Hackaday Superconference 2023: Workshops Announced, Get Tickets Now!

October 12, 2023 by Elliot Williams 4 Comments

Last week, we announced just half of our fantastic slate of talks for Supercon. This week, we’re opening up the workshops. The workshops are small, hands-on opportunities to build something or learn something, lead by an expert in the field. Workshops sell out fast, so register now if you’re interested.

And stay tuned for the next round of talk reveals next week! And maybe even the badge reveal?

Andy Geppert
Weave Your Own Core Memory – Core16!

This workshop provides you with the opportunity to weave your own core memory! Using 16 authentic ferrite core bits and 16 RGB LEDs, you can play tic-tac-toe, paint with a magnetic stylus, and create your own interactive experiences. Andy Geppert will guide you through the assembly of Core16. The Core16 kit is the little brother of the Core64 kit. The smaller Core16 kit reduces assembly time/cost, enabling more people to experience the challenge and satisfaction of creating their own core memory.

Travis Foss
Presented by DigiKey: Introduction and expansion of the XRP Robotics Platform

In this workshop you will be able to get your hands on the new XRP (Experiential Robotics Platform) and take the basics a step further with a few additional parts. Along with the base kit, participants will have the opportunity to install a RGB twist encoder, a LCD screen, and a buzzer to create a setup that will allow the user to choose a program onboard without being tethered to a computer.

Becky Button
How to Make a Custom Guitar Pedal

Musical effects are for everybody! Join this workshop and get hands-on experience assembling and programming your musical effects pedals. Walk away from this workshop with the capability of integrating multiple musical effects into 1 device and reprogramming the pedal with any effects you want!

Daniel Lindmark
From Zero to Git: 1 Hour Hardware Git Bootcamp

In this workshop, you will learn all about basic git operations, including how to download and install the client, setting up a repo, synching changes, and much more. Learn how to navigate common issues and take advantage of a live FAQ during the workshop.

Jazmin Hernandez
Solder and Learn How to Use Your Own Anti-Skimmer (HunterCat)

Have you ever been vulnerable to data theft? Do you fear using your bank card in ATMs or even in a restaurant? Protect your information from potential skimmers in this workshop while you learn to solder some components of your anti-skimmer/magnetic stripe clone detectors. By the end of the workshop, you’ll have a device to insert before using your bank card to check for potential issues.

Matt Venn
Tiny Tapeout – Demystifying Microchip Design and Manufacture

In this workshop, you can design and manufacture your own chip on an ASIC. You will learn the basics of digital logic, how semiconductors are made, the skills needed to use an online digital design tool for simulation, and how to create the GDS file for manufacturing. Participants will also have the option to submit their designs to be manufactured as part of the Tiny Tapeout project.

You can’t attend the workshops without attending Supercon, so get your tickets! (As we write, there are only ten more…)

You’ve Got Mail: It All Depends On ZIP Code

October 12, 2023 by Kristina Panos 26 Comments

Previously on You’ve Got Mail, we looked at a few services that were designed to speed up the mail at various points along the way. But these improvements were all taking place on the USPS’ side of the the fence. Was there anything the customer could be doing to help out?

As it turns out, yes. And it was almost too late. Whereas you could once address a letter or postcard simply to “Fred Minke, Somerset, Wis.” and it would reach him, the volume of mail was getting completely out of hand with the rise of computers, automated billing, and advertising. Something was needed to improve routing and speed up delivery.

We all know enough about ZIP codes to use them, but where did they come from? How many types are out there? What do they even mean? Let’s find out.

Continue reading “You’ve Got Mail: It All Depends On ZIP Code” →

Meshtastic And Owntracks To Kick Your Google Habit

October 11, 2023 by Jonathan Bennett 20 Comments

I have an admission to make. I have a Google addiction. Not the normal addiction — I have a problem with Google Maps, and the timeline feature. I know, I’m giving my location data to Google, who does who-knows-what-all with it. But it’s convenient to have an easy way to share location with my wife, and very useful to track my business related travel for each month. What we could really use is a self-hosted, open source system to track locations and display location history. And for bonus points, let’s include some extra features, like the ability to track vehicles, kids, and pets that aren’t carrying a dedicated Internet connection.

You can read the title — you know where we’re going with this. We’re setting up an Owntracks service, and then tying it to Meshtastic for off-Internet usability. The backbone that makes this work is MQTT, a network message bus that has really found its niche in the Home Assistant project among others. It’s a simple protocol, where clients send brief messages labeled by topic, and can also subscribe to specific topics. For this little endeavor we’ll use the Mosquito MQTT broker.

One of the nice things about MQTT is that the messages are all text strings, and often take the form of JSON. When trying to get two applications to talking using a shared MQTT server, there may need to be a bit of translation. One application may label a field latitude, and the other shortens it to lat. The glue code to put these together is often known as an MQTT translator, or sometimes an MQTT bridge. This is a program that listens to a given topic, ingests each message, and sends it back to the MQTT server in a different format and topic name.

The last piece is Owntracks, which has a recorder project, which pulls locations from the MQTT server, and stores it locally. Then there’s Owntracks Frontend, which is a much nicer user interface, with some nice features like viewing movement a day at a time. Continue reading “Meshtastic And Owntracks To Kick Your Google Habit” →

Jenny’s Daily Drivers: SerenityOS, And In Particular, Ladybird

October 10, 2023 by Jenny List 35 Comments

As we continue on with the series in which I take a different OS for a spin every month I am afraid, dear reader, that this month I have a confession to make. Our subject here isn’t a Daily Driver at all, and it’s not the fault of the operating system in question. Instead I’m taking a look at a subject that’s not quite ready for the big time but is interesting for another reason. The OS is SerenityOS, which describes itself as “a love letter to ’90s user interfaces with a custom Unix-like core“, and the reason I’m interested in it comes from its web browser. I know that the OS is very much a work in progress and I’ll have to forgo my usual real hardware and run it in QEMU, but I’ve heard good things about it and I want to try it. The browser in question is called Ladybird, and it’s interesting because it has the aim of creating a modern fully capable cross-platform browser from scratch, rather than being yet another WebKit-based appliance.

A Pleasant Trip Into The 1990s

Part of a Linux desktop with the SerenityOS build instructions in the background, a terminal having built the OS, and the OS itself in a QEMU window. — My first look at SerenityOS after building it.

SerenityOS isn’t ready to be installed on real hardware, and there’s no handy ISO to download. Instead I had to clone the repository to my Linux machine and run the build script to compile the whole thing, something I was very pleased to observe only took about 40 minutes. It creates a hard disk image and opens QEMU for you, and you’re straight into a desktop.

When they mention ’90s user interfaces they definitely weren’t hiding anything, because what I found myself in could have easily been a Windows 9x desktop from the middle of that decade. There are a bunch of themes including some Mac-like ones, but should you select the “Redmond” one, you’re on very familiar ground if you had a Microsoft environment back then. It’s only skin-deep though, because as soon as you venture into a command line shell there’s no DOS to be found. This is a UNIX-like operating system, so backslashes are not allowed and it’s familiarly similar to an equivalent on my Linux box. The purpose of this review is not to dive too far into the workings of the OS, but suffice it to say that both the underpinnings and the desktop feel stable and as polished as a Windows 95 lookalike can be. The various bundled utilities and other small programs seem to work well, and without any hint of the instabilities I’ve become used to when I’ve experimented with other esoteric operating systems. Continue reading “Jenny’s Daily Drivers: SerenityOS, And In Particular, Ladybird” →

Illustrated Kristina with an IBM Model M keyboard floating between her hands.

Keebin’ With Kristina: The One With The Arboreal Keyboards

October 9, 2023 by Kristina Panos 6 Comments

Well, unfortunately we don’t know much yet about this nice wooden keyboard from [Kelvin Chow], but maybe this inclusion will encourage [Kelvin] to post more about it.

Sure is nice-looking, don’t you think? That’s because there some great details at play here, like the legend-less two-tone keycaps and the neat-o locking box it sits in.

This keyboard is inspired by the Hacoa Ki-board, which uses a singles plank of wood to craft the keycaps. [Kelvin] wanted to try this technique for themselves. Evidently this won’t be the last wooden keyboard, so stay tuned for more over on Hackaday.io.

This isn’t the first dead-tree keyboard we’ve seen around here, either. A while back we saw one with Scrabble tile keycaps, and earlier this year, a nice wooden macro pad.

Continue reading “Keebin’ With Kristina: The One With The Arboreal Keyboards” →

Hackaday Links: October 8, 2023

October 8, 2023 by Dan Maloney 17 Comments

Too much of a good thing is generally a bad thing, but a surfeit of asteroid material is probably a valid exception to that rule. Such was NASA’s plight as it started to unpack the sample return capsule recently dropped off by the OSIRIS-REx spacecraft as it flew by Earth, only to discover it was packed to overflowing with samples of asteroid Bennu. The spacecraft, which arrived at Bennu in 2018 and spent a good long time mapping the near-Earth asteroid, apparently approached its carefully selected landing site a bit too energetically and really packed the sample container full of BennuBits™ — so much so that they could actually see sample shedding off into space before stowing it for the long trip back to Earth. The container is now safely in the hands of the sample analysis team, who noted that everything in the TAGSAM (Touch and Go Sample Acquisition Module), even the avionics deck, is covered with black particles, each precious one of which needs to be collected and cataloged. The black stuff is especially interesting to planetary scientists, as it might be exactly what they were after when they selected Bennu, which may have broken off a much larger carbon-rich asteroid a billion or so years ago. It’ll be interesting to see if these interplanetary hitchhikers have anything to tell us about the origin of life in the solar system.

Continue reading “Hackaday Links: October 8, 2023” →

This Week In Security: Looney Tunables, Not A 0-day*, And Curl Warning

October 6, 2023 by Jonathan Bennett 8 Comments

This week starts out with a nifty vulnerability in the glibc dynamic loader. This is an important step in running a binary executable on Linux, as it pulls the list of required shared libraries, and loads those libraries into memory. Glibc also includes a feature to adjust some runtime settings, via the GLIBC_TUNABLES environment variable. That’s where the vulnerability resides, and researchers from Qualsys obviously had a bit of fun in taking inspiration to pick the vulnerability name, “Looney Tunables”.

The problem is memory handling in the sanitizing parser. This function iterates through the environment variable, looking for strings of tunable1=aa, separated by colons. These strings get copied to the sanitized buffer, but the parsing logic goes awry when handling the malformed tunable1=tunable2=AAA. The first equals sign is taken at face value, copying the rest of the string into the buffer. But then the second equals sign is also processed as another key=value pair, leading to a buffer overflow.

The reason this particular overflow is interesting is that if the binary to be run is a Set-User-ID (SUID) root application, the dynamic loader runs as root, too. If the overflow can achieve code execution, then it’s a straightforward privilege escalation. And since we’re talking about it, you know there’s a way to execute code. It turns out, it’s possible to overwrite the pointer to the library search path, which determines where the dynamic loader will look for libraries. Tell it to look first in an attacker-controlled location, and you can easily load a malicious libc.so for instant code execution.

This vulnerability affects many Linux distros, and there’s already a Proof of Concept (PoC) published. So, it’s time to go check for updates for cve-2023-4911. Continue reading “This Week In Security: Looney Tunables, Not A 0-day*, And Curl Warning” →