Community Rallies Behind Youtube-dl After DMCA Takedown

October 27, 2020 by Tom Nardi 63 Comments

At this point, you’ve likely heard that the GitHub repository for youtube-dl was recently removed in response to a DMCA takedown notice filed by the Recording Industry Association of America (RIAA). As the name implies, this popular Python program allowed users to produce local copies of audio and video that had been uploaded to YouTube and other content hosting sites. It’s a critical tool for digital archivists, people with slow or unreliable Internet connections, and more than a few Hackaday writers.

It will probably come as no surprise to hear that the DMCA takedown and subsequent removal of the youtube-dl repository has utterly failed to contain the spread of the program. In fact, you could easily argue that it’s done the opposite. The developers could never have afforded the amount of publicity the project is currently enjoying, and as the code is licensed as public domain, users are free to share it however they see fit. This is one genie that absolutely won’t be going back into its bottle.

In true hacker spirit, we’ve started to see some rather inventive ways of spreading the outlawed tool. A Twitter user by the name of [GalacticFurball] came up with a way to convert the program into a pair of densely packed rainbow images that can be shared online. After downloading the PNG files, a command-line ImageMagick incantation turns the images into a compressed tarball of the source code. A similar trick was one of the ways used to distribute the DeCSS DVD decryption code back in 2000; though unfortunately, we doubt anyone is going to get the ~14,000 lines of Python code that makes up youtube-dl printed up on any t-shirts.

Screenshot of the Tweet sharing YouTube-dl repository as two images

It’s worth noting that GitHub has officially distanced themselves from the RIAA’s position. The company was forced to remove the repo when they received the DMCA takedown notice, but CEO Nat Friedman dropped into the project’s IRC channel with a promise that efforts were being made to rectify the situation as quickly as possible. In a recent interview with TorrentFreak, Friedman said the removal of youtube-dl from GitHub was at odds with the company’s own internal archival efforts and financial support for the Internet Archive.

But as it turns out, some changes will be necessary before the repository can be brought back online. While there’s certainly some debate to be had about the overall validity of the RIAA’s claim, it isn’t completely without merit. As pointed out in the DMCA notice, the project made use of several automated tests that ran the code against copyrighted works from artists such as Taylor Swift and Justin Timberlake. While these were admittedly very poor choices to use as official test cases, the RIAA’s assertion that the entire project exists solely to download copyrighted music has no basis in reality.

[Ed Note: This is only about GitHub. You can still get the code directly from the source.]

AMD Acquires Xilinx For $35 Billion

October 27, 2020 by Mike Szczys 45 Comments

News this morning that AMD has reached an agreement to acquire Xilinx for $35 Billion in stock. The move to gobble up the leading company in the FPGA industry should come as no surprise for many reasons. First, the silicon business is thick in the age of mergers and acquisitions, but more importantly because AMD’s main competitor, Intel, purchased the other FPGA giant Altera back in 2015.

Primarily a maker of computer processors, AMD expands into the reconfigurable computing market as Field-Programmable Gate Arrays (FPGA) can be adapted to different tasks based on what bitstream (programming information written to the chips) has been sent to them. This allows the gates inside the chip to be reorganized to perform different functions at the hardware level even after being put into products already in the hands of customers.

Xilinx invented the FPGA back in the mid-1980s, and since then the falling costs of silicon fabrication and the acceleration of technological advancement have made them evermore highly desirable solutions. Depending on volume, they can be a more economical alternative to ASICs. They also help with future-proofing as technology not in existence at time of manufacture — such as compression algorithms and communications protocols — may be added to hardware in the field by reflashing the bitstream. Xilinx also makes the Zynq line of hybrid chips that contain both ARM and FPGA cores in the same device.

The deal awaits approval from both shareholders and regulators but is expected to be complete by the end of 2021.

Going For The Home Run Record With Explosive Help

October 27, 2020 by Danie Conradie 6 Comments

The baseball home run distance challenge for crazy engineers is really heating up, with the two main (only?) competitors joining forces. [Shane] of [Stuff Made Here] and [Destin] of [Smarter Every Day] did a deep dive into [Shane]’s latest powder charged baseball bat, designed to hit a ball 600+ feet.

[Shane] built two new versions of his bat this time, using the lessons he learned from his previous V1 and V2 explosive bats. It still uses blank cartridges, but this time the max capacity was increased from three to four cartridges. For V3 a section of the bat was removed, and replaced with a four-bar linkage, which allowed the entire front of the bat to move. The linkage integrated a chamber for four blank cartridges that could be loaded almost like a double barrel shotgun and closed with a satisfying snap. Unfortunately the mass of the moving section was too much for the welds, and the entire front broke off on the first test, so the design was scrapped.

V4 returned to the piston concept of the initial version, except V4 contains two parallel pistons, in a metal bat, with a larger hitting surface. With two cartridges it worked well, but parts started breaking with three and four, and required multiple design updates to fix. [Destin] covered the physics of the project and took some really cool high speed video. He and [Jeremy Fielding] hold the current distance record of 617 ft with their crazy Mad Batter. Unfortunately on [Shane]’s final distance attempt the bat broke again, and the ball was lost in a field with tall grass beyond the 600-foot mark, so they could not confirm if the record was actually broken.

[Destin] and his team still remain the undisputed baseball velocity record holders, with their supersonic baseball canon. It sounds like there might be another collaboration between [Destin] and [Shane] in the future, and we’re definitely looking forward to the results of that crazy venture. Continue reading “Going For The Home Run Record With Explosive Help” →

World’s Smallest Benchy Shows Off What 3D-Printing Can Do For “Microswimmers”

October 26, 2020 by Dan Maloney 12 Comments

We’ve said it before, but we cast a wary eye at any superlative claims that come our way. “World’s fastest” or “world’s first” claims always seem to be quickly debunked, but when the claim of “World’s Smallest Benchy” is backed up by a tugboat that two dozen E. coli would have a hard time finding space on, we’re pretty comfortable with it.

Of course the diminutive benchmark was not printed just for the sake of it, but rather as part of a demonstration of what’s possible with “microswimmers”, synthetic particles which are designed to move about freely in microscopic regimes. As described in a paper by [Rachel P. Doherty] et al from the Soft Matter Physics lab at Leiden University, microswimmers with sizes on the order of 10 to 20 μm can be constructed repeatably, and can include a small area of platinum catalyst. The catalyst is the engine of the microswimmer; hydrogen peroxide in the environment decomposes on the catalyst surface and provides a propulsive force.

Artificial microswimmers have been around for a while, but most are made with chemical or evaporative methods which result in simple shapes like rods and spheres. The current work describes much more complex shapes — the Benchy was a bit of a flex, since the more useful microswimmers were simple helices, which essentially screw themselves into the surrounding fluid. The printing method was based on two-photon polymerization (2PP), a non-linear optical process that polymerizes a resin when two photons are simultaneously absorbed.

The idea that a powered machine so small could be designed and manufactured is pretty cool. We’d love to see how control mechanisms could be added to the prints — microfluidics, perhaps?

STM32 Gets Up Close And Personal With Mandelbrot

October 25, 2020 by Bryan Cockfield 12 Comments

The Mandelbrot set is a curious mathematical oddity that, while interesting in its own right, is also a useful tool for benchmarking various types of computers. Its constant computing requirement when zooming in and out on the function, combined with the fact that it can be zoomed indefinitely, means that it takes some quality hardware and software to display it properly. [Thanassis] has made this a pet project of his, running Mandelbrot set visualizations in different ways on many different hardware platforms.

This particular one is based on an STM32 board called the Blue Pill, which [Thanassis] chose because he hadn’t yet done a continuous Mandelbrot zoom on a microcontroller yet. The display is handled by a tiny 16K IPS color screen, and some clever memory tricks had to come into play in order to get smooth video output since the STM has only 20 kB available. The integer multiplication is also tricky on a platform this small while keeping the continuous zoom function, so it’s limited to fixed point multiplication.

Even with the limitations of the platform, he is still able to achieve nearly double-digit FPS rates with this one. If you want to play around with graphics like this on an STM platform, [Thanassis] has released all of the source code on his GitHub page, but if you’d like to see more Mandelbrot manipulation you can check out one of his older projects where he built a similar project on an FPGA.

Continue reading “STM32 Gets Up Close And Personal With Mandelbrot” →

This Week In Security: Too Little Too Late, And Other Stories

October 23, 2020 by Jonathan Bennett 2 Comments

Microsoft has just announced a way to disable JScript in Internet Explorer. This would have been very useful a few years ago, to proactively prevent problems found in the now-ancient JScript engine, which ran their own slightly different version of standard JavaScript. Even though IE is no longer under active development, it still receives security updates. JScript, on the other hand, is basically done. If you’re one of the 1.06% that still use IE, then go flip the switch to protect yourself from additional JScript vulnerabilities.

Zerologon and Samba?

Samba is an open source re-implemenation of Microsoft’s SMB protocol. There’s a clever term that describes the reality of this situation: “Bug for bug compatibility”. Remember Zerologon, the flaw where a security token’s generation could be manipulated to vastly reduce the key space? Samba follows the specification, and therefore suffers from the same issue, though it seems to be unusual to actually run Samba in a vulnerable configuration.

Other implementations cannot say the same. QNAP in particular has been bitten by Zerologon when configured as a domain controller. What’s not clear is whether QNAP is running Samba on the NAS products, or if this is yet another vulnerable implementation. Either way, go update your devices. Continue reading “This Week In Security: Too Little Too Late, And Other Stories” →

Google Meddling With URLs In Emails, Causing Security Concerns

October 21, 2020 by Zoe Skyforest 58 Comments

Despite the popularity of social media, for communication that actually matters, e-mail reigns supreme. Crucial to the smooth operation of businesses worldwide, it’s prized for its reliability. Google is one of the world’s largest e-mail providers, both with its consumer-targeted Gmail product as well as G Suite for business customers [Jeffrey Paul] is a user of the latter, and was surprised to find that URLs in incoming emails were being modified by the service when fetched via the Internet Message Access Protocol (IMAP) used by external email readers.

This change appears to make it impossible for IMAP users to see the original email without logging into the web interface, it breaks verification of the cryptographic signatures, and it came as a surprise.

Security Matters

A test email sent to verify the edits made by Google’s servers. Top, the original email, bottom, what was received.

For a subset of users, it appears Google is modifying URLs in the body of emails to instead go through their own link-checking and redirect service. This involves actually editing the body of the email before it reaches the user. This means that even those using external clients to fetch email over IMAP are affected, with no way to access the original raw email they were sent.

The security implications are serious enough that many doubted the initial story, suspecting that the editing was only happening within the Gmail app or through the web client. However, a source claiming to work for Google confirmed that the new feature is being rolled out to G Suite customers, and can be switched off if so desired. Reaching out to Google for comment, we were directed to their help page on the topic.

The stated aim is to prevent phishing, with Google’s redirect service including a link checker to warn users who are traveling to potentially dangerous sites. For many though, this explanation doesn’t pass muster. Forcing users to head to a Google server to view the original URL they were sent is to many an egregious breach of privacy, and a security concern to boot. It allows the search giant to further extend its tendrils of click tracking into even private email conversations. For some, the implications are worse. Cryptographically signed messages, such as those using PGP or GPG, are broken by the tool; as the content of the email body is modified in the process, the message no longer checks out with respect to the original signature. Of course, this is the value of signing your messages — it becomes much easier to detect such alterations between what was sent and what was received.

Inadequate Disclosure

Understandably, many were up in arms that the company would implement such a measure with no consultation or warning ahead of time. The content of an email is sacrosanct, in many respects, and tampering with it in any form will always be condemned by the security conscious. If the feature is a choice for the user, and can be turned off at will, then it’s a useful tool for those that want it. But this discovery was a surprise to many, making it hard to believe it was adequately disclosed before roll-out. The question unfolded in the FAQ screenshot above hints at this being part of Google’s A/B test and not applied to all accounts. Features being tested on your email account should be disclosed yet they are not.

Protecting innocent users against phishing attacks is a laudable aim, and we can imagine many business owners enabling such a feature to avoid phishing attacks. It’s another case where privacy is willingly traded for the idea of security. While the uproar is limited due to the specific nature of the implementation thus far, we would expect further desertion of Google’s email services by the tech savvy if such practices were to spread to the mainstream Gmail product. Regardless of what happens next, it’s important to remember that the email you read may not be the one you were sent, and act accordingly.

Update 30/10/2020: It has since come to light that for G Suite users with Advanced Protection enabled, it may not be possible to disable this feature at all.