When deciding on a style for documentation, I typically draw the line between tutorials and references. The linear top-down flow of an introductory guide lends itself well to inserting additional context throughout it even if not completely on-topic, while in an API or hardware reference you generally want to keep each section reasonably self-contained, trivially searchable for (minimizing false hits by carefully choosing keywords) and readable independently of the others. I have found the literate programming approach [1] of writing entire tutorials as code to work pretty well for this purpose, which I've used to great effect in some of my pet projects [2].
There actually is a pretty large community of hardware reverse engineers decapping chips for fun, sometimes just to dump internal ROMs (like in this case) and other times going as far as to try reconstructing the original schematics and netlists in order to document the chip's internals and allow for more accurate emulation, in some cases all the way down to the transistor level [1] [2]. If you want to learn more, Ken Shirriff has written a lot of blog posts on the subject [3] and Siliconprawn [4] hosts a huge collection of die shots from many contributors.
Doesn’t decapping chips require hydrofluoric acid ?
If so I cannot express enough respect, the one person I’ve interacted with that regularly worked with it put the fear of god with by showing what one insignificant miss for anything else did to his finger
No, the default acid used is nitric acid. Which should definitely be treated with respect, but isn't nearly as nasty as anything with fluorine.
But if you have a few examples of the chip and can break a few eggs to make an omelette, there are techniques that just involve hitting the epoxy with a blow torch and/or opening it up with plyers.
Not just regular nitric acid either, but red/white fuming nitric acid in many cases!
Back during my teenage years I used to make the stuff for decapping projects and amateur rocketry by grabbing the ingredients from our local hardware store and distilling it in a make-your-own-moonshine kit I bought off of craigslist.
Worked great up until the police were called because the store employees thought I was making bombs. I hear heating up sulfuric acid is the better way to decap epoxy chips nowadays.
A careless move with a skill saw can take your finger off too. I don't think acid deserves such a scary reputation. I guess because it doesn't make an obnoxious sound does make it easier to forget. But in both cases you must follow best practices (fume hood, goggles, bicarb wash nearby) , and suffer consequences if you don't.
ZKPs (as well as C2PA and similar user attestation systems) are quite literally a DRM scheme for the web, fraught with all the usual control and accessibility issues while still being relatively easy to circumvent by a sufficiently motivated and funded actor. Given the huge number of shady companies that run "phone farms" for purposes ranging from social media spam to Spotify royalty farming, I doubt they would even put a dent on this kind of automated abuse. They would however be very effective at locking every Linux and GrapheneOS user out of the internet.
The internet is still full of individuals sharing deep passion for all sorts of things, but only within the walls of invite-only communities you have to go out of your way to find (Discord servers, private forums) and/or make a financial commitment towards (Patreon).
Or at least it was, before LLM "enthusiasts" started leaking into these otherwise hermetic communities and overrunning formerly safe spaces with mass-produced low-effort content nobody wants to see, particularly when anyone else could prompt the exact same thing into existence.
For me the difference today is that most people sharing their passions are now doing for The Algorithm. It's a far cry from the scrappy days of the early web where people just posted stuff because they thought it was cool. I'm not saying their passion is any less, more just that is so much noise. People are now "creators" and are pressured to constantly create.
Why do you assume a hobby or interest still has a significant presence on the non-algorithmified open web?
For travel-related hobbies, for instance, there is no longer any kind of significant open-web scene where people just share stuff to help others or because it is cool. (Yes, you can set up your own blog, but pretty much none of your peers will ever see it.) The community might be using a variety of apps beyond your "like 5 websites", but all those apps are designed around phones and minimize text content, and so they are just as pathological as "sites with 'creators'".
I'm not sure what exactly a travel-related hobby app might even be for (other than e.g. a map and a calendar, but there are FOSS ones), but isn't this exactly demonstrating the "creator" mentality? You can make your blog as you like it with text, images, videos, etc. Share it with people in your social circle who are interested. Maybe others will find it too some day if you want it to be open. But if you can't send them a link, they're not really your peer, are they? And if they won't click a link, they weren't interested.
Let me give you long-haul bicycle travel as an example: back when there was an active blogging scene, people sharing route tips and bike-build breakdowns could be sure that a decent amount of other people would find it and benefit from it: the blogs got picked up by search engines and were readily findable, and there was still a culture of using the open web.
Today, no one you will see the content that you posted to help other people out. Google began deprioritizing personal blogs a decade ago already, and now a whole generation has come up that doesn't know the open web is a thing. When people look for tips in this hobby, it is overwhelmingly on phone apps like Komoot or PolarSteps, on the general image-based social media like YouTube or Instagram, or (already for an older-skewing crowd that still uses browsers) on the big for-profit website Bikepacking.com that grew by using its SEO-fu to wipe out the non-profit-driven scene.
There is a community around this hobby, one with a lot of IRL interaction, and people do enjoy that feeling of community. But claiming that people "aren't really your peer" if they don't use the old open web that we knew, is just cutting yourself off from that.
Ha, yes I wanted to keep my comment short without trying to cover every base, but figured I might get this comment. Of course such sites still exist, but still a different phenomena when that was the entire internet. There are a lot of interesting people who run YouTube channels that be so cool to see a GeoCities-type site from, for example.
This isn't even the worst payload ever delivered through Windows Update. The prize for that should probably go to chip manufacturer FTDI, which once abused the system to publish a driver that would semi-permanently brick USB serial bridge parts the driver detected as counterfeit [1] by exploiting a command that the genuine parts did not implement correctly (how ironic) [2]. The backlash was large enough that Microsoft ended up pulling the update almost immediately, but that did not stop FTDI from trying again a few years later with another driver update that deliberately corrupted data sent through detected-counterfeit parts.
This is indeed what is happening behind the scenes. By default Windows Update will automatically download and install support packages for pretty much any device Windows can identify through manufacturer/device IDs, which includes PCIe and USB devices but also monitors. This is most commonly used to deliver drivers but Microsoft allows these packages to silently install any user-facing application as well, presumably due to peripherals such as GPUs or audio chipsets often requiring "control panels" or similar companion apps.
Around a month ago LG took advantage of this feature by publishing a Windows "driver" for all their TVs and monitors that consisted entirely of payola bloatware, resulting in predictable backlash [1] and the obligatory subsequent HN discussion [2]. None of this has anything to do with the TVs themselves being connected to the internet or not.
The computer should not do something that the user did not specifically command. It should not guess, "Oh, the user plugged in device X. This means I have the user's consent to download and install software."
Every user wants their computer to do things they didn't specific command. You may draw the line differently from random user Bob, but your claim is simply wrong.
The *vast* majority of users do want their machine to silently do whatever it takes for their device to work.
I don't want to go handwrite XF86Config. I want my machine to go negotiate resolutions and aspect ratios and pick a default. I don't want to have to go find a CD drive or go to the OEM's website to get my printer or scanner working. Many users want their audio device to be able to talk over HDMI when plugging in a monitor with speakers. And so on.
A particularly worrying trend that keeps spreading is the one of restricting significant amounts of (often non-financial) functionality to the apps only, gated behind your phone passing device integrity checks, in what seems to be a poorly thought out attempt at blocking all forms of scraping and automation (AI or not). The worst offender right now is probably Twitter, which alongside the recent Nitter cease-and-desist now appears to require client integrity on all logged out access.
The FeliCa NFC standard made its way into more than just transit cards in Japan. One notable user is the Amusement IC network, which lets you quickly log into arcade games across multiple manufacturers using a single card. Some implementations (Konami's e-amusement most notably) even go as far as to allow any FeliCa-compatible card or device to be linked to a profile, including transit cards, phones (with no app required!) and certain models of Sony Bluetooth earbuds which use FeliCa for quick pairing.
If C2PA and similar signature systems ever become a meaningful authenticity signal, they will create huge incentives for someone (potentially a state actor) to hack at least one camera in order to sign images of arbitrary provenance with its private keys. This will in turn inevitably lead to the same game of cat-and-mouse we have seen play out with video DRM schemes, where keys are regularly extracted from exploitable devices and used to decrypt as much content as possible before the device gets blacklisted entirely (harming all legitimate owners in the process).
I've done this btw. I went for the Pixel Camera app since they were the ones bragging the hardest about their "security". Writeup + PoC should be dropping some time tomorrow. Despite 90+ days from initial report, it remains unpatched.
[1] https://en.wikipedia.org/wiki/Literate_programming
[2] https://github.com/spicyjpeg/ps1-bare-metal
reply