Hackers And China

October 9, 2021 by Elliot Williams 26 Comments

The open source world and Chinese manufacturing have a long relationship. Some fifteen years ago, the big topic was how companies could open-source their hardware designs and not get driven bankrupt by competition from overseas. Companies like Sparkfun, Adafruit, Arduino, Maple Labs, Pololu, and many more demonstrated that this wasn’t impossible after all.

Maybe ten years ago, Chinese firms started picking up interesting hacker projects and producing them. This gave us hits like the AVR transistor tester and the NanoVNA. In the last few years, we’ve seen open-source hardware and software projects that have deliberately targeted Chinese manufacturers, and won. We do the design and coding, they do the manufacturing, sales, and distribution.

But this is something else: the Bangle.js watch takes an essentially mediocre Chinese smartwatch and reflashes the firmware, and sells them as open-source smartwatches to the general public. These pre-hacked watches are being sold on Kickstarter, and although the works stands on the shoulders of previous hacker’s reverse engineering work on the non-open watch hardware, it’s being sold by the prime mover behind the Espruino JavaScript-on-embedded language, which it runs on.

We have a cheap commodity smartwatch, being sold with frankly mediocre firmware, taken over by hackers, re-flashed, re-branded, and sold by the hackers on Kickstarter. As a result of it being (forcibly) opened, there’s a decently sized app store of contributed open-source applications that’ll run on the platform, making it significantly more useful and hacker friendly than it was before.

Will this boost sales? Will China notice the hackers’ work? Will this, and similar projects, end up in yet another new hacker/China relationship? We’re watching.

This Week In Security: Apache Nightmare, REvil Arrests? And The Ultimate RickRoll

October 8, 2021 by Jonathan Bennett 14 Comments

The Apache HTTP Server version 2.4.49 has a blistering vulnerability, and it’s already being leveraged in attacks. CVE-2021-41773 is a simple path traversal flaw, where the %2e encoding is used to bypass filtering. Thankfully the bug was introduced in 2.4.49, the latest release, and a hotfix has already been released, 2.4.50.

curl --data "echo;id" 'http://127.0.0.1:80/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'

If that returns anything other than a 403 error, your server may be vulnerable. It’s worth pointing out that Apache is shipped with a configuration block that mitigates this vulnerability.

# Deny access to the entirety of your server's filesystem. You must # explicitly permit access to web content directories in other # blocks below. # <Directory /> AllowOverride none Require all denied </Directory>

The Day The Internet Stood Still

You might have noticed a bit of a kerfluffel on the Internet on Monday. Facebook dropped out for nearly six hours. While the break was nice for some, it was a major problem for others. What exactly happened? The most apparent cause was that the Facebook.com domain was returning nxdomain to DNS lookups. This led to some fun tweets, with screen caps showing Facebook.com for sale.
Continue reading “This Week In Security: Apache Nightmare, REvil Arrests? And The Ultimate RickRoll” →

Creating Methane From Captured Carbon Dioxide And The Future Of Carbon Capture

October 7, 2021 by Maya Posch 125 Comments

There’s something intrinsically simple about the concept of carbon (CO₂) capture: you simply have the CO₂ molecules absorbed or adsorbed by something, after which you separate the thus captured CO₂ and put it somewhere safe. Unfortunately, in physics and chemistry what seems easy and straightforward tends to be anything but simple, let alone energy efficient. While methods for carbon capture have been around for decades, making it economically viable has always been a struggle.

This is true both for carbon capture and storage/sequestration (CCS) as well as carbon capture and utilization (CCU). Whereas the former seeks to store and ideally permanently remove (sequester) carbon from the atmosphere, the latter captures carbon dioxide for use in e.g. industrial processes.

Recently, Pacific Northwest National Laboratory (PNNL) has announced a breakthrough CCU concept, involving using a new amine-based solvent (2-EEMPA) that is supposed to be not only more efficient than e.g. the previously commonly used MEA, but also compatible with directly creating methane in the same process.

Since methane forms the major component in natural gas, might this be a way for CCU to create a carbon-neutral source of synthetic natural gas (SNG)? Continue reading “Creating Methane From Captured Carbon Dioxide And The Future Of Carbon Capture” →

Decoding SMD Part Markings

October 6, 2021 by Chris Lott 29 Comments

You’ve probably encountered this before — you have a circuit board that is poorly documented, and want to know the part number of a tiny SMD chip. Retro computer enthusiast [JohnK] recently tweeted about one such database that he recently found, entitled The Ultimate SMD Marking Codes Database. This data base is only a couple of years old judging from the Wayback Machine, but seems to be fairly exhaustive and can be found referenced in quite a few electronics forums.

Unlike their larger SMD siblings, these chips in question are so small that there is no room to print the entire part number on the device. Instead, the standard practice is for manufacturers use an abbreviated code of just a few characters. These codes are only unique to each part or package, and aren’t necessarily unique across an entire product line. And just because it is standard practice does not imply the marking codes themselves follow any standard whatsoever. This seemingly hodgepodge system works just fine for the development, procurement and manufacturing phases of a product’s lifecycle. It’s during the repair, refurbishment, or just hacking for fun phases where these codes can leave you scratching your head.

Several sites like the one [JohnK] found have been around for years, and adding yet another database to your toolbox is a good thing. But none of them will ever be exhaustive. There’s a good reason for that — maintaining such a database would be a herculean task. Just finding the part marking information for a known chip can be difficult. Some manufacturers put it clearly in the data sheet, and some refer you to other documentation which may or may not be readily available. And some manufacturers ask you to contact them for this information — presumably because it is dynamic changes from time to time. Continue reading “Decoding SMD Part Markings” →

3D Printering: Corrugated Plastic For Cheaper & Easier Enclosures

October 6, 2021 by Donald Papp 37 Comments

Clear acrylic panels have long been a mainstay of 3D printer enclosure designs, but they can also add significant cost in terms of money, shipping, weight, and hassle. An alternative material worth looking at is corrugated plastic (also known by its trade name coroplast) which is cheap, light, an excellent insulator, and easy to work with. Many enclosure designs can be refitted to use it instead of acrylic, so let’s take a closer look at what it has to offer.

What’s Wrong With Acrylic?

It’s not just the purchase price that makes acrylic a spendy option. Acrylic is fairly heavy, and shipping pieces the size of enclosure panels can be expensive. Also, cutting acrylic without special tools can be a challenge because it cracks easily if mishandled. Acrylic cuts beautifully in a laser cutter, but most laser cutters accessible to a hobbyist are not big enough to make enclosure-sized panels. If you are stuck with needing to cut acrylic by hand, here are some tips on how to get by with the tools you have.

It is best to source acrylic from a local shop that can also cut it to size with the right tools for a reasonable price, but it is still far from being a cheap material. There’s another option: corrugated plastic has quite a few properties that make it worth considering, especially for a hobbyist.

Continue reading “3D Printering: Corrugated Plastic For Cheaper & Easier Enclosures” →

Yes, You Can Put Out A Burning Gas Well With A Nuclear Bomb

October 5, 2021 by Zoe Skyforest 30 Comments

Nuclear explosives were first developed as weapons of war in the pitched environment of World War II. However, after the war had passed, thoughts turned to alternative uses for this new powerful technology. Scientists and engineers alike dreamed up wild schemes to dig new canals or blast humans into space with the mighty power of the atom.

Few of these ever came to pass, with radiological concerns being the most common reason why. However, the Soviet Union did in fact manage to put nuclear explosions to good use for civilian ends. One of the first examples was using a nuke to plug an out-of-control gas well in the mid 1960s.

Continue reading “Yes, You Can Put Out A Burning Gas Well With A Nuclear Bomb” →

Need A New Programming Language? Try Zig

October 5, 2021 by Matthew Carlson 131 Comments

Maybe you’ve heard of it, maybe you haven’t. Zig is a new programming language that seems to be growing in popularity. Let’s do a quick dive into what it is, why it’s unique, and what sort of things you would use it for. (Ed Note: Other than “for great justice“, naturally.)

What Is It?

You’ve likely heard of Rust as it has made significant inroads in critical low-level infrastructures such as operating systems and embedded microcontrollers. As a gross oversimplification, it offers memory safety and many traditional runtime checks pushed to compile time. It has been the darling of many posts here at Hackaday as it offers some unique advantages. With Rust on the rise, it makes sense that there might be some space for some new players. Languages like Julia, Go, Swift, and even Racket are all relative newcomers vying for the highly coveted mindshare of software engineers everywhere.

So let’s talk Zig. In a broad sense, Zig is really trying to provide some of the safety of Rust with the simplicity and ease of C. It touts a few core features such as: