This Week In Security: Apple Backdoors Curl, Tor’s New Bridge, And GhostRace

March 15, 2024 by Jonathan Bennett 8 Comments

OK, that headline is a bit of a cheap shot. But if you run the curl binary that Apple ships, you’re in for a surprise if you happen to use the --cacert flag. That flag specifies that TLS verification is only to be done using the certificate file specified. That’s useful to solve certificate mysteries, or to make absolutely sure that you’re connecting to the server you expect.

What’s weird here is that on a MacOS, using the Apple provided curl binary, --cacert doesn’t limit the program to the single certificate file. On an Apple system, the verification falls back to the system’s certificate store. This is an intentional choice by Apple, but not one that’s aimed particularly at curl. The real magic is in Apple’s SSL library, which forces the use of the system keychain.

The current state of things is that this option is simply not going to do the right thing in the Apple provided binary. It’s documented with the note that “this option is supported for backward compatibility with other SSL engines, but it should not be set.” It’s an unfortunate situation, and we’re hopeful that a workaround can be found to restore the documented function of this option. Continue reading “This Week In Security: Apple Backdoors Curl, Tor’s New Bridge, And GhostRace” →

Retrotechtacular: Air Mail For The Birds

March 14, 2024 by Al Williams 9 Comments

Today, if you want to send a message to a distant location, you’ll probably send an e-mail or a text message. But it hasn’t always been that easy. Military commanders, in particular, have always needed ways to send messages and were early adopters of radio and, prior to that, schemes like semaphores, drums, horns, Aldis lamps, and even barrels of water to communicate over distances.

One of the most reliable ways to pass messages, even during the last world war, was by carrier pigeon. Since the U.S. Army Signal Corps handled anything that included messages, it makes sense that the War Department issued TM 11-410 about how to use and care for pigeons. Think of it as the network operations guide of 1945. The practice, though, is much older. There is evidence that the Persians used pigeons in the 6th century BC, and Julius Caesar’s army also used the system.

You wouldn’t imagine that drawing an assignment in the Signal Corps might involve learning about breeding pigeons, training them, and providing them with medical attention, but that’s what some Signal Corps personnel did. The Army started experimenting with pigeons in 1878, but the Navy was the main user of the birds until World War I, when the U.S. Pigeon Intelligence Service was formed. In World War II, they saw use in situations where radio silence was important, like the D-Day invasion.

The Navy also disbanded its earlier Pigeon Messenger Service. It then returned to avian communications during the World Wars, using them to allow aviators to send messages back to base without radio traffic. The Navy had its own version of the pigeon manual.

Continue reading “Retrotechtacular: Air Mail For The Birds” →

FLOSS Weekly Episode 774: Let’s Get Rusty

March 13, 2024 by Jonathan Bennett 5 Comments

This week, Jonathan Bennett chats with Herbert Wolverson about Rust! Is it really worth the hype? Should you have written that in Rust? What’s up with “if let some” anyways? And what’s the best way to get started with this exciting language? We also cover comparisons with other languages like Ada, what drives us crazy about Cargo, and the fascinating world of kernel development!

Continue reading “FLOSS Weekly Episode 774: Let’s Get Rusty” →

Review: The New Essential Guide To Electronics In Shenzhen

March 13, 2024 by Jenny List 15 Comments

The city of Shenzhen in China holds a special fascination for the electronic hardware community, as the city and special economic zone established by the Chinese government at the start of the 1980s it has become probably one of the most important in the world for electronic manufacturing. If you’re in the business of producing electronic hardware you probably want to do that business there, and if you aren’t, you will certainly own things whose parts were made there. From the lowly hobbyist who buys a kit of parts on AliExpress through the project featured on Hackaday with a Shenzhen-made PCB, to the engineer bringing an electronic product to market, it’s a place which has whether we know it or not become part of our lives.

First, A Bit Of History

A picture of booths in a Shenzhen market — These are the markets we have been looking for. Credit: Naomi Wu.

At a superficial level it’s very easy to do business there, as a quick trawl through our favourite Chinese online retailers will show. But when you’ve graduated from buying stuff online and need to get down to the brass tacks of sourcing parts and arranging manufacture, it becomes impossible to do so without being on the ground. At which point for an American or European without a word of Chinese even sourcing a resistor becomes an impossibly daunting task. To tackle this, back in 2016 the Chinese-American hardware hacker and author Andrew ‘bunnie’ Huang produced a slim wire-bound volume, The Essential Guide to Electronics in Shenzhen. This book contained both a guide to the city’s legendary Huaquanbei electronics marts and a large section of point-to-translate guides for parts, values, and all the other Chinese phrases which a non-Chinese-speaker might need to get their work done in the city. It quickly became an essential tool for sourcing in Shenzhen, and more than one reader no doubt has a well-thumbed copy on their shelves.

There are places in the world where time appears to move very slowly, but this Chinese city is not one of them. A book on Shenzhen written in 2016 is now significantly out of date, and to keep pace with its parts that have since chanced beyond recognition, an update has become necessary. In this endeavour the mantle has passed to the hardware hacker and Shenzhen native Naomi Wu, someone with many years experience in introducing the people, culture, and industries of her city to the world. Her updated volume, The New Essential Guide to Electronics in Shenzhen has been the subject of a recent crowdfunding effort, and I was lucky enough to snag one. It’s a smart hardcover spiral-bound book with a red and gold cover, and it’s time to open it up and take a look. Continue reading “Review: The New Essential Guide To Electronics In Shenzhen” →

PCB Design Review: DPI-LVDS Sony Vaio LCD Devboard

March 12, 2024 by Arya Voronova 11 Comments

Ordering a PCB with mistakes sucks. We should help each other avoid such mistakes – especially newcomers. One of the best ways to avoid these mistakes, especially if it’s your first one, is to get a few other people to look at it. You deserve to get a PCB that is as functional and as helpful as humanly possible, so that you can be happy with your project, and feel ever so slightly more confident in yourself in whatever you shall set out to do next.

At the end of last year, I put out a call for design review submissions, and we’ve received enough projects to make me feel overwhelmed for a bit. A design review has always felt like a personal thing, and here we are doing them in public. But in that sense, we hope that everyone can learn from them, and we hope to push forward a healthy review culture.

What’s more, these articles won’t just be design review. Every project I’m highlighting is worthy of a Hackaday feature just on its own, so tune in and learn more about them!

Today’s Contestant

For this example, I will be walking through a review I’ve already given someone with a pretty cool board, for a pretty cool project I’ve already shown you. Remember the Sony Vaio remake project? A fair bit of people have reached out to me afterwards, and one of them, [Exentio] also had the same Sony Vaio rebuild idea in mind. We started chatting, and he decided to tackle one of the project’s milestones, and perhaps the most crucial one – adapting the LCD.

Continue reading “PCB Design Review: DPI-LVDS Sony Vaio LCD Devboard” →

Illustrated Kristina with an IBM Model M keyboard floating between her hands.

Keebin’ With Kristina: The One With The Pocket Cyberdeck

March 12, 2024 by Kristina Panos 10 Comments

When you find something you love doing, you want to do it everywhere, all the time. Such is the case with [jefmer] and programming. The trouble is, there is not a single laptop or tablet out there that really deals well with direct sunlight. So, what’s a hacker to do during the day? Stay indoors and suffer?

The answer is a project like Pocket Pad. This purpose-built PDA uses a Nice! Nano and a pair of two very low-power ST7302-driven monochrome displays. They have no backlight, but they update much faster than e-paper displays. According to [jefmer], the brighter the ambient light, the more readable the displays become. What more could you want? (Besides a backlight?)

The miniature PocketType 40% is a little small for touch typing, but facilitates thumbs well. [jefmer] added those nice vinyl transfer legends and sealed them with clear nail polish.

All of the software including the keyboard scanner is written in Espruino, which is an implementation of JavaScript that targets embedded devices. Since it’s an interpreted language, [jefmer] can both write and execute programs directly on the Pocket Pad, using the bottom screen for the REPL. I’d sure like to have one of these in my pocket!
Continue reading “Keebin’ With Kristina: The One With The Pocket Cyberdeck” →

Share Your Projects: KiCad Automations And Pretty Renders

March 11, 2024 by Arya Voronova 23 Comments

I have a pretty large GitHub repository, with all of my boards open-sourced there. Now, I’m finally facing the major problem it has – it can be uncomfortable for others to work with. I don’t store Gerber files in the repository because that will interfere with how Git functions – you’re supposed to only have source files in the repo. Yet, when someone needs Gerbers for my PCB, or a schematic PDF, or just to see how the board looks before they clone the entire repository, I often don’t have a good option for them.

In my experience as a hacker, being able to find others’ PCBs on GitHub is simply wonderful, but a PCB repository without a README feels barren, and a PCB README without pictures makes me sad. On the other hand, not having these files autogenerate is uncomfortable – updating a picture every time is a major drawback in particular.

Let’s take a look at some KiCad Git integrations, and see what they have to offer.

kicad_cli

We’ve mentioned kicad_cli back when KiCad 7 got released, and in the recently released KiCad 8, it’s only become more powerful. Before, it could do gerbers and schematic PDFs, but now, it can even do DRC checks – which is ideal if you want to add a hook for any pull requests you might encounter.

Continue reading “Share Your Projects: KiCad Automations And Pretty Renders” →