Ask Hackaday: Is Windows XP Source Code Leak A Bad Thing?

September 25, 2020 by Mike Szczys 57 Comments

News comes overnight that the Windows XP source code has been leaked. The Verge says they have “verified the material as legitimate” and that the leak also includes Windows Server 2003 and some DOS and CE code as well. The thing is, it has now been more than six years since Microsoft dropped support for XP, does it really matter if the source code is made public?

The Poison Pill

As Erin Pinheiro pointed out in her excellent article on the Nintendo IP leak earlier this year (perhaps the best Joe Kim artwork of the year on that one, by the way), legitimate developers can’t really make use of leaked code since it opens them up to potential litigation. Microsoft has a formidable legal machine that would surely go after misuse of the code from a leak like this. Erin mentions in her article that just looking at the code is the danger zone for competitors.

Even if other software companies did look at the source code and implement their own improvements without crossing the legal line, how much is there still to gain? Surely companies with this kind of motivation would have reverse engineered the secret sauce of the long dead OS by now, right?

Spy vs. Spy

The next thing that comes to mind are the security implications. At the time of writing, statcount pegs Windows XP at a 0.82% market share which is still going to be a very large number of machines. Perhaps a better question to consider is what types of machines are still running it? I didn’t find any hard data to answer this question, however there are dedicated machines like MRIs that don’t have easy upgrade paths and still use the OS and there is an embedded version of XP that runs on point-of-sale, automated teller machines, set-top boxes, and other long-life hardware that are notorious for not being upgraded by their owners.

Continue reading “Ask Hackaday: Is Windows XP Source Code Leak A Bad Thing?” →

Hackaday Podcast 086: News Overflow, Formula 1/3 Racer, Standing Up For Rubber Duckies, And Useless Machine Takes A Turn

September 25, 2020 by Mike Szczys No comments

Hackaday editors Elliot Williams and Mike Szczys peruse the world of hacks. There was so much news this week that we lead off the show with a rundown to catch you up. Yet there is still no shortage of hardware hacks, with prosthetic legs for your rubber ducky, a RC cart that channels the spirit of Formula 1, and a project that brings 80’s video conferencing hardware to Zoom. There’s phosphine gas on Venus and unlimited hacking projects inside your guitar. The week wouldn’t be complete without the joy of riffing on the most useless machine concept.

Take a look at the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download (60 MB or so.)

Continue reading “Hackaday Podcast 086: News Overflow, Formula 1/3 Racer, Standing Up For Rubber Duckies, And Useless Machine Takes A Turn” →

This Week In Security: UTorrent Vulnerable, Crowd-Sourcing Your Fail2Ban, And Cryptographers At Casinos

September 25, 2020 by Jonathan Bennett 22 Comments

The uTorrent client was recently updated to fix a null pointer dereference (CVE-2020-8437), discovered by [whtaguy]. Triggering the dereference simply crashes the client — so far an actual RCE hasn’t been found. Given the nature of the null pointer dereference, it’s possible this bug is limited to denial of service. That’s extremely good, because the flaw is extremely easy to target.

BitTorrent is a clever protocol. It’s still used to distribute large files, like Linux ISOs. The concept is simple: Split a large file into small chunks. Send the chunks to a client one at a time. As each chunk is received, the client sends a copy of that chunk to the next client. As a result of this peer-to-peer (p2p) arrangement, the bandwidth available to the server is greatly multiplied. As with all other p2p arrangements, the sticking point is how to make those connections between peers, particularly when most of the world’s desktops are behind NAT routers. In practice, for two peers to share data, at least one of them has to have a port opened or forwarded to the client. This is often accomplished through Universal Plug-n-Play (UPnP) or the NAT Port Mapping Protocol (NAT-PMP). The idea of both protocols are the same; a client on an internal device can request a temporary port forward without manual intervention. Whether it’s a good idea to allow automatic port forwards is another issue for another day. Continue reading “This Week In Security: UTorrent Vulnerable, Crowd-Sourcing Your Fail2Ban, And Cryptographers At Casinos” →

In Praise Of The DT830, The Phenomenal Instrument You Probably Don’t Recognise For What It Is

September 24, 2020 by Jenny List 132 Comments

If we had to make a guess at the single piece of electronic bench equipment owned by the highest proportion of Hackaday readers, it would not be a budget oscilloscope from Rigol, nor would it be a popular portable soldering iron like the TS100. Instead we’re guessing that it’s a multimeter, and not even the most accomplished one.

The DT830 is a genericised Chinese-manufactured 3.5 digit digital multimeter that can be had for an astonishingly low price. Less than a decent hamburger gets you an instantly recognisable plastic case with a chunky rotary range selector switch, and maybe a socket for some kind of transistor or component tester. Make sure that there is a 9 volt battery installed, plug in the pair of test leads, and you’re in business for almost any day-to-day electrical or electronic measurement. They’ve been available in one form or another for decades and have been the subject of innumerable give-aways and loss-leader offers, so it’s a reasonsble guess that you’ll have one somewhere. I have three as far as I know, they make great on-the-go instruments and have proved themselves surprisingly reliable for what they are. Continue reading “In Praise Of The DT830, The Phenomenal Instrument You Probably Don’t Recognise For What It Is” →

Inputs Of Interest: BIGtrack Mouse Might Make You Squeal

September 22, 2020 by Kristina Panos 20 Comments

You know me, I like to get my feet involved when I use my computer, which happens pretty much all day every day at this point. My cache of pedal inputs keeps growing like mushrooms in the darkness under my desk: every upper case letter in this post and dozens more have been capitalized with a shift pedal!

Naturally, I’ve thought about what it might be like to mouse with my toes. The more time I can spend with both hands on the keyboard, the better. I started sniffing around for foot-sized trackball candidates, thinking maybe I could just build one with regular mouse guts. Then I found a 15-year-old Golden Tee home edition console at a thrift store. It has a large ball and four buttons, so it seemed ripe for turning into a mouse as-is, or just stealing the ball to build my own. So far, that hasn’t happened, though I did solder a bunch of wires for testing out the controls. Continue reading “Inputs Of Interest: BIGtrack Mouse Might Make You Squeal” →

Axe Hacks: New Sounds For Your Electric Guitar Beginning From What Makes Them Tick

September 22, 2020 by Sven Gregori 30 Comments

Creating music is a perfect hobby for anyone into hacking, and the amount of musical hacks and self-made instruments we come across here makes that supremely evident. It’s just a great match: you can either go full-on into engineering mode as music is in the end “just” applied physics, or simply ignore all of the theory and take an artistic approach by simply doing whatever feels right. The sweet spot is of course somewhere in between — a solid grasp of some music theory fundamentals won’t hurt, but too much overthinking eventually will.

The obvious choice to combine a favorite pastime like electronics or programming with creating music would be in the realm of electronic music, and as compelling as building synthesizers sounds, I’ll be going for the next best thing instead: the electric guitar. Despite its general popularity, the enormous potential that lies within the electric guitar is rarely fully utilized. Everyone seems to just focus on amp settings and effect pedals when looking for that special or unique sound, while the guitar itself is seen as this immutable object bestowed on us by the universe with all its predestined, magical characteristics. Toggle a pickup switch, and if we’re feeling extra perky, give that tone pot a little spin, that’s all there is to it.

The thing is, the guitar’s electrical setup — or wiring — in its stock form simply is as boring and generic as it can get. Sure, it’s a safe choice that does the job well enough, but there’s this entirely different world of tonal variety and individual controllability locked inside of it, and all it really takes is a screwdriver and soldering iron to release it. Plus, this might serve as an interesting application area to dive into simple analog electronics, so even if guitars aren’t your thing yet, maybe this will tickle your creativity bone. And if bass is more your thing, well, let me be ignorant and declare that a bass is just a longer guitar with thicker, lower-tuned strings, meaning everything that follows pretty much applies to bass as well, even if I talk about guitars.

However, in order to modify something, it helps to understand how it functions. So today, we’ll only focus on the basics of an electric guitar, i.e. what’s inside them and what defines and affects their tone. But don’t worry, once we have the fundamentals covered, we’ll be all settled to get to the juicy bits next time.

Continue reading “Axe Hacks: New Sounds For Your Electric Guitar Beginning From What Makes Them Tick” →

Linux Fu: Simple SSH File Sharing

September 21, 2020 by Al Williams 28 Comments

If you have more than one Linux computer, you probably use ssh all the time. It is a great tool, but I’ve always found one thing about it strange. Despite having file transfer capabilities in the form of scp and sftp, there is no way to move a file back or forth between the local and remote hosts without starting a new program on the local machine or logging in from the remote machine back to the local machine.

That last bit is a real problem since you often access a server from behind a firewall or a NAT router with an ephemeral IP address, so it can’t reconnect to you anyway. It would be nice to hit the escape character, select a local or remote file, and teleport it across the interface, all from inside a single ssh session.

I didn’t quite get to that goal, but I did get pretty close. I’ll show you a script that can automatically mount a remote directory on the local machine. You’ll need sshfs on the local machine, but no changes on the remote machine where you may not be able to install software. With a little more work, and if your client has an ssh server running, you can mount a local directory on the remote machine, too. You won’t need to worry about your IP address or port blocking. If you can log into the remote machine, you are good.

Combined, this got me me very close to my goal. I can be working in a shell on either side and have access to read or write files on the other side. I just have to set it up carefully. Continue reading “Linux Fu: Simple SSH File Sharing” →