Why Learn Ancient Tech?

The inner orbits of the Hackaday solar system have been vibrating with the announcement of the 2022 Hackaday Supercon badge. The short version of the story is that it’s a “retrocomputer”. But I think that’s somehow selling it short a little bit. The badge really is an introduction to machine language or maybe a programming puzzle, a ton of sweet blinky lights and clicky buttons, and what I think of as a full-stack hacking invitation.

Voja Antonic designed the virtual 4-bit machine that lives inside. What separates this machine from actual old computers is that everything that you might want to learn about its state is broken out to an LED on the front face, from the outputs of the low-level logic elements that compose the ALU to the RAM, to the decoder LEDs that do double-duty as a disassembler. You can see it all, and this makes it an unparalleled learning aid. Or at least it gives you a fighting chance.

So why would you want to learn a made-up machine language from a non-existent CPU? Tom Nardi and I were talking about our experiences on the podcast, and we both agreed that there’s something inexplicably magical about flipping bits, calling the simplest of computer operations into action, and nonetheless making it do your bidding. Or rather, it’s anti-magical, because what’s happening is the stripping away of metaphors and abstractions. Peering not just behind, but right through the curtain. You’re seeing what’s actually happening for once, from the bottom to the top.

As Voja wrote on the silkscreen on the back of the badge itself: “A programmer who has never coded 1s and 0s in machine language is like a child who has never run barefoot on the grass.” It’s not necessary, or maybe even relevant, but learning a complex machine in its entirety is simultaneously grounding and mind-expanding. It is simply an experience that you should have.

ERRF 22: After Two Years, Back And Better Than Ever

When the COVID-19 pandemic hit, it became clear that organizers would have to pull the plug on any large social events they had planned. Many organizers decided to take their events online, but blurry web streams and meme-filled Discord channels can only get you so far. At this point we’re all keenly aware that, while they do have some advantages, virtual events are not the same as the real thing.

Which is why I was looking forward to making the trip down to Bel Air, Maryland for the first in-person East Coast RepRap Festival (ERRF) since 2019. I’m happy to report that the event, which was still in its infancy prior to the pandemic, was just as lively this year as it was doing my previous trips. Perhaps even more so, as local hackers and makers were eager for an outlet to show of their latest creations.

I’ll admit that part of me was concerned the two-year shutdown would have robbed ERRF of the momentum organizers had worked so hard to build. But judging by what I saw over the weekend, it seems even a global pandemic couldn’t slow down this fantastic event.

Continue reading “ERRF 22: After Two Years, Back And Better Than Ever” →

Hackaday Podcast 189: Seven Segments Three Ways, Candle Code, DIY E-Readers, And The Badge Reveal

This week Hackaday Editor-in-Chief Elliot Williams and Managing Editor Tom Nardi will discuss the return of the East Coast RepRap Festival, the scientific application of slices of baloney, and the state of the art in homebrew e-readers. The discussion weaves its way through various reimaginings of the seven (or more) segment display, an impressive illuminated headboard that comes with its own science-fiction film, and the surprising difficulty of getting a blinking LED to actually look like a flame. Stick around to the end to find out why iPhones are freaking out on amusement park rides, and to hear all the details about this year’s Supercon badge.

Direct download your own!

Continue reading “Hackaday Podcast 189: Seven Segments Three Ways, Candle Code, DIY E-Readers, And The Badge Reveal” →

This Week In Security: Npm Timing Leak, Siemens Universal Key, And PHP In PNG

First up is some clever wizardry from the [Aqua Nautilus] research team, who discovered a timing attack that leaks information about private npm packages. The setup is this, npm hosts both public and private node.js packages. The public ones are available to everyone, but the private packages are “scoped”, meaning they live within a private namespace, “@owner/packagename” and are inaccessible to the general public. Trying to access the package results in an HTTP 404 error — the same error as trying to pull a package that doesn’t exist.


The clever bit is to keep trying, and really pay attention to the responses. Use npm’s API to request info on your target package, five times in a row. If the package name isn’t in use, all five requests will take the expected amount of time. That request lands at the service’s backend, a lookup is performed, and you get the response. On the flipside if your target package does exist, but is privately scoped, the first request returns with the expected delay, and the other four requests return immediately. It appears that npm has front-end that can cache a 404 response for a private package. That response time discrepancy means you can map out the private package names used by a given organization in their private scope.

Now this is all very interesting, but it turns into a plausible attack when combined with typosquatting and dependency confusion issues. Those attacks are two approaches to the same goal, get a node.js deployment to run a malicious package instead of the legitimate one the developer intended. One depends on typos, but dependency confusion just relies on a developer not explicitly defining the scope of a package.

Continue reading “This Week In Security: Npm Timing Leak, Siemens Universal Key, And PHP In PNG” →

Publish Or Perish: Data Storage And Civilization

Who do you think of when you think of ancient civilizations? Romans? Greeks? Chinese? India? Egyptians?  What about the Scythians, the Muisca, Gana, or the Kerma? You might not recognize that second group as readily because they all didn’t have writing systems. The same goes, to a lesser extent, for the Etruscans, the Minoans, or the inhabitants of Easter Island where they wrote, but no one remembers how to read their writing. Even the Egyptians were mysterious until the discovery of the Rosetta stone. We imagine that an author writing in Etruscan didn’t think that no one would be able to read the writing in the future–they probably thought they were recording their thoughts for all eternity. Hubris? Maybe, but what about our documents that are increasingly stored as bits somewhere?

Continue reading “Publish Or Perish: Data Storage And Civilization” →

The 2022 Supercon Badge Is A Handheld Trip Through Computing History

Over the last several years, there’s been a trend towards designing ever more complex and powerful electronic event badges. Color displays, sensors, WiFi, USB, Bluetooth — you name it, and there’s probably a con badge out there that has packed it in. Even our own 2019 Supercon broke new ground with the inclusion of a Lattice LFE5U-45F FPGA running a RISC-V core. Admittedly, observing this unofficial arms race has been fascinating. But as we all know, a hacker isn’t defined by the tools at their disposal, but rather the skill and imagination with which they wield them.

So this year, we’ve taken a slightly different approach. Rather than try and cram the badge with even more state of the art hardware than we did in 2019, we’ve decided to go back to the well. The 2022 Supercon badge is a lesson in what it means to truly control a piece of hardware, to know what each bit of memory is doing, and why. Make no mistake, it’s going to be a challenge. In fact, we’d wager most of the people who get their hands on the badge come November 4th will have never worked on anything quite like it before. Folks are going to get pulled out of their comfort zones, but of course, that’s the whole idea.

Continue reading “The 2022 Supercon Badge Is A Handheld Trip Through Computing History” →

2022 Supercon: More Talks, More Speakers!

Round two of the 2022 Supercon talks is out, and it’s another superb lineup. This round is full of high voltage, art, and science. If you’ve ever dreamed of starting up your own hacker company, making your own refrigerator, teaching your toaster to think, or just making your breath glow, then Supercon is where you want to be Nov. 4-6!

Supercon will sell out, so get your tickets now before it’s too late. And stay tuned for the next and final round of talk reveals next week! Plus the keynote speaker reveal. Plus workshops. Oh my. Continue reading “2022 Supercon: More Talks, More Speakers!” →