Hackerspace News

Flipper One: Il mostro da laboratorio che non sa quando fermarsi

🇮🇹 · /root · Lamberto Tedaldi

Immaginate di prendere un computer di fascia media, un modulo radio avanzato, un server miniaturizzato e un pezzo di hardware per l’espansione industriale, e di schiacciarli tutti insieme in un dispositivo che potresti comodamente infilare in tasca. Ecco, questo è quello che sta provando a fare il nuovo Flipper One. Se eravamo abituati al Flipper Zero come a un giocattolo geniale e un po’ imprevedibile, il ‘One’ è un salto verso l’ignoto che mette ansia e soggezione. Le specifiche tecniche sono appena trapelate e, onestamente, sono una bizzarria tecnologica che farebbe impallidire qualsiasi produttore di smartphone di fascia alta. Parliamo di un processore Rockchip RK3576 con 8 core, 8 GB di RAM LPDDR5 e una NPU da 6 TOPS. Sì, avete letto bene: c’è un’unità per l’intelligenza artificiale integrata in un dispositivo che, tecnicamente, dovrebbe servire per il debugging e il testing hardware. Ma il vero delirio da maker è la connettività. Abbiamo due porte Ethernet Gigabit, uscita HDMI 2.1 che supporta il 4K a 120Hz, DisplayPort, USB 3.1 e persino un modulo M.2 Key B sotto la scocca. Per chi mastica di elettronica, questo significa che puoi praticamente montare un SSD o un modulo custom e trasformare il tuo Flipper in una workstation portatile. E che dire del microcontrollore secondario? Un RP2350 della Raspberry Pi Silicon, con tutto il supporto per i nuovi core ARM, che gestisce le operazioni a bassa latenza. È pura follia progettuale. Naturalmente, c’è un ‘ma’. Con tutta questa potenza e questa varietà di interfacce (parliamo di porte USB, HDMI, diversi bus di comunicazione), il consumo energetico e la gestione termica saranno un incubo. Come faranno a far stare tutto questo calore in un modulo così compatto senza che diventi un piccolo radiatore da scrivania? E la durata della batteria? Se usate tutto il potenziale, probabilmente dovrete restare attaccati a una presa di corrente dopo dieci minuti. Per noi che amiamo smanettare, però, questo è il paradiso. La possibilità di avere pin GPIO, interfacce di comunicazione seriali, USB e persino un output video di alta qualità su un unico device è una bomba per il prototyping rapido. Potete intercettare traffico di rete, analizzare protocolli hardware e contemporaneamente avere un’interfaccia grafica fluida per visualizzare i dati. Certo, rimane il dubbio su quanto questo device sarà accessibile (in termini di prezzo) e quanto sarà difficile gestire il software. Ma se l’obiettivo è creare lo strumento definitivo per il debugging e l’analisi di sistema, allora il team di sviluppo ha centrato il punto. Non vedo l’ora di avere tra le mani un prototipo per vedere quanto velocemente riesco a mandare in corto circuito le aspettative (o la batteria). Source: Flipper One Tech Specs

webnewsembedded-systemsFlipper Onehardware-hackingtech news

Laser-Wartung

🇩🇪 · Warpzone · larsm

Unser CNC Laser Cutter hat eine Wartung erhalten. Spiegel und Linse wurden gereinigt und neu fixiert. Zudem hatte sich die Fixiermutter der Linse gelöst, wodurch sie bei schnellen Bewegungen wackelte. Das Endergebnis sind ca. 30% mehr Leistung und ein viel saubereres Schnittbild. Linse vorher: Schnittbilder in Stempelgummi mit identischen Parametern:

Uncategorized

Un’estensione di VS Code entra nel cuore di GitHub: il classico errore da ‘clicca qui per il plugin magico’

🇮🇹 · /root · Lamberto Tedaldi

Avete mai avuto quella strana sensazione, mentre cercate un plugin per colorare meglio il codice o per automatizzare un task inutile, che stiate per invitare un estraneo a cena in salotto? Ecco, qualcuno nel team di GitHub lo ha fatto davvero, e il risultato è stato un disastro di proporzioni industriali. GitHub ha appena confermato che circa 3.800 repository interni sono finiti sotto i ferri di un attacco informatico. E la causa non è un super-hacker con un cappuccio nero che ha bypassato firewall impenetrabili, ma un dipendente che ha installato una maledetta estensione malevola su VS Code. Sì, avete letto bene: un singolo clic su un’estensione probabilmente inutile ha aperto le porte del fortino. La notizia è la solita, stanca conferma che la supply chain security è un buco nero senza fondo. Non importa quanto siano robusti i vostri sistemi di autenticazione o quanto siano blindati i server; se qualcuno nel team decide di installare quel plugin ‘comodo’ che promette di formattare il codice in modo ancora più elegante, il gioco è fatto. È il classico problema del ‘trusting the developer’, che per noi maker e smanettoni è un concetto sacro, ma che nel mondo enterprise si sta rivelando il tallone d’Achille più grande. Dal mio punto di vista, questa è la prova che l’hype per la comodità sta vincendo la battaglia contro la prudenza. Viviamo in un’epoca in cui vogliamo tutto subito, con un click, integrato in un unico IDE, senza dover configurare nulla. Ma questa comodità ha un prezzo: la superficie di attacco si espande a dismisura. Ogni estensione che aggiungiamo al nostro setup è un potenziale cavallo di Troia che attende solo di essere aggiornato con una payload malevola. Cosa significa per noi che passiamo le notti tra circuiti, codice Godot e modelli 3D in Blender? Significa che non possiamo più permetterci il lusso dell’ingenuità. Se usate estensioni non verificate, se installate pacchetti npm senza controllare cosa stanno facendo in background, state giocando alla roulette russa con i vostri dati. Non parlo di diventare dei paranoidi che usano solo Vim in modalità testuale (anche se, ammettiamolo, è più sicuro), ma di iniziare a guardare con sospetto quegli strumenti che promettono miracoli con zero sforzo. In conclusione: la prossima volta che vedete un plugin con 10 milioni di download e un nome altisonante, fermatevi un secondo. Fate un check. Perché se non riescono a proteggere i propri repo, figuriamoci noi che gestiamo progetti personali su server casalinghi o piccoli server Linux recuperati dalle discariche. Source: GitHub confirms breach of 3,800 repos via malicious VSCode extension

webnewscybersecuritydevopsGitHubsoftware-development

Meetups/Infra/2026-05-11

🇺🇸 · Noisebridge · Mcint

create page New page {{meetups/infra}} Monday, May 11, 2026, 7:00–8:30 PM. Shell, web services, self-hosting, networking! == Intros == * [name] - [background]. [goals for meetup, or interests to explore] - [what you’re hosting / hacking on / curious about this week.] * Loren - cloud infrastructure, interesting in rendering md files locally. * Ciara - play with linux and computer and kubernets and ?, self hosting maybe get into bi-os ? * Elan - self hosting, kubernetes, last dep now support py 3.14 * Daniel - web stuff, likes donations, built an awesome webpage, perpetually. * Derek - focusing on developer tools / specs, [...] dystopian scheduler. * Brandon - two companies: apricot, principal: respectively palenstine, and helps leave big tech. From Minn. Aspiration tech. * Doug - Likes to self-host, conjuring up software projects * Thomas - also likes to self-host, llms?, ? * Dan - likes computers to the full extent * Victor - works in platform stuff and dev tools, linux sandboxing with bubble wrap * Thom - software dev, person all projects, feeling guilty putting things on digital ocean, moved to the area 4 weeks ago * Thijs (like "dice" starts with "t") - moved here from the netherlands, failed at self hosting, * Kevin - likes computers and AI, ecosystem of coding agents and observability around them, opportunites around them. Real briefly, looking at TokenTelemtry project for analyzing token spend. Supports 8 coding agents. * Jet - got a new DSLR EOS Rebel T6i - benchmarking compiler options for Rust. * Erik - "mobile edge device (intel i9) 8GB VRAM / 64GB RAM" for kubernetes hosting, T1000 nvidia gpu (think station). Not a lot of room for context. * Ellie - really likes terminals, rust. Looking into TUI for terminal GUI. * Robert - interested in programming ingerneral * WE-Z - intersetion of verilog and pytorch, learning about Burn, a gpu tensor library in rust * Max - Here and tired, made it! * Eugene - Was outside touching actual grass today. (mention how to follow / add to notes) (add to template) (Thom - why guilty digital ocean?) () - Working on it over the weekend, instead of self hosting. == Tonight’s plan == * ‘’‘Requested topics page’’’ — new wiki subpage for ongoing intake. Quick demo of signing (<code>[[User:Mcint|Mcint]] ([[User_talk:Mcint|talk]]) [[mw:help:sign|<code><nowiki>--~~</nowiki><nowiki>~~</nowiki></code>]] 22:24, 20 May 2026 (PDT)</code>) and talk-page norms. * Joke RFC - X-Tacit knowledge is hard to transfer * ‘’‘glow-web’’’ — Loren: markdown reader in the browser, built on [https://charm.sh charm]/glow. Demo + sketch of where it’s going (history queue, diff view, blame-by-commit-age). ** https://github.com/mcint/glow-web/ ** go install github.com/mcint/glow-web/cmd/glow-web@latest *** (glow charm bracelet is lib for TUI) *** browse through files *** render with markdown hints *** side bar filter, hit cmd-k fuzzy bounce between files * (call to consider -- projects worth reading a changelog for) * VyOS - intro / discussion (see also networking intros) ** router operating system ** networking, hardware, handsoff preferred *** obtuse, archaic *** VyOS is fork of a fork Viata? edge router ubiquity toolkit **** Rational, bad security in router OSs black box vyos takes inspiration from the Cisco ecosystem designed for scriptability the operating system is designed around set commands set the hostname? $ set system host-name <ident> $ commit # save setting to linux stack (not permanent) $ save # persists through startup. It's just linux, gets patches just like linux. Designed for X86 only. A nuc running with two different ports at homelab and colo recently also installed at friends for pi-hole seems like a good idea to being linux into software world (freebsd pfSense?: https://www.pfsense.org/), gets all compat with linux networking engineers need automated rollbacks, a special proactive defense mechanism because easy to lock self out. Comes from the Cisco methodology mindset supports image management Perhaps update to a kernel you don't like download another release and upgrade to it, or downgrade supports multiple images to make updates smoother A set of toolkits built in offers wrappers around specific packages with extra care around updates. How sophisticated is rollback feature? Write-ahead log. Does: set "This is what I'm going to do. Then do the thing" Each set command sets the elements withing the config The writeahead log has a sequenece of steps is transparent The issue with MicroTik, locks into possibly vuln kernels. The nic drivers are linux for easy support. Most routers security is determined by configuration. * * Doug, sfmix ? * jet - fast token generation https://chatjimmy.ai/ https://taalas.com/products/ ** Weird product! AI Chat online. > "Are you a real AI chat?" > 14,000 token per second runs on Taalas.com can be finetuned Started two years ago Taalas HC1 tech demo runs only LLama 3.1, doesn't have any reasoning. coming out with second, medium sized reasoning model. Try a thinking question? > "Generate a fortran program to computer e to arbitrary precision" "Use SML" show an example of lifetimes in rust 2.5 kWatt server Support different type of sampling? $200M funding, 24 people * ‘’‘Changelog reading’’’ — pick a few projects, read for ~15 min, round-robin reports. '''''Report back: one notable change, one thing that surprised you, one thing worth following.''''' * https://endoflife.date/linux * https://endoflife.date/ others? ** linux kernel -- copy.fail, dirty frag -- what else big arrived -- deb or ubuntu, or other ** apache beam - py 3.14 update (no-GIL version available) Multithread everything? held up by small dependency on tensor flow ** token telemetry - what does the coding agent communicate to remote hosts? provides visilibity into what coding agents tend to offer and which MCPs are available. Constitutes a huge number of tokens. Context get accumulatively chewed up. ** python-telemetry - control what tokens end up in prompts ** Helm -- Ciara *** (Helm charts) ** suggestions: py: requests py: ... ** OpenSSL / ssl ** OpenSSH - Kevin low severity vulns were repaired ** CudaOxide * little question: openapi? (swagger implements openapi) ** docs == Changelogs -- == * OpenSSL - * Linux -- 6.12 -- realtime preemption deeper integration with eBPF support for printing qr-code on panic lkml.org * uv -- audit -- security audit came out in April. Checks lock-ed deps against Python Advisory database ** uv ? <3 - introduced in April $ uv self update # to get latest $ uv audit Resolved 54 packages in 4ms Found no known vulnerabilities and no adverse project statuses in 53 packages * Read dependencies from both pyproject.toml and uv.lock * Check all locked dependencies (including all dependency groups) against the Python Packaging Advisory Database * Generate a security report highlighting: ** Identified vulnerabilities ** Affected versions ** Bun was ported to Rust. test suite was really good. ported by LLMs in 4 days. W3C specs get negotiated between implementers Spec and Politics driven design. ** ABI changes for Fuscia? ** Nix policy changes automation policy assisted by which model or tool so it's clear to other devs their bottleneck is review. It's important that maintainers can review the flood of codegen contributions. ** Rust is adopting a more nuanced AI contribution policy ** GhosTTY maintainer: https://github.com/mitchellh/vouch vouch has denounce+commend feature transferable reputation ** apache beam - py 3.14 update (no-GIL version available) Multithread everything? -- GIL xfer is harder held up by small dependency on tensor flow ** TODO ** beam, == Outros == * Ciara - ai model - chatjimmy - energy efficient ai * Daniel - don't call me a genious, but i called weights burned into silicon years ago * Elan - uv audit -- really interesting * Derek - llm story thing, outstanding * Doug - reminded how little I know, nice to attend. Amazon S3 can now be used as a file store * Thomas - Scheduler? Into userspace, super cool * Dan - 7.whatever linux release candidate rc3. Rust extension has a section on safety * Victor - 7.0 compatilibty for Risc-V * Steve - ?? * Eugene - Taalas cool. ?! cerebras 4x faster than groq (why nvidia bought groq not cerebras) * Tom - surprised by inference speed of Taalas * Thijs - new things to look into `uv audit` * Kevin - good session, one-upsmanship game esp of calling things in advance, invented standing near other people and ignoring them (Doug had internet access in 1984) * Robert - VyOS thing very interested, lazy pushes? * Erik - VyOS sounded cool as ex-juno OS hater, has a NUC (next unit of compute) with two nics (don't forget Arista, top 3, router hate) * Max - really fast inference was really fast, ASIC AI is a fast thing. kind of mind blowing to get 100x speed up (18,000 tokens / second) end of the optimization? If we plateu, what we be able to do with on board inference 100 times faster than cloud APIs? * Ellie - Super interested with BUN news. Split! rewrite a thing in 4 days. But also,the test suite only checks node problems, imagine end up at some point with a whole class of issues? (Loren: Fuzzer in the loop) * Loren - uv audit -- (12 factor app) (Cisco OSes, Router operating system conflicts with Robot operating system) (Fish shell) () * == Dropped topics / not followed-up again == * Kevin - token telemetry * — other topics, requests, announcements. * ‘’‘tmux web session handler’’’ — Loren: claim the PyPI name live, walk through the flow. Tease two-way shell + multi-agent orchestration directions. * ‘’‘SSH agent + signing refresher’’’ — normal agent usage, then git commit signing via the agent. == Changelog reading — candidate projects == (pick your own; suggestions to seed) - - - - Report back: one notable change, one thing that surprised you, one thing worth following. == Announcements == - - == Action items / interest == - - == Links shared == -

FIX IT in the Classroom (21 May 2026)

🇨🇦 · Victoria Makerspace

FIX IT will be working on robots in the Classroom

Meetups/Infra/2026-05-18

🇺🇸 · Noisebridge · Mcint

create page New page 2026-05-18 m [[Meetups/Infra]] {{meetups/infra}} <!-- header --> (TODO summary) == Introductions == * [name] - [background]. [goals for meetup, or interests to explore] * Loren - working on automating a little more infra * Daniel - noted web dev, general computer man, how to dox null * null- interested in many things, geolocation stuff, worked on systems that used noise crypto protocol, dealing with transport and authentication scheme. * Doug - Likes computers, consistently out of his depth * Ciara - playing a lot with noise garden, came across interesting kernel hackery to improve stability * Victor - spent this week messing with network block devices * Derek - designing a system for doing spec driven development -- working with Kevin to arrive at something * Max - we know him, lately ricing linux going nowhere, interested in CVE?s, dev containers, * Eugene - after weeks of discussion process moving arch to nix, also on NAS runing ZFS for a long time, adopting 3-2-1 backup, getting the second box to copy over not so easy, messing around with sync thing, maybe second box will be nix? * Erik - trying to make his home setup quieter, it has a mysterious hum! no more spinning drives, reducing noise, unplugged all the servers. Reducing functionality are gains in peace and quiet. (Doug wonders about 15.6 kHz CRT device - 70db) * Elan - Recently looking into refactoring API to be more secure, not just more secure, and bot resistant to DDOS, setting up fail to ban properly. * Robert - currently trying to make a system that makes a toy box, like busy box, all the main utlities are contained in one binary. Has been working on that all day. Was compiling linux kernel on the thinkpad, did bring a usb drive containing current process, a binary containing bash and another containing a compiled result of toy box. No current image, but does have files. == Topics == * Noise protocol ** Cryptographic framework people are often bitten rolling their own crypto pick n' choose A Layer 2 protocol called lightning over bitcoin https://github.com/lightning/bolts/blob/master/08-transport.md Comprehensive Overiew: https://noiseprotocol.org/noise.html Need to transport, authenticate Rather than develop their own protocol will adopt noise protocol tune up the framework, or tune it down to meet the project requirements Example: The buoy project, hunting for gold, should use the noise protocol instead of learning and failing at implementing cryptolgraphy. Example: In protocol setup there are 3 handshake patterns https://en.wikipedia.org/wiki/Noise_Protocol_Framework#Handshake_patterns ** atoms of noise handshakes when paired together 1st is initiator. 2nd is responder. The first character refers to the initiator's static key: N = No static key for initiator K = Static key for initiator Known to responder X = Static key for initiator Xmitted ("transmitted") to responder I = Static key for initiator Immediately transmitted to responder, despite reduced or absent identity hiding The second character refers to the responder's static key: N = No static key for responder K = Static key for responder Known to initiator X = Static key for responder Xmitted ("transmitted") to initiator https://en.wikipedia.org/wiki/Noise_Protocol_Framework#Handshake_patterns (static key = A long term key) (Ephemoral key might be generated by a session) *** happiest path, GPG, two known keys, just use the key to encrypt *** TLS mostly works starting with an ephemoral key is used to create the session, relies on the entire infrastructure to transfer? the long term key ** All these patterns are in existing encryption schemes Framework for modeling encrypted systems, models can autogenerate clients Overall actions happen in many protocols may not used in noise methods Signal had some noise pieces Widely used in the industry for secure Are you really talking to Bob? Are you really talking to Alice? There are a lot of concerns beyond modulo arithmetic, which is what noise protocol is especially good at. https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange g is the generator of the cyclic group of order G. ** Alice and Bob agree on a natural number n and a generating element g in the finite cyclic group G of order n. (This is usually done long before the rest of the protocol; g and n are assumed to be known by all attackers.) The group G is written multiplicatively. ** Alice picks a random natural number a with 1 < a < n, and sends the element ga of G to Bob. ** Bob picks a random natural number b with 1 < b < n, and sends the element gb of G to Alice. ** Alice computes the element (gb)^a = g^(ba) of G. ** Bob computes the element (ga)^b = g^(ab) of G. Certificate authorities operate on harder and impossibly expensive to cheat the system, to make a key to claim to be google.com Three letter agencies are constantly trying to own CAs, so they can attack target systems. Signing things that are not in the transparency log is a sign of malfeasence. It comes down to trust? More fun to be had, KK Magic worm hole: https://github.com/magic-wormhole/magic-wormhole AxyotlRatchet? (regrows a secure hash) Forward secrecy, property, what you want, even if box gets popped and keys are infiltrated. Rotate keys every so often. Prevent decrypting all historically encrypted. Zacchae was wondering if there is a way to detect missing messages somehow. On signal, system ratchets key on every message. (called MLS) https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm#Functioning OTR-mode (Off the record), with Jabber. repudiation and non-repudiation Deck of cards entropy In [5]: -math.log2(1/fact(52)) Out[5]: 225.58100312370277 From Claude: The Noise spec [http://noiseprotocol.org/noise.html] is genuinely one of the most readable cryptography documents out there if you want to go deeper. * e2e principle -- end-to-end principle -- careful design of protocols, clients, architecting systems -- allows you not to keep state there * CVEs -- VMs for dev containers - light use podman in rootless mode, in a vm 3 CVEs recently - How do you isolate environments for development - Use a micro vm! Boot in 150ms Use nix -- use direnv -- and when you cd into a project, it loads you into Victor: thing about network block devices, I was looking into for microvms -- you can use memory snapshots to start the vm even faster, but still mount the project directory through from the file system. Elan: I've been doing some of this isolation with Bazel, running builders in vms * nix / lix -- nix run nixpkgs#sl you can use it as a package manager on other linux distributions, macOS, ...windows linux frontent use the determinate installer, or * NAS stuff - zfs syncing -- backups 3-2-1. SBC - single-board computers - 4 NVMe -- Eugene successfully using * demo? robert's toybox -- * Google -- Location component of ..central auth gateway ** wiggle.net ** eDNS ** Firefox / macOS -- SSID lookup ** non-location fingerprinting? canvas - any of the wild Malboge-like login scripts ** * pol.is, for spec feedback, for derek? == Outros == * null - learned nix has a (beta?) installer * Cole - contributed to the meetup as much as this lamp -- requested cryptography, * Brandon - thoura.ai - ai chatgpt, 2 syrians * Loren - more interested in crypto stuff and primitives. * Erik - nix - want to see real workflows people do * Eugene - nice to hear the ELI5 for Diffie-Hellman, also getting into nix so excited to put up my hand as a user next time * Max - forgot how satisfying doing deep dives on math, higher level discussions also appreciated (if you get into nix, there is a decent amount of self packaging involved) * Derek - like the DSL used by noise, so succinctly describes the pieces (will look into Pol.is, thanks!) * Renaud - enjoyed the crypto stuff, regrets not paying more attention in college * Victor - wants to look more into noise * Elan - am no longer affected by dirty frag? * Ciara - n/a * Doug - wants to do some elliptic crypto by hand * Robert - Feels like switching to nix so he doesn't have to deal with deps. * Zacchae - re: dissecting the signal protocol, how much effort exists for bridging. == Lesson or Demo == * Read aloud: clarify for meetup. We are taking notes in a riseup pad (or I am--help appreciated, and links). We have meeting notes posted to the wiki. noisebridge.net, search Infra, or Meetups/Infra. (the Infrastructure page has a disambiguation link.) * Shell, web services, self-hosting, networking! == Questions, Discussion, or Coworking == * [Issue] = For next time = == Questions == == Readings & Exercises == * Readings ** * Exercises ** == Join online == * Try it yourself! ** Join libera.chat #nb-meetup-infra https://www.noisebridge.net/wiki/Meetups/Infra