Personalization, Industrial Design, And Hacked Devices

[Maya Posch] wrote up an insightful, and maybe a bit controversial, piece on the state of consumer goods design: The Death Of Industrial Design And The Era Of Dull Electronics. Her basic thesis is that the “form follows function” aesthetic has gone too far, and all of the functionally equivalent devices in our life now all look exactly the same. Take the cellphone, for example. They are all slabs of screen, with a tiny bezel if any. They are non-objects, meant to disappear, instead of showcases for cool industrial design.

Of course this is an extreme example, and the comments section went wild on this one. Why? Because we all want the things we build to be beautiful and functional, and that has always been in conflict. So even if you agree with [Maya] on the suppression of designed form in consumer goods, you have to admit that it’s not universal. For instance, none of our houses look alike, even though the purpose is exactly the same. (Ironically, architecture is the source of the form follows function fetish.) Cars are somewhere in between, and maybe the cellphone is the other end of the spectrum from architecture. There is plenty of room for form and function in this world.

But consider the smartphone case – the thing you’ve got around your phone right now. In a world where people have the ultimate homogeneous device in their pocket, one for which slimness is a prime selling point, nearly everyone has added a few millimeters of thickness to theirs, aftermarket, in the form of a decorative case. It’s ironically this horrendous sameness of every cell phone that makes us want to ornament them, even if that means sacrificing on the thickness specs.

Is this the same impetus that gave us the cyberdeck movement? The custom mechanical keyboard? All kinds of sweet hacks on consumer goods? The need to make things your own and personal is pretty much universal, and maybe even a better example of what we want out of nice design: a device that speaks to you directly because it represents your work.

Granted, buying a phone case isn’t necessarily creative in the same way as hacking a phone is, but it at least lets you exercise a bit of your own design impulse. And it frees the designers from having to make a super-personal choice like this for you. How about a “nothing” design that affords easy personalized ornamentation? Has the slab smartphone solved the form-versus-function fight after all?

Hackaday Podcast Episode 330: Hover Turtles, Dull Designs, And K’nex Computers

What did you miss on Hackaday last week? Hackaday’s Elliot Williams and Al Williams are ready to catch you up on this week’s podcast. First, though, the guys go off on vibe coding and talk about a daring space repair around Jupiter.

Then it is off to the hacks, including paste extruding egg shells, bespoke multimeters, and an 8-bit mechanical computer made from a construction toy set.

For can’t miss articles, you’ll hear about boring industrial design in modern cell phones and a deep dive into how fresh fruit makes it to your table in the middle of the winter.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

The DRM-free MP3 was stored in a public refrigerated warehouse to ensure freshness. Why not download it and add it to your collection?

Continue reading “Hackaday Podcast Episode 330: Hover Turtles, Dull Designs, And K’nex Computers”

This Week In Security: Sharepoint, Initramfs, And More

There was a disturbance in the enterprise security world, and it started with a Pwn2Own Berlin. [Khoa Dinh] and the team at Viettel Cyber Security discovered a pair of vulnerabilities in Microsoft’s SharePoint. They were demonstrated at the Berlin competition in May, and patched by Microsoft in this month’s Patch Tuesday.

This original exploit chain is interesting in itself. It’s inside the SharePoint endpoint, /_layouts/15/ToolPane.aspx. The code backing this endpoint has a complex authentication and validation check. Namely, if the incoming request isn’t authenticated, the code checks for a flag, which is set true when the referrer header points to a sign-out page, which can be set arbitrarily by the requester. The DisplayMode value needs set to Edit, but that’s accessible via a simple URL parameter. The pagePath value, based on the URL used in the call, needs to start with /_layouts/ and end with /ToolPane.aspx. That particular check seems like a slam dunk, given that we’re working with the ToolPane.aspx endpoint. But to bypass the DisplayMode check, we added a parameter to the end of the URL, and hilariously, the pagePath string includes those parameters. The simple work-around is to append another parameter, foo=/ToolPane.aspx.

Putting it together, this means a POST of /_layouts/15/ToolPane.aspx?DisplayMode=Edit&foo=/ToolPane.aspx with the Referrer header set to /_layouts/SignOut.aspx. This approach bypasses authentication, and allows a form parameter MSOTlPn_DWP to be specified. These must be a valid file on the target’s filesystem, in the _controltemplates/ directory, ending with .iscx. But it grants access to all of the internal controls on the SafeControls list.

There’s an entire second half to [Khoa Dinh]’s write-up, detailing the discovery of a deserialization bug in one of those endpoints, that also uses a clever type-confusion sort of attack. The end result was remote code execution on the SharePoint target, with a single, rather simple request. Microsoft rolled out patches to fix the exploit chain. The problem is that Microsoft often opts to fix vulnerabilities with minimal code changes, often failing to fix the underlying code flaws. This apparently happened in this case, as the authentication bypass fix could be defeated simply by adding yet another parameter to the URL.

These bypasses were found in the wild on July 19th, and Microsoft quickly confirmed. The next day, the 20th, Microsoft issued an emergency patch to address the bypasses. The live exploitation appears to be coming from a set of Chinese threat actors, with a post-exploitation emphasis on stealing data and maintaining access. There seem to be more than 400 compromised systems worldwide, with some of those being rather high profile.

Continue reading “This Week In Security: Sharepoint, Initramfs, And More”

The Epochalypse: It’s Y2K, But 38 Years Later

Picture this: it’s January 19th, 2038, at exactly 03:14:07 UTC. Somewhere in a data center, a Unix system quietly ticks over its internal clock counter one more time. But instead of moving forward to 03:14:08, something strange happens. The system suddenly thinks it’s December 13th, 1901. Chaos ensues.

Welcome to the Year 2038 problem. It goes by a number of other fun names—the Unix Millennium Bug, the Epochalypse, or Y2K38. It’s another example of a fundamental computing limit that requires major human intervention to fix. 

Continue reading “The Epochalypse: It’s Y2K, But 38 Years Later”

Fixing Human Sleep With Air Under Pressure

By and large, the human body is designed to breathe from birth, and keep breathing continuously until death. Indeed, if breathing stops, lifespan trends relatively rapidly towards zero. There’s a whole chunk of the brain and nervous system dedicated towards ensuring oxygen keeps flowing in and carbon dioxide keeps flowing out.

Unfortunately, the best laid plans of our body often go awry. Obstructive sleep apnea is a condition in which a person’s airways become blocked by the movement of soft tissues in the throat, preventing the individual from breathing. It’s a mechanical problem that also has a mechanical solution—the CPAP machine.

Continue reading “Fixing Human Sleep With Air Under Pressure”

Hackaday Links Column Banner

Hackaday Links: July 20, 2025

In the relatively short time that the James Webb Space Telescope has been operational, there’s seemingly no end to its list of accomplishments. And if you’re like us, you were sure that Webb had already achieved the first direct imaging of a planet orbiting a star other than our own a long time ago. But as it turns out, Webb has only recently knocked that item off its bucket list, with the direct visualization of a Saturn-like planet orbiting a nearby star known somewhat antiseptically as TWA 7, about 111 light-years away in the constellation Antlia. The star has a significant disk of debris orbiting around it, and using the coronagraph on Webb’s MIRI instrument, astronomers were able to blot out the glare of the star and collect data from just the dust. This revealed a faint infrared source near the star that appeared to be clearing a path through the dust.

Continue reading “Hackaday Links: July 20, 2025”

Hackaday Podcast Episode 329: AI Surgery, A Prison Camp Lathe, And A One Hertz Four-Fer

Join Hackaday Editors Elliot Williams and Tom Nardi as they talk about their favorite hacks and stories from the previous week. They’ll start things off with a small Supercon update, and go right into fusion reactors, AI surgeons, planned obsolescence, and robotic cats and dogs. They’ll also go over several entries from the ongoing 2025 One Hertz Challenge, an ambitious flight simulator restoration project, old school lightning detectors, and how Blu-ray won the battle against HD DVD but lost the war against streaming. Stick around to the end to hear an incredible story about a clandestine machine shop in a WWII prisoner of war camp, and the valiant fight to restore communications with the Lunar Trailblazer spacecraft.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Download in DRM-free MP3 and add it to your collection.

Continue reading “Hackaday Podcast Episode 329: AI Surgery, A Prison Camp Lathe, And A One Hertz Four-Fer”