fubarx @ fubarx @lemmy.ml

Posts

28

Comments

774

Joined

2 yr. ago

People used to do this at tech conferences, but using Twitter. Someone would start a hashtag and people would jump in. There was always a fun side-channel going with people commenting on what was being presented on the main stage.

Fun times, before... sigh

New casual gaming platform, using on-device AI. Hope to have something to share and get feedback in a few weeks.

Get your filthy mitts off her. That's my future wife. As soon as my check clears, we're getting married.

• Putting out the app I've been working on for the last year.
• More hugging the family (and general appreciation).
• Catching up with friends more often.
• Ignoring the news.
• Not having my back go out and ending up in ER, like last year.

• Practice triage: start with small, achievable projects that can be done on a weekend. Don't get overwhelmed. Be kind to yourself. Not every problem is immediate or needs fixing.
• If you have access to a local tools library, avail yourself of it fully. The staff are a treasure-trove of wisdom and knowledge. If not, talk to the oldest, crotchiest person at your local bardware store.
• There are so many single-use tools out there (favorite one is so you can unscrew the faucet bolt under a sink). If not, see if there's a community online board and post a request.
• Vintage appliances, windows, doors, etc are cool. A little elbow grease and they're in good shape. Junkyards and recycling centers are a treasure trove.
• If it involves anything hazardous or too heavy (gas, electricity, foundation), bite the bullet and seek professional help.
• Ants and cracks are small-fry. Baits and fillers are easy fixes. Focus on big ticket items. And remember, some things are best left alone (see triage, above).

Go back to the Garden of Eden with a bucket, grab all the apples, then head back.

We're engaged. Will be getting married as soon as my deposit check for half the expenses clears.

Ran a hairdryer all night, propped against my Mac laptop keyboard after a friend knocked over a full pint of beer onto it.

The next morning the whole bathroom reeked of stale beer, the power bill was astronomical, and the left quarter of the keyboard never worked again.

Took it in for repairs and was grateful AppleCare swapped it out without a peep. This was a while back, before the embedded moisture strips that void the warranty.

I tried to offer a gentler backgrounder on this HCI business: https://lemmy.ml/comment/17160273

The opcodes that actually jumped out at me more than the undocumented ones were the ones that erases the flash.

But the conclusion stands. None of this is a 'backdoor' unless you can secretly access it from the wireless side and nothing in the presentation points to that. If I had to guess, the opcodes are for QA and tuning on the manufacturing line.

ARM is a UK-based company. If they hadn't dropped out of EU, it's possible they would have settled on an ARM-based supercomputer design.

Chalk it up to another WIN for Brexit!

Thanks, am on the beta now. Feedback sent via TestFlight.

Am not. Happy to jump on it if you can point me at instructions.

Pull up a chair and pour yourself a stiff beverage...

TLDR: Don't Panic.

If you have a regular old processor (MCU) and want to give it wireless capability, you can buy a wireless chip and stick it next to the processor, then have the MCU talk to it through a wired connection (typically UART or SPI). Think of it as the old ATDT commands that had your PC control your old screeching modems.

To standardize this communication protocol, folks came up with the Host Controller Interface (HCI) so you didn't have to reinvent that protocol for every new chip. This was handy for people on the MCU side, since they could write firmware that worked with any wireless chip out there, and could swap out for a cheaper/faster one with minimal change.

Fast forward to the era of integrated MCU+wireless, where you had a little ARM or other lightweight processor plus a little radio, and the processor could run programs in a high-level API that abstracted out the low level wireless stuff. Plus, you could use the same radio for multiple wireless protocols, like BLE, wifi, ANT, etc. Nordic and TI were early adopters of this method.

Typically, it was the vendor's own processor talking to their own wireless module, but they still implemented the full HCI interface and let it be accessed externally. Why? So if your design needed an extra beefy processor and used the MCU+wireless chip as a simple communication module, this would still work. The teeny MCU could be used to run something extra in parallel, or it could just sit idle. A typical example could be a laptop or cell phone. The little MCU is too small for everything else, so you pair it with a big chip and the big chip drives the little chip through HCI.

Sure, it would be cheaper if you just went with a basic 'dumb' wireless chip, as folks from CSR, Broadcom, and Dialog kept pointing out. But the market demanded integrated chips so we could have $10 activity trackers, fancy overpriced lightbulbs, and Twerking Santas (https://www.amazon.com/twerking-santa-claus/s?k=twerking+santa+claus).

For integrated MCU+wireless chips, most vendors didn't release the super low-level firmware that ran between them. There was no need. It was internal plumbing. They exposed SDKs so you could control the wireless chip, or high-level Bluetooth/wifi APIs so you could connect and talk to the outside world in a few lines of code. These SDKs were unique to each vendor (like Nordic's nRF Connect library, or TI's SimpleLink SDK).

Then along came Espressif out of Shanghai, China with a combo chip (ESP8266) that offered processor + wifi and was so cheap and easy to program that it took the hobbyist market by storm. Oh, god... so many LED light strips, perfect for Christmas and blinky EDM lightup outfits (hello, Adafruit: https://www.adafruit.com/category/65).

Fast forward and Espressif drops the ESP32. A bigger, faster Tensilica Xtensa processor, with built-in flash storage, plus wifi, Bluetooth, and BLE in one place. Plus lots of peripherals, busses, and IO pins. Also, running FreeRTOS and eventually Arduino SDKs, and MicroPython. All for less than $5! It took off like a rocket. So many products. Plus, you could run them as little webservers. Who doesn'l love a little webserver in their pocket?

It's gone through a few variations, including swapping out the Tensilica with an open-source RISC-V MCU, but otherwise it's a massive seller and the gateway drug for most IoT/Smarthome nerds.

So along come these Tarlogic researchers, looking to build a direct USB to bluetooth library. This way, you can drive the wireless from, say Linux, directly. There are already BLE to USB stacks, but this one is giving access at the HCI level, in a C library. Handy if you're doing research or developing drivers, but not the sort of thing your typical DIY person needs.

As part of their process, the researchers decide to dump the really low level ESP32 firmware and reverse engineer it.

A typical HCI implementation is a giant event loop that handles HCI opcodes and parameters. Host wants to talk to the outside world, it sets up some registers, configures the unique MAC address, then opens a channel and starts sending/receiving (hopefully without the modem screeching tones). There are typical packet encoders and decoders, multiple ISO/TCP layers, and the sort of thing that most people assume somebody else has gotten right.

For fancier implementations, there may be interrupt or DMA support. Sometimes, there's a multi-tasking part under the hood so they can time-slice between wifi, bluetooth, and ble (aka Fusion or Coexistence support). Not that you should care. The internals of this stuff is usually nobody's business and the vendors just include a binary blob as part of their SDK that handles things. The host systems just talk HCI. The wireless side talks HCI on the wired side, and wireless on the radio side. Everyone's happy.

In the process of reverse engineering the low-level HCI blob, these researchers found a few extra undocumented HCI opcodes. They're not sure what they're for, but according to their presentation (https://www.documentcloud.org/documents/25554812-2025-rootedcon-bluetoothtools/) if my super rusty Spanish holds up, it has to do with setting MAC addresses and handling low-level Link-Level Control Protocol communications (https://www.ellisys.com/technology/een_bt10.pdf).

Now in an of itself, this is no big deal. ESP32s already let you easily set your own temporary MAC address (https://randomnerdtutorials.com/get-change-esp32-esp8266-mac-address-arduino/), so there has to be a way to override the manufacturer one. And LLCP management is a totally geeky low-level thing that the MCU needs when handling wireless packets. There are perfectly good reasons why the opcodes would be there and why Espressif may not have documented them (for example, they could be used only during manufacturing QA).

So the original presentation is a teeny bit of an exaggeration. Yes, the opcodes exists. But are they nefarious? Should we stick all our ESP32s inside Faraday cages? Is this a secret plan for the CCP to remotely control our lights and plunge the world into chaos?

As I said before, ONLY if there's a secret as-yet-undiscovered wireless handshake that gives remote wireless access to these (or really, pretty much any other published HCI opcode). That presentation most definitely doesn't claim that.

To see if there is a REAL backdoor, you should wait for an analysis from fine professional wireless debugging vendors like Ellisys (starting models run $30K and up), Frontline, or Spanalytics.

Incidentally, Tarlogic, the group that put out that paper have their own BLE analyzer product (https://www.tarlogic.com/es/productos/analizador-bluetooth-le/). They look to know their stuff, so they should know better than putting out clickbait-y hair-on-fire reports. But come on, who can resist a good CCP/backdoor headline? Will media run with this and blow it out of proportion? No way!

If you've read this far, you must safely be on your third drink or the edible's just kicked in. Stop panicking, and wait until the pro sniffer and Bluetooth forum people give their opinions.

If it turns out there is an actual WIRELESS backdoor, then by all means, feel free to panic and toss out all your Smarthome plugs. Go ahead and revert to getting up and flicking on your light switch like a peasant. Have a sad, twerk-free Christmas.

But over a few undocumented HCI opcodes? Have another drink and relax.

Happy Sunday.

PS: controversy already up on wikipedia: https://en.m.wikipedia.org/wiki/ESP32

PPS: you may want to stock up on ESP32s for your light-up Christmas light project. Don't be surprised if Espressif gets smacked with some hard tariffs or an outright ban, based on these ragebait headlines 🤷🏻‍♂️

Edit: DarkMentor offers a little more detail on the nature of the opcodes: https://darkmentor.com/blog/esp32_non-backdoor/

This sounds like there are some undocumented opcodes on the HCI side -- the Host Computer Interface -- not the wireless side. By itself, it's not that big a deal. If someone can prove that there's some sort of custom BLE packet that gives access to those HCI opcodes wirelessly, I'd be REALLY concerned.

But if it's just on the host side, you can only get to it if you've cracked the box and have access to the wiring. If someone has that kind of access, they're likely to be able to flash their own firmware and take over the whole device anyway.

Not sure this disclosure increases the risk any. I wouldn't start panicking.

The first one was tall and skinny and toppled over after a landing leg malfunctioned. So they sent a second tall skinny probe, loaded with expensive equipment. Aaaand it fell over.

Maybe somebody should tell them about center of gravity and redundant systems.

I live in an earthquake zone and have been taking CERT emergency training courses. Have been looking at these as part of a neighborhood emergency network.

Turns out SeedStudio sells these with a base that comes with a display and a bunch of grove connectors, as well as a cheap GPS module. Will have to think a bit more on what else may be needed (keyboard, display, battery, vibration, or other environmental sensors?)

It may be possible to build one of these for < $50USD and hopefully cheaper, then have each emergency sector in the city keep one as part of their emergency cache. Would be useful if cell networks and power go out.

I mostly use it on an iPad mini in landscape mode, when lying down and casually reading. Two things:

1. When scrolling on the main feed, if your left or right finger accidentally touches the screen, instead of scrolling, you're inside the post, which isn't what you intended. So you have to be extra careful keeping your fingers away. Be nice if there was a 1 or 2" zone on each side which only does scroll instead of tap. Not sure I'm explaining it right.
2. Again, on an iPad mini, the Post box only shows a couple of lines for editing. Most of the screen is taken by application chrome.

Other than that, love the app. Use it daily.

https://developers.google.com/ml-kit/

Saw one in a neighborhood full of Priuses and EVs. Imagine the block party conversations.

That and your citizenship papers, in case of Papiere, Bitte. 🤷🏻‍♂️