This Week In Security: IngressNightmare, NextJS, And Leaking DNA

March 28, 2025 by Jonathan Bennett 9 Comments

This week, researchers from Wiz Research released a series of vulnerabilities in the Kubernetes Ingress NGINX Controller that, when chained together, allow an unauthorized attacker to completely take over the cluster. This attack chain is known as IngressNightmare, and it affected over 6500+ Kubernetes installs on the public Internet.

The background here is that web applications running on Kubernetes need some way for outside traffic to actually get routed into the cluster. One of the popular solutions for this is the Ingress NGINX Controller. When running properly, it takes incoming web requests and routes them to the correct place in the Kubernetes pod.

When a new configuration is requested by the Kubernetes API server, the Ingress Controller takes the Kubernetes Ingress objects, which is a standard way to define Kubernetes endpoints, and converts it to an NGINX config. Part of this process is the admission controller, which runs nginx -t on that NGINX config, to test it before actually deploying.

As you might have gathered, there are problems. The first is that the admission controller is just a web endpoint without authentication. It’s usually available from anywhere inside the Kubernetes cluster, and in the worst case scenario, is accessible directly from the open Internet. That’s already not great, but the Ingress Controller also had multiple vulnerabilities allowing raw NGINX config statements to be passed through into the config to be tested. Continue reading “This Week In Security: IngressNightmare, NextJS, And Leaking DNA” →

Supercon 2024: Yes, You Can Use The Controller Area Network Outside Of Cars

March 27, 2025 by Lewin Day 21 Comments

Ah, the CAN bus. It’s become a communication standard in the automotive world, found in a huge swathe of cars built from the mid-1990s onwards. You’ll also find it in aircraft, ships, and the vast majority of modern tractors and associated farm machines, too.

As far as [Randy Glenn] is concerned, though, the CAN bus doesn’t have to be limited to these contexts. It can be useful far beyond its traditional applications with just about any hardware platform you care to use! He came down to tell us all about it at the 2024 Hackaday Supercon.

Continue reading “Supercon 2024: Yes, You Can Use The Controller Area Network Outside Of Cars” →

FLOSS Weekly Episode 826: Fedora 42 And KDE

March 26, 2025 by Jonathan Bennett 3 Comments

This week, Jonathan Bennett chats with Neal Gompa about Fedora 42 and KDE! What’s new, what’s coming, and why is flagship status such a big deal?

Continue reading “FLOSS Weekly Episode 826: Fedora 42 And KDE” →

Tech In Plain Sight: Hearing Aids

March 26, 2025 by Al Williams 38 Comments

You might think you don’t need a hearing aid, and you might be right. But in general, hearing loss eventually comes to all of us. In fact, you progressively lose hearing every year, which is why kids can have high-pitched ringtones their parents can’t hear.

You’d think hearing aids would be pretty simple, right? After all, we know how to pick up sounds, amplify them, and play them back. But there’s a lot more to it. Hearing aids need to be small, comfortable, have great battery life, and cram a microphone and speaker into a small area. That also can lead to problems with feedback, which can be very uncomfortable for the user. In addition, they need to handle very soft and loud sounds and accommodate devices like telephones.

Although early hearing aids just made sound louder and, possibly, blocked unwanted sound, modern devices will try to increase volume only in certain bands where the user has hearing loss. They may also employ sophisticated methods to block or reduce noise. Continue reading “Tech In Plain Sight: Hearing Aids” →

Illustrated Kristina with an IBM Model M keyboard floating between her hands.

Keebin’ With Kristina: The One With The Grasshopper Typewriter

March 24, 2025 by Kristina Panos 10 Comments

Do you consider your keyboard to be a fragile thing? Meet the glass keyboard by [BranchNo9329], which even has a glass PCB. At least, I think the whole thing is glass.

The back side of an all-glass keyboard. Yeah. — Image via [BranchNo9329] via reddit

There are so frustratingly few details that this might as well have been a centerfold, but I thought you all should see it just the same. What we do have are several pictures and a couple of really short videos, so dive in.

I can tell you that [BranchNo2939] chose a glass substrate mainly due to curiosity about its durability compared with FR4. And that the copper circuitry was applied with physical vapor deposition (PVD) technology.

Apparently one of [BranchNo2939]’s friends is researching the bonding of copper on to glass panels, so they thought they’d give a keyboard a go. Right now the thing is incomplete — apparently there’s going to be RGB. Because of course there’s going to be RGB. Continue reading “Keebin’ With Kristina: The One With The Grasshopper Typewriter” →

Hackaday Links: March 23, 2025

March 23, 2025 by Dan Maloney 9 Comments

What a long, strange trip it’s been for NASA astronauts Suni Williams and Bruce Wilmore, who finally completed their eight-day jaunt to space after 289 days. The duo returned to Earth from the ISS on Tuesday along with two other returning astronauts in a picture-perfect splashdown, complete with a dolphin-welcoming committee. For the benefit of those living under rocks these past nine months, Williams and Wilmore slipped the surly bonds way back in June on the first crewed test flight of the Boeing Starliner, bound for a short stay on the ISS before a planned return in the same spacecraft. Alas, all did not go to plan as their ride developed some mechanical difficulties on the way upstairs, and so rather than risk their lives on a return in a questionable capsule, NASA had them cool their heels for a couple of months while Starliner headed home without them.

There’s been a lot of talk about how Butch and Suni were “stranded,” but that doesn’t seem fair to us. Sure, their stay on the ISS was unplanned, or at least it wasn’t Plan A; we’re sure this is always a contingency NASA allows for when planning missions. Also unfortunate is the fact that they didn’t get paid overtime for the stay, not that you’d expect they would. But on the other hand, if you’re going to get stuck on a work trip, it might as well be at the world’s most exclusive and expensive resort.

Continue reading “Hackaday Links: March 23, 2025” →

Thanks For Hackaday Europe!

March 22, 2025 by Elliot Williams 10 Comments

We just got back from Hackaday Europe last weekend, and we’re still coming down off the high. It was great to be surrounded by so many crazy, bright, and crazy-bright folks all sharing what they are pouring their creative energy into. The talks were great, and the discussions and impromptu collaborations have added dramatically to our stack of to-do projects. (Thanks?) Badges were hacked, stories were shared, and a good time was had by all.

At the event, we were approached by someone who wanted to know if we could replicate something like Hackaday Europe in a different location, one where there just isn’t as vibrant a hacking scene. And the answer, of course, was maybe, but probably not.

It’s not that we don’t try to put on a good show, bring along fun schwag, and schedule up a nice location. But it’s the crowd of people who attend who make a Hackaday event a Hackaday event. Without you all, it just wouldn’t work.

So in that spirit, thanks to everyone who attended, and who brought along their passions and projects! It was great to see you all, and we’ll do it again soon.