On Carbon Fiber Types And Their Carcinogenic Risks

August 7, 2024 by Maya Posch 13 Comments

Initially only seeing brief popular use as the filament in incandescent lighting, carbon fibers (CF) experienced a resurgence during the 20th century as part of composite materials that are lighter and stronger than materials like steel and aluminium, for use in aircraft, boats and countless more applications. This rising popularity has also meant that the wider population is now exposed to fragments of CF, both from using CF-based products as well as from mechanically processing CF materials during (hobby) projects.

It is this popularity that has also led to the addition of short CF sections to FDM 3D printing filaments, where they improve the mechanical properties of the printed parts. However, during subsequent mechanical actions such as sanding, grinding, and cutting, CF dust is created and some fraction of these particles are small enough to be respirable. Of these, another fraction will bypass the respiratory system’s dust clearing mechanisms, to end up deep inside the lungs. This raises the question of whether CF fragments can be carcinogenic, much like the once very popular and very infamous example of asbestos mineral fibers.

Continue reading “On Carbon Fiber Types And Their Carcinogenic Risks” →

Tickets For Supercon 2024 Go On Sale Now!

August 6, 2024 by Elliot Williams 10 Comments

Tickets for the 2024 Hackaday Supercon are on sale now! Go and get yours while they’re still hot. True-Believer Tickets are half-price at $148 (plus fees), and when that pile of 100 is gone, regular admission is $296 (plus fees).

Come join us on November 1st-3rd in sunny Pasadena, CA, for three days of talks, demos, badge hacking, workshops, and the sort of miscellaneous hardware shenanigans that make Hackaday Hackaday! If you’ve never been to a Supercon, now is the best time to check that off your bucket list. And if you’re a seven-time veteran, we’re stoked to see you again. Supercon is like a year’s worth of posts in one weekend. You don’t want to miss it.

Friday, November 1st, is our chill-out day. You can roll in as soon as the doors open in the morning, get your badge and some bagels, and get down to hacking. Or you can start socializing early. Or, as it almost always happens, both at once. We’ll have food and music and even a few workshops, but for the most part, Fridays are what you all make of them. And we love it that way.

Talks start up on Saturday on both stages, along with the soldering contest and an alley full of hackers. We’ll close out the evening with a special celebration, but more on that in a minute.

On Sunday, in addition to the usual slate of talks, we’ve set aside a big block of time for Lightning Talks. These are seven-minute quickies where you get to tell the bigger Hackaday community what you’re up to. A short talk like this forces you to condense the story down to its essence while giving tons of people their fifteen minutes of fame in half the time! If you’ve got a Lightning Talk that you’d like to present, let us know! We’ll try to fit in everyone we can.

Wrapping up Sunday evening, we’ll give you a chance to show off whatever badge hacks you’ve been working on over the weekend. We love the badge hacking demo because it allows us to see a wide (and wild) range of projects, all of which were put together in record time. Whether funny, flashy, or phenomenal, we want to see what you’ve been up to. Continue reading “Tickets For Supercon 2024 Go On Sale Now!” →

Embedded Python: MicroPython Toolkits

August 5, 2024 by Arya Voronova 22 Comments

Last time, I talked about how MicroPython is powerful and deserving of a place in your toolkit, and it made for a lively discussion. I’m glad to see that overall, MicroPython has indeed been getting the recognition it deserves – I’ve built a large number of wonderful projects with it, and so have people I’ve shown it to!

Sometimes I see newcomers dissatisfied with MicroPython, because the helper tools they initially pick don’t suit it well. For instance, they try and start out with a regular serial terminal application that doesn’t fit the MicroPython constraints, or a general IDE that requires a fair bit of clicking around every time you need to run your code. In particular, I’d make sure that you know your options no matter whether you prefer GUI or commandline – both have seriously nice tools for MicroPython use!

The main problem to be solved with MicroPython is that you have a single serial port that everything happens through – both file upload and also debugging. For ESP8266/32-based boards, it’s a physical serial port, and for chips like RP2040 and ESP32-S* where a hardware USB peripheral is available, it’s a virtual one – which makes things harder because the virtual port might get re-enumerated every now and then, possibly surprising your terminal application. If you want to upload a program of yours, you need to free up the serial port, and to see the program’s output, you will need to reopen that port immediately after – not a convenient thing to do if you’re using something like PuTTy.

So, using MicroPython-friendly software is a must for a comfortable hacking experience. What are your options? Continue reading “Embedded Python: MicroPython Toolkits” →

Hackaday Links: August 4, 2024

August 4, 2024 by Dan Maloney 8 Comments

Good news, bad news for Sun watchers this week, as our star launched a solar flare even bigger than the one back in May that gave us an amazing display of aurora that dipped down into pretty low latitudes. This was a big one; where the earlier outburst was only an X8.9 class, the one on July 23 was X14. That sure sounds powerful, but to put some numbers to it, the lower end of the X-class exceeds 10^-4 W/m² of soft X-rays. Numbers within the class designate a linear increase in power, so X2 is twice as powerful as X1. That means the recent X14 flare was about five times as powerful as the May flare that put on such a nice show for us. Of course, this all pales in comparison to the strongest flare of all time, a 2003 whopper that pegged the needle on satellite sensors at X17 but was later estimated at X45.

Continue reading “Hackaday Links: August 4, 2024” →

How About Privacy and Hackability?

August 3, 2024 by Elliot Williams 32 Comments

Many smart electric meters in the US use the 900 MHz band to broadcast their usage out to meter readers as they walk the neighborhood. [Jeff Sandberg] used an RTL-SDR dongle and some software to integrate this data into his own home automation system, which lets him keep track of his home’s power usage.

Half of the comment section was appalled that the meters broadcast this data in the clear, and these readers thought this data should be encrypted even if the reach is limited to the home-owner’s front yard. But that would have stopped [Jeff] from accessing his own data as well, and that would be a shame. So there’s clearly a tradeoff in play here.

We see this tradeoff in a lot of hardware devices as well – we want to be able to run our firmware on them, but we don’t want criminals to do the same. We want the smart device to work with the cloud service, but to also work with our own home automation system if we have one. And we want to be able to listen in to our smart meters, but don’t necessarily want others to do so.

The solution here is as easy as it is implausible that it will get implemented. If the smart meters transmitted encrypted, each with their own individual password, then everyone would win. The meter reader would have a database of passwords linked to meter serial numbers or addresses, and the home owner could just read it off of a sticker, optimally placed on each unit. Privacy and usability would be preserved.

This issue isn’t just limited to electric meters. Indeed, think of all of the data that is being sent out from or about you, and what percentage of it is not encrypted and should be, but also about what data is sent out encrypted that you could use access to. The solution is to put you in control of the encryption, by selecting a password or having access to one that’s set for you. Because after all, if it’s your data, it should be your data: private and usable.

Hackaday Podcast Episode 282: Saildrones, A New Classic Laptop, And SNES Cartridges Are More Than You Think

August 2, 2024 by Tom Nardi 1 Comment

In this episode, the CrowdStrike fiasco has Hackaday Editors Elliot Williams and Tom Nardi pondering the fragility of our modern infrastructure. From there the discussion moves on to robotic sailboats, the evolving state of bespoke computers, and the unique capabilities of the Super Nintendo cartridge. You’ll also hear about cleaning paintings with lasers, the advantages of electronic word processors, stacking 3D printed parts, and the joys of a nice data visualization. They’ll wrap the episode up by marveling at the techniques required to repair undersea fiber optic cables, and the possibilities (and frustrations) of PCB panelization using multiple designs.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

As always, the Hackaday Podcast is available in DRM-free MP3 for offline listening.

Continue reading “Hackaday Podcast Episode 282: Saildrones, A New Classic Laptop, And SNES Cartridges Are More Than You Think” →

This Week In Security: Echospoofing, Ransomware Records, And Github Attestations

August 2, 2024 by Jonathan Bennett 5 Comments

It’s a bit of bitter irony, when a security product gets used maliciously, to pull off the exact attack it was designed to prevent. Enter Proofpoint, and the EchoSpoofing attack. Proofpoint offers an email security product, filtering spam and malicious incoming emails, and also handling SPF, DKIM, and DMARC headers on outgoing email. How does an external service provide those email authentication headers?

One of the cardinal sins of running an email server is to allow open relaying. That’s when anyone can forward email though an SMTP server without authentication. What we have here is two nearly open relays, that wound up with spoofed emails getting authenticated just like the real thing. The first offender is Microsoft’s Office365, which seems to completely skip checking for email spoofing when using SMTP relaying from an allowed IP address. This means a valid Office365 account allows sending emails as any address. The other half relies on the way Proofpoint works normally, accepting SMTP traffic from certain IP addresses, and adding the authentication headers to those emails. There’s an option in Proofpoint to add the Microsoft Office 365 servers to that list, and apparently quite a few companies simply select that option.

The end result is that a clever spammer can send millions of completely legitimate looking emails every day, that look very convincing even to sophisticated users. At six months of activity, averaging three millions emails a day, this campaign managed just over half a billion malicious emails from multiple high-profile domains.

The good news here is that Proofpoint and Guardio discovered the scheme, and worked with Microsoft to develop the X-OriginatorOrg header that is now applied to every email sent from or through the Office365 servers. This header marks the account tenant the email belongs to, giving vendors like Proofpoint a simple way to determine email validity. Continue reading “This Week In Security: Echospoofing, Ransomware Records, And Github Attestations” →