittle PLA filament can attest to. Although you can find plenty of tips online about how you should ‘just’ toss said spool into an filament dryer, oven or similar to bake it – with accusing fingers pointed at moisture intrusion, hydrolysis and kin – it helps to understand the fundamentals of how PLA works, and how it degrades.

Continue reading “3D Printering: Why Is My PLA So Brittle?”

Announcing The 2026 Hackaday Retrocomputing Challenge

What is it about retrocomputing? For some people, it’s nostalgia. For others, it’s the appeal of simplicity. For still others, it’s the chance to save old machines from the graveyard. Whatever your motivation, there’s no denying that we’ve seen a metric ton of retrocomputer projects here at Hackaday. And we’d like to see more!

We’re happy to announce the 2026 Hackaday Retrocomputing Challenge!

Now’s the chance to put your retrocomputer project up for all to see. Open up a Hackaday.io project that features your retrocomputer project, and we’ll pick our three favorites for a $150 gift certificate courtesy of this contest’s sponsor, DigiKey. You have until Tuesday, October 27th. So get hacking!

Continue reading “Announcing The 2026 Hackaday Retrocomputing Challenge”

Linux Fu: Improving FTP

FTP isn’t exactly cutting-edge technology. These days, if you control both ends of a connection, you’re probably using scp, SFTP, rsync, or something even fancier. But FTP refuses to die, especially if you are perusing old public FTP servers or talking to retrocomputers. Every now and then, you still need an FTP client. Naturally, there are plenty of graphical clients. But some of us would rather stay at the command line. You could just type ftp, of course. It works, and if you haven’t used it lately, it is probably better than you remember. However, I’ve long been a fan of NcFTP. While some other FTP clients have caught up, it still has unique features that make FTP a lot more productive.

Not Your Father’s FTP

Before maligning the standard ftp command, though, we should point out that it probably isn’t the FTP client you remember from 30 years ago. For example, on openSUSE Tumbleweed, /usr/bin/ftp is really tnftp, a portable version of NetBSD’s enhanced FTP client. Debian uses it too; the ftp package in both Bookworm and Trixie leads you to tnftp. Since current Raspberry Pi OS is based on Debian Trixie, you’ll encounter tnftp there, too. That’s significant because tnftp has already fixed many of the irritations you might associate with old-fashioned FTP.

You get command-line editing, history, and filename completion, things that are also in ncftp. Both understand passive FTP and IPv6. The tnftp client can also retrieve HTTP, HTTPS, and file: URLs, so commands such as:

ftp https://example.com/something.tar.gz

aren’t necessarily typos, although ncftp lacks this ability. But ncftp does have some killer features.

Remember Me?

One of NcFTP’s nicest creature comforts is bookmarks. Connect to a machine, move to a useful directory, and save it:

ncftp /pub/micros> bookmark oldstuff

Then later you can simply type:

ncftp oldstuff

The bookmark can remember more than just the hostname, making frequently used FTP sites feel much more like named resources than anonymous servers you repeatedly have to navigate.

NcFTP also maintains a cache of remote directory listings. If you’ve ever used FTP over a slow link, you know how annoying it is to ask for the same directory listing over and over. NcFTP can often work from what it already knows instead. Neither feature sounds earth-shattering, but together they make an interactive FTP session considerably more pleasant.

Get All The Things

Another difference becomes obvious when you want an entire directory. NcFTP supports recursive transfers:

get -R foo

or:

put -R foo

That seems obvious if you’re accustomed to modern tools, but traditional FTP is fundamentally organized around transferring individual files. NcFTP does the tedious directory walking for you. It also handles resuming interrupted transfers more naturally, something particularly welcome when the file in question is a multi-gigabyte disk image rather than README.TXT. With tnftp, you have to explicitly ask to resume an interrupted file. NcFTP will detect it and, depending on configuration, either resume or, at least, offer to resume the transfer.

Go Away, I’m Busy

NcFTP also has a clever background-transfer system. Commands such as:

bgget giant-file.iso

Hand a transfer to NcFTP’s spooler rather than tying up your interactive session. There are corresponding facilities for uploads. That’s an interesting distinction from simply detaching a shell command. NcFTP knows that this is a transfer job and maintains a queue of FTP work that can be retried and processed independently.

Shell Games

But perhaps the biggest reason to know about NcFTP is that NcFTP isn’t just one program. The package includes commands such as ncftpget, ncftpput, and ncftpls. These perform FTP operations directly from the Unix shell without starting an interactive FTP command interpreter. For example:

ncftpget ftp.example.com /tmp /pub/widget.bin

or:

ncftpput ftp.example.com /incoming widget.bin

This is much nicer in a script than sending commands to ftp using, for example, a here document and automating login with .netrc. For example:

ftp <<EOF
open ftp.example.com
cd incoming
put widget.bin
quit
EOF

Sure, it works, but any time you send input to an interactive program it is, at best, messy. The ncftpput program expresses what you actually wanted to do in the first place: put this file there. That’s much more Unix-like.

Don’t Do This At Home

None of these conveniences change FTP’s fundamental problem: ordinary FTP is not secure. Usernames, passwords, and data can travel without encryption. If you’re designing a new system and control both ends, you usually have much better choices. But sometimes you don’t control both ends. If FTP is something you run into, ncftp is worth knowing about. Bookmarks, cached directories, recursive and background transfers, and especially the script-friendly companion commands turn an antique protocol into something that feels surprisingly at home on a modern Unix command line.

Of course, just as you can use FUSE to mount an ssh server, you can use ftpfs, to make a remote server look like part of your file system. You never know when FTP is going to crop up.

Hackaday Links Column Banner

Hackaday Links: August 16, 2026

We’re no strangers to unusual hardware failures around these parts, but even so, a swarm of jellyfish clogging up the works is a new one to us. That’s exactly what happened to the cooling system at the Gravelines nuclear power plant in France earlier this week, resulting in three reactors having to be shut down. This isn’t even an isolated incident, as POLITICO points out that the same thing actually happened last year around this same time.

So why are jellyfish staging an annual protest against nuclear power? A warming of the North Sea has extended breeding seasons and produced larger populations of the plankton that the jellyfish feed on. This is great for the gelatinous sea creatures, but not exactly ideal if you’re trying to pump the water they live in through a complex cooling system. The French installed filter screens and monitoring systems after this happened in 2025, but clearly they’re going to need to keep working on the problem.

From a new problem to a very old one, a BBC investigation has revealed that the UK’s National Health Service (NHS) Blood and Transplant department was inadvertently leaking private patient data by sending it in the clear over the pager network. Sniffing pager messages was fairly trivial decades ago, and is even easier these days thanks to the proliferation of cheap software-defined radios and open source decoding software. Given the fragility of the underlying communication network they use, the NHS announced they were going to stop using pagers by 2021, but clearly not everyone got the memo.

Continue reading “Hackaday Links: August 16, 2026”

Fully Characterized Systems

A friend from my old hackerspace was in grad school for electrical engineering. He had a professor who would ask, when something went wrong with a student project, “Have you fully characterized the system?” It’s a good, if lofty, goal, but it also became an inside joke around the hackerspace because YOLO was our MO about 95% of the time. Head crashes on the 3D printer – “not fully characterized”. Forgot to take out the trash last weekend? Was the system fully characterized?

It’s maybe also the difference between theory and practice: In theory, there’s no difference between theory and practice, and all systems can be fully characterized. But in practice, it’s hard to fully characterize a system that you don’t yet fully understand.

Case in point: we have nine small saplings growing in our front yard, and I have to water them. It’s boring moving the hose from tree to tree, so I thought I’d take a length of hose, stopper it at one end, and drill enough holes in it so that it could irrigate all of the trees at once. I kinda characterized the system: I figured out how much water flows per minute through our hose, and divided that up into a reasonable outflow in my mind, and drilled holes that ended up being way too large.

Why? Because a length of hose has a resistance to flow, and the water came pouring out of the first few holes, while the last few were dry. It wasn’t a constant pressure system like I thought it would be. I hadn’t even thought that the drag in the hose would matter, so there was no way I would have tried to measure it. But how would I characterize this resistance anyway? You could make a hose with too-large holes and measure the falloff. (Oops, that’s exactly what I did.)

In retrospect, professional drip irrigation systems always have holes that are tiny relative to the pipe diameter, which avoids this pressure-drop phenomenon, which means that they don’t have to worry about characterizing the hose resistance. So that’s what I ended up doing. I cut the hole size in half, and later widened up some of the downstream holes until it looked about right. Not even close to fully characterized, but it works.

So now, in addition to the engineer’s “have you fully characterized the system?”, I have the hacker’s “can you avoid characterizing parts of the system?” in my mind. And a holey chunk of hose in the trashcan.

Supercon News

Just briefly, in case you missed it: Tickets are on sale now for Supercon Ten, and we’ve extended the call for participation by another two weeks. If you’re a Hackaday fan, you owe it to yourself to join us at our annual gathering.