Slider

5064 Articles

Engineers: Be Subversive To Be Green

October 7, 2022 by 153 Comments

The caterers for the volunteer workforce behind the summer’s MCH hacker camp in the Netherlands served all-vegan food. This wasn’t the bean sprouts and lentils that maybe some of the more meat-eating readers might imagine when confronted with vegan food, nor was it a half-as-good array of substitutes with leathery soy hamburgers and rubbery fake cheese smelling suspiciously of feet.

Instead it was a well-crafted, interesting, and tasty menu that was something to look forward to after several hours driving a vanload of handwashing sinks. It was in one of their meals that I found food for thought when driving a week later past the huge Garzweiler open-cast lignite mine on my way through Germany to Luxembourg’s Haxogreen as part of my European hacker camp summer tour.

The meal was deep-fried soy protein strips and the mine is probably one of Western Europe’s dirtiest and most problematic CO2 sources in a country that likes to imagine itself as environmentally friendly, so where in this unlikely connection did I find a pairing? Continue reading “Engineers: Be Subversive To Be Green” →

This Week In Security: PHP Attack Defused, Scoreboard Manipulation, And Tillitis

October 7, 2022 by 1 Comment

If you use PHP, you likely use the Composer tool for managing dependencies, at least indirectly. And the good folks at SonarSource found a nasty, potential supply chain attack in this tool, when used in the Packagist repository. The problem is the support for arbitrary README filenames. When a package update shows up on Packagist, that service uses a Version Control Service (VCS) like Git or Mercurial to pull the specified readme location. That pull operation is subject to argument injection. Name your branch --help, and Git will happily run the help argument instead of doing the pull intended. In the case of Git commands, our intrepid researchers were unable to weaponize the issue to achieve code execution.

Composer also supports projects that use Mercurial as their VCS, and Mercurial has a --config option that has… interesting potential. It allows redefining a Mecurial command as a script snippet. So a project just has to contain a malicious payload.sh, and the readme set to --config=alias.cat=!hg cat -r : payload.sh|sh;,txt. For those keeping track at home, the vulnerability is that this cursed string of ugly is accepted by Composer as a valid filename. This uses the --config trick to redefine cat as a bit of script that executes the payload. It ends in .txt because that is a requirement of Composer.

So let’s talk about what this little hack could have been used for, or maybe still used for on an unpatched, private install of Packagist. This is an unattended attack that jumps straight to remote script execution — on an official package repository. If discovered and used for evil, this would have been a massive supply chain attack against PHP deployments. Instead, thanks to SonarSource, it was discovered and disclosed privately back in April. The official Packagist repo at packagist.org was fixed the day after disclosure, and a CVE and updated packages went out six days later. Great work all around.
Continue reading “This Week In Security: PHP Attack Defused, Scoreboard Manipulation, And Tillitis” →

Git Your PCBs Online

October 6, 2022 by 16 Comments

Last time, I’ve shown you how to create a local Git repository around your PCB project. That alone provides you with local backups, helping you never lose the changes you make to your files, and always be able to review the history of your project as it developed.

However, an even more significant part of Git’s usefulness is the ability to upload our creations to one of the various online Git repository hosting services, and keep it up to date at all times with a single shell command. I’d like to show you how to upload your project to GitHub and GitLab, in particular!

Continue reading “Git Your PCBs Online” →

Immersive Cursive: Growing Up Loopy

October 6, 2022 by 28 Comments

Growing up, ours was a family of handwritten notes for every occasion. The majority were left on the kitchen counter next to the sink, or in a particular spot on the all-purpose table in the breakfast nook. Whether one was professing their familial love and devotion on the back of a Valpak coupon, or simply communicating an intent to be home before dinnertime, the words were generally immortalized in BiC on whatever paper was available, and timestamped for the reader’s information. You may have learned cursive in school, but I was born in it — molded by it. The ascenders and descenders betray you because they belong to me.

Both of my parents always seemed to be incapable of printing in anything other than all caps, so I actually preferred to see their cursive most of the time. As a result, I could copy read it quite easily from an early age. Well, I don’t think I ever had any hope of imitating Dad’s signature. But Mom’s on the other hand — like I said in the first installment, it was important for my signature to be distinct from hers, given that we have the same name — first, middle, and last. But I could probably still bust out her signature if it came down to something going on my permanent record.

While my handwriting was sort of naturally headed towards Mom’s, I was more interested in Dad’s style and that of my older brother. He had small caps handwriting down to an art, and my attempts to copy it have always looked angry and stilted by comparison. In addition, my brother’s cursive is lovely and quick, while still being legible.

Continue reading “Immersive Cursive: Growing Up Loopy” →

Leading Edge Erosion: When Precipitation Destroys Wind Turbine Blades

October 5, 2022 by 85 Comments

Erosion is all around us, from the meandering course of rivers and other waterways, to the gradual carving out of channels in even the toughest mountains, and the softening of features in statues. Yet generally we expect erosion from precipitation to be gradual and gentle, taking decades to make a noticeable difference. This of course takes into account gentle flows and the soft pitter-patter of rain on stone, not turbine blades passing through the air at many times the terminal velocity of rain drops of up to 9 m/s.

As wind turbines have increased in size and diameter of their blades, this has noticeably increased the speed of especially the blade tips. With more and more wind turbine blade tips now exceeding speeds of 100 m/s, this has also meant a significant increase in the impact of rain drops, hail and other particulates on the lifespan of these turbine blades. As comparison, 100 m/s is 360 km/h (224 mph), which is only slightly slower than the top speed of a Formula 1 car.

The effect of turbine blade leading edge erosion (LEE) not only decreases aerodynamic efficiency, but also invites premature failure. Over the past years, special coatings and leading edge tapes have been developed that act as sacrificial surfaces, but as wind turbines only keep getting larger, so does the effect of LEE. Beyond simply replacing LE tape every year on every turbine, what other options are there?

Continue reading “Leading Edge Erosion: When Precipitation Destroys Wind Turbine Blades” →

The State Of The SBC Interface Ecosystem, Is It Time To Design A Standard?

October 5, 2022 by 132 Comments

We are spoiled for choice when it comes to single board computers, whether they be based around a microcontroller or a more capable SoC capable of running an operating system such as GNU/Linux. They can be had from well-established brands such as Arduino, Adafruit, or Raspberry Pi, or from a Wild West of cheaper Far Eastern modules carrying a plethora of different architectures.

Everyone has their own favourite among them, and along with that comes an ecosystem of operating systems and software development environments. There’s another aspect to these boards which has evolved; certain among them have become de facto interface connector standards for hardware peripherals. Do these standards make any sense? Let’s talk about that.

Continue reading “The State Of The SBC Interface Ecosystem, Is It Time To Design A Standard?” →

2022 Hackaday Supercon Speakers Will Inspire You

October 4, 2022 by 10 Comments

The return of Supercon is taking place in just a month. We’ve got 45 fantastic talks and workshops planned for the three-day weekend, and they are as varied and inspiring as the Hackaday community itself. From molecules to military connectors, here’s an even dozen talks to whet your appetite.

Supercon is the Ultimate Hardware Conference and you need to be there! We’ll continue to announce speakers and workshops over the next couple weeks. Supercon will sell out so get your tickets now before it’s too late. And stay tuned for the next round of talk reveals next week! Continue reading “2022 Hackaday Supercon Speakers Will Inspire You” →