Notices by Gus (projectgus@aus.social)

Got pulled in as secondary consultant for a head-scratcher of a problem flashing an ESP32 from a Linux SoC embedded in a product.

The ESP32 flashes perfectly from a USB/Serial adapter, but would never flash from the SoC's onboard UART.

Waveforms on the scope looked absolutely perfect, all the transitions happen at the right time and we see the ESP32 go into its serial bootloader mode. However, it never sends any reply to the packets sent from esptool.

Several hours of head-scratching and triple-checking signals ensue.

Eventually I zoomed in on the packets sent by the SoC's onboard UART. esptool sends these SYNC packets with 0x55 square wave payload, and the ESP32 auto-bauds based on what it receives.

The problem is there, but its not exactly easy to spot...

#esp32 #embedded

There was a pretty tidy looking Apple Extended Keyboard (1990ish vintage) in the same bin. I'm kind of proud I left that there, as I already have an Apple Extended Keyboard II that I should get rid of.

Pleased(*) to see my local tip has reopened their ewaste sorting centre, so I now get to find out what was wrong with this 1000W Corsair PC power supply.

(*) If you ignore the increased hoarding this enables

I have a probably-foolish question about IPv6 and privacy, I suspect something fundamental I don't understand.

My home ISP issues IPv6 ranges that effectively never change. I know there is a spec for how to do automatic rotation, but mine haven't changed in the 9+ months I've been watching them. I think this is pretty common.

A big win if you want to run any kind of server as you basically get all the static IPs that you could want, at no extra charge. Yay!

However, isn't any privacy preserving stuff you do in your home web browser almost a waste of time now? At best, all the internet access from this location is trivially correlated by the IPv6 prefix. At worst, it's trivially correlated per-device if your home router never rotates addresses.

I know dynamic IPv4 isn't "for" privacy, but (especially with CGNAT) I always felt a little comfortable that correlating someone's online activity long term would take at least a small amount of effort (for businesses, not for governments).

(BTW I know that routing all traffic through a VPN provider takes this mostly off the table, similar to CGNAT but you get to solve a lot more captchas. I still feel like I must be missing something, given the overlap between nerds who like Privacy and nerds who like IPv6 rollout.)

#ipv6 #privacy

LOL, I was thinking my solder flux gel is nowhere near as effective as when it was when new.

One syringe is over 10 years old, one is 7 years old. Even the colour difference between the two is telling... 🤦♂️

The manufacturer datasheet says it can be kept unrefrigerated for up to 12 months, "depending on packaging". 🙃

Although it does still work as flux. Not particularly good flux, but still. Honestly pretty impressive.

#electronics

Taobao store that sells tissue box covers modelled like shipping containers.

Most have major shipping brands on them, but one has the docker logo. 😄

Plus, inexplicably, one has the VSCode logo!

(Those two seem to be the most popular according to the reviews.)

So odd.

https://item.taobao.com/item.htm?id=752110369496

@Unixbigot "Here's your site license, and here's the number of our grief counselling service."

My fridge has a WIFI header and a UART For Test header...

I'm honestly worried about what I might do with this information.

I needed a small Linux computer to run rtl_433 and remembered these Pi Model As, left over from some long ago client's project.

I guess it's admirable that the Pi foundation still supports 10+ year old hardware, unfortunately it's a real struggle in 256MB of RAM.The Debian Bookworm-based minimal install actively swaps to the SD card whenever it does anything at all..

OpenWRT to the rescue! Has pre-built images for the Pi SoCs[*], serial console by default, uses a fraction of the RAM and an impressive amount of software is packaged for it. ✨

https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi

[*] For Ethernet on the A then you probably need to build a custom image with the right kmod-usb-net-XYZ module for your adapter.

#raspberrypi #openwrt

So impressed with the progress of the ESP32 open source Wi-Fi MAC efforts: https://zeus.ugent.be/blog/23-24/esp32-reverse-engineering-continued/

Had similar long term ambitions on ESP8266 when I started esp-open-rtos a decade ago, but ended up being hired by Espressif instead. 😅

From inside we always had theoretical support for open sourcing more of the WiFi stack, but it was never going to become a priority unless some high tier client demanded it...

I look forward to seeing where this effort lands!

#esp32 #reverseengineering

(In b4 standard Fediverse reply of "piracy has no ads, torrenting everything is the only ethical choice, etc, etc.")

PSA for Aussies who watch SBS on Demand:

SBS is trialling a feature where you opt out of one category of advertising. Register here:

https://help.sbs.com.au/hc/en-au/articles/360002023835-Information-on-ads-and-ad-preferences-on-SBS-On-Demand

This information brought to you by my partner writing to complain about the relentless and mind-numbing gambling ads they show. (Although not #AloneAustralia I noticed, top shelf advertisers on that programme!)

#SBS #SBSOnDemand #TV

Friendship with vintage Apple Keyboard ended.

Wacky glowy clicky keyboard is my new best friend.

In other news, RIP my typing speed. How do people do this?

Infuriating corporate technical support forum anti-pattern:

1) Someone posts a sensible description of a problem they're having.
2) Employee replies "The forum moderator had marked your post as needing a little more investigation and direct support. An online support case has been created on your behalf, please stand by for just a moment and you will hear from us."
3) This gets marked as the Accepted Answer, and seemingly will never be updated again.

https://community.st.com/t5/stm32-mcus-products/prevent-speculative-access-using-privdefena/td-p/625982

... all the downsides of a public forum, plus all the downsides of providing support in private channels 🤦♂️

Kagi account deleted. To their credit they made this very easy to do. Back to using DDG as "the best of a bad bunch, I guess" for now.

For me it wasn't specifically incorporating results from Brave, it was the blanket statements about keeping out politics.

A search engine can't "keep out" of politics any more than a library can. Which is not to say that libraries and search engine can't aspire to be neutral, but in that case they need to *really* do the work to define what that means and how they go about it in an ethical fashion.

Hand-waving away that huge responsibility isn't going to work.

@inthehands put the issues around this very well: https://hachyderm.io/@inthehands/111707594378406458

(I'm not trying to call this a nothingburger, clearly it's a nasty bug which has a huge impact on the vulnerable platforms. I just don't quite follow yet how many platforms belong in that category...)

Looking at the LogoFAIL white paper and I'm not connecting the "just about every device vulnerable" part of the headlines.

IIUC, vulnerable UEFI firmware has to support loading a custom logo from the EFI system partition. I can't find much vendor support for this?

The only documented method I've found is from HP: https://support.hp.com/au-en/document/c01646879

Do more vendors support this but don't document it?

Other "custom BIOS logo" tutorials I've found involve repacking a firmware image, in which case surely the logo is in the BGRT inside the firmware payload which is verified by Intel Boot Guard / Secure Boot before it's loaded. Isn't it?

#logofail #infosec #uefi

Four days after seeing @daedalus post about kagi.com, I've run out of free trial searches and signed on for a US$10/month unlimited plan. Happily!

On the one hand, internet search should absolutely be a publicly regulated utility. Reserving reasonable search results for people who can afford to pay upfront for them is digital divide bullshit compared to "the good old days".

On the other hand, gee it's been nice searching for things and finding them easily. For years I've been gradually mashing "!g" more and more when Duck Duck Go (a.k.a Bing in a funny hat) fails. Then increasingly having to edit and re-run the Google search query multiple times until Google finally turns up a half-decent result.

Not to jinx it, but so far my experience of Kagi has been not that. Closer to internet search of old...

@jwildeboer @77nn FWIW, thanks for re-linking that post. Sometimes federation does weird things around edits, here I see the original reply in the thread (without the link). I had to click through to hackyderm.io to see the edited version with the link to https://hackingbutlegal.substack.com/p/naomi-wu-and-the-silence-that-speaks-volumes

This is also really troubling news, I hope Naomi and Kaidi are OK.