Hackaday Columns

4113 Articles

This excellent content from the Hackaday writing crew highlights recurring topics and popular series like Linux-Fu, 3D-Printering, Hackaday Links, This Week in Security, Inputs of Interest, Profiles in Science, Retrotechtacular, Ask Hackaday, Teardowns, Reviews, and many more.

Fail Of The Week: The Little Remote-Controlled Snowblower That Couldn’t

March 3, 2024 by 17 Comments

[Punxatawny Phil]’s prognostications aside, winter isn’t over up here in the Northern Hemisphere, and the snow keeps falling. If you’re sick of shoveling the driveway and the walk and you don’t have a kid handy to rope into the job, relax —  this rapidly assembled junkyard RC snowblower will do just as crappy a job while you stay nice and warm inside.

This build seemed to have a lot of potential at the start, based as it was on a second-hand track-drive snowblower, something that was presumably purpose-built for the job at hand. [Lucas] quickly got to work on it; he left the original gasoline engine to power the auger but took most of the transmission off so that each track could be driven separately with a wheelchair motor.  That seemed like a solid idea as far as steering goes, but the fact that he chose to drive the 24 volt motors with a single 12 volt deep-cycle battery worked against him out in the snow.

With a battery upgrade for better traction, the snowblower actually got around in the snow pretty well. [Lucas] also added some nice features, like a linear actuator to remotely engage the auger — a nice safety touch when kids and pets are around — and a motor to control the direction of the chute. Even these improvements weren’t enough, though; it worked insofar as it moved snow from where it was to where it wasn’t, but didn’t really move it very far. To the casual observer, it seems like there’s just not enough weight to the machine, allowing it to ride up over the snow rather than scraping the driveway clean. Check out the video below and see what you think.

Now, we’re not picking on [Lucas] here. Far from it — we enjoyed this build as much as some of his other stuff, like his scratch-built CO2 laser tube and his potty-mouthed approach to Kaizen tool organization. We still think this one has a lot of potential, and we’re glad he vowed to continue working on it for next winter.

Continue reading “Fail Of The Week: The Little Remote-Controlled Snowblower That Couldn’t” →

Hackaday Links Column Banner

Hackaday Links: March 3, 2024

March 3, 2024 by 26 Comments

Who’d have thought that $30 doorbell cameras would end up being security liabilities? That’s the somewhat obvious conclusion reached by Consumer Reports after looking at some entry-level doorbell cameras available through the usual outfits and finding glaring security gaps which are totally not intentional in any way.

All these cameras appear to be the same basic hardware inside different enclosures, most supporting the same mobile app. Our favorite “exploit” for these cameras is the ability to put them into a pairing mode with the app, sometimes by pressing a public-facing button. Slightly more technically challenging would be accessing images from the app using the camera’s serial number, or finding file names being passed in plain text while sniffing network traffic. And that’s just the problems CR identified; who knows what else lurks under the covers? Some retailers have stopped offering these things, others have yet to, so buyer beware.

Speaking of our techno-dystopian surveillance state, if you’ve had it with the frustrations and expense of printers, has Hewlett-Packard got a deal for you. They want you to never own a printer again, preferring that you rent it from them instead. Their “All-In Plan” launched this week, which for $6.99 a month will set up up with an HP Envy inkjet printer, ink deliveries, and 24/7 tech support. It doesn’t appear that paper is included in the deal, so you’re on your own for that, but fear not — you won’t go through much since the entry-level plan only allows 20 prints per month. Plans scale up to 700 prints per month from an OfficeJet Pro for the low, low price of $36. The kicker, of course, is that your their printer has to be connected to the Internet, and HP can pretty much brick the thing anytime they want to. The terms of service also explicitly state that they’ll be sending your information to advertising partners, so that’ll be fun. This scheme hearkens back to the old pre-breakup days of AT&T, where you rented your phone from the phone company. That model made a lot more sense when the phone (probably) wasn’t listening in on everything you do. This just seems like asking for trouble.

“Enhance, enhance…” Credit: NASA/JPL-Caltech/LANL/CNES/IRAP/Simeon Schmauß

It’s been a while since Ingenuity‘s final rough landing on Mars permanently grounded the overachieving helicopter, long enough that it’s time for the post-mortem analyses to begin. The first photographic evidence we had was a shadowgram from one of the helicopter’s navigational cameras, showing damage to at least one of the rotor tips, presumably from contact with the ground. Then we were treated to a long-distance shot from Ingenuity‘s rover buddy Perseverance, which trained its MASTCAM instruments on the crash zone and gave us a wide view of its lonely resting place.

Now, geovisual design student [Simeon Schmauβ] has taken long shots made with the rover’s SuperCam instrument and processed them into amazingly detailed closeups, which show just how extensive the damage really is. One rotor blade sheared clean off on contact, flying 15 meters before gouging a hole in the regolith. Another blade looks to be about half gone, while the remaining two blades show the damaged tips we’ve already seen. That the helicopter is still on its feet given the obvious violence of the crash is amazing, as well as an incredible piece of luck, since it means the craft’s solar panel is pointing in roughly the right direction to keep it powered up.

Continue reading “Hackaday Links: March 3, 2024” →

Hackaday Podcast Episode 260: KiCad 8, Two Weather Stations, And Multiple I2Cs

March 1, 2024 by 1 Comment

It’s a leap year, so Elliot and Dan put the extra day to good use tracking down all the hottest hacks from the past week and dorking out about them. There’s big news in the KiCad community, and we talked about all the new features along with some old woes. Great minds think alike, apparently, since two different e-ink weather stations made the cut this week, as did a floating oscilloscope, an automated film-developing tank, and some DIY solar panels.

We talked about a hacker who figured out that water makes a pretty good solar storage medium, and it’s cheaper than lithium, another who knows that a crappy lathe is better than no lathe, and what every hacker should know about Ethernet. Is there a future for room-temperature superconductors? Maybe it just depends on how cold the room is.

 

Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:

Grab a copy for yourself if you want to listen offline.

Continue reading “Hackaday Podcast Episode 260: KiCad 8, Two Weather Stations, And Multiple I2Cs” →

This Week In Security: Forksquatting, RustDesk, And M&Ms

March 1, 2024 by 14 Comments

Github is struggling to keep up with a malware campaign that’s a new twist on typosquatting. The play is straightforward: Clone popular repositories, add malware, and advertise the forks as the original. Some developers mistake the forks for the real projects, and unintentionally run the malware. The obvious naming choice is forksquatting, but the researchers at apiiro went with the safer name of “Repo Confusion”.

The campaign is automated, and GitHub is aware of it, with the vast majority of these malicious repositories getting removed right away. For whatever reason, the GitHub algorithm isn’t catching all of the new repos. The current campaign appears to publishing millions of forks, using code from over 100,000 legitimate projects. It’s beginning to seem that the squatting family of attacks are here to stay.

RustDesk and Odd Certificates

The RustDesk remote access software is interesting, as it’s open source, allows self-hosting, and written in Rust. I’ve had exploring RustDesk as a todo item for a long time, but a bit of concerning drama has just finished playing out. A user pointed out back in November that a test root certificate was installed as part of the RustDesk installation. That root cert is self-signed with SHA1. There is also concern that the RustDesk binaries are signed with a different certificate.

There have been new events since then. First, there was a Hacker News thread about the issue earlier this month. The next day, CVE-2024-25140 was registered with NIST, ranking an insane CVE 9.8 CVSS. Let’s cut through some FUD and talk about what’s really going on.

Continue reading “This Week In Security: Forksquatting, RustDesk, And M&Ms” →

The White House Memory Safety Appeal Is A Security Red Herring

February 29, 2024 by 102 Comments

In the Holy Programming Language Wars, the lingua franca of system programming – also known as C – is often lambasted for being unsecure, error-prone, and plagued with more types of behavior that are undefined than ones that are defined by the C standards. Many programming languages were said to be ‘C killers’, yet C is still alive today. That didn’t stop the US White House’s Office of the National Cyber Director (ONCD) from putting out a report in which both C and C++ got lambasted for being ‘unsafe’ when it came to memory management.

The full report (PDF) is pretty light on technical details, while citing only blog posts by Microsoft and Google as its ‘expert sources’. The claim that memory safety issues are the primary cause of CVEs is not substantiated, or at least ignores the severity of CVEs when looking at the CISA statistics for active exploits. Beyond this call for ‘memory safety’, the report then goes on to effectively call for more testing and validation, while kicking in doors that were opened back in the 1970s already with the Steelman requirements and the High Order Language Working Group (HOLWG) of 1975.

What truly is the impact and factual basis of the ONCD report?

Continue reading “The White House Memory Safety Appeal Is A Security Red Herring” →

Ethernet For Hackers: Equipment Exploration

February 28, 2024 by 28 Comments

Last time, we talked about the surface-level details of Ethernet. They are fundamental to know for Ethernet hacking, but they’re also easy to pick up from bits and pieces online, or just from wiring up a few computers in your home network. Now, there’s also a bunch of equipment and standards that you will want to use with Ethernet – easy to find whether used or new, and typically as easy to work with. Let’s give you a few beacons!

Routers And Switches

Whenever you see a box with a few Ethernet ports, it’s either referred to as a router, or a switch, sometimes people will even use the word “hub”! Fortunately, it’s simpler than it may seem. A router is a smart device, typically with an OS, that ties two or more networks together – routing packers from one network to another, and typically taking care of things like handing out local IP addresses via DHCP. A switch merely helps Ethernet devices exchange packets between each other on the same level – it’s typically nowhere near as smart as a router gets. Oftentimes, a home router will contain a switch inside, so that you can plug in multiple of your home devices at once. That’s the main difference – a switch merely transmits packets between Ethernet-connected devices, while a router is a small computer taking care of packet forwarding between networks and possibly including an Ethernet switch on the side.
Continue reading “Ethernet For Hackers: Equipment Exploration” →