Schrödinger's Catgirl (Joyce)

Go on, circumvent these measures & keep our tech open and free.

But know that many hackers find basic hardware hacking tools too costly and out of reach. WE'RE OUTRESOURCED.

PUSH BACK BEFORE THESE POLICIES BECOME NORMALIZED. DON'T RELY ON HACKING ALONE TO SAVE US.

/END

People who think "oh we'll just buy Chinese motherboards and chips" or "just use open source hardware"

WHO FABRICATES THE BOARDS AND CHIPS FOR OSHW? DO YOU BELIEVE STATES LIKE CHINA AREN'T INTERESTED IN SIMILAR MEASURES OF CONTROL?

This is the tech equivalent of tankie-ism.

/8

This is why GiovanH's blog article is a must-read.

People assume that accessible hacks of invasive systems will always exist, and users hacking their devices is to be expected.

THIS SHOULDN'T BE A NORM. THIS IS AN ARMS RACE AND WE'RE OUTMATCHED. /7

blog.giovanh.com/blog/2025/10...

Again, no one assumes that any system can be made 100% bulletproof. But that was never the point is it?

The end game is for manufacturers to harden their devices against cheaper tools and raise the barrier to entry such that it costs a fortune for hackers who might even try. /6

There have been vulnerabilities in ME and PSP, and there MAY BE a way for users to bypass these checks.

But this assumes:
- Someone out there will put in labor to circumvent these things and release it freely, even at great expense.
- A simple, user doable hack even exists.

/5

For now, these functions are not strictly enforced or turned on in a lot of consumer devices.

But is there anything stopping nation states from forcing hardware manufacturers and OEMs to do so?

What options do you have in such a case? /4

How do these security processors verify the firmware integrity?

Through a set of cryptographic keys and their hashes, which are used to verify the cryptographic signature of the UEFI firmware. These keys or hashes are *burned* into the processor and cannot be changed. /3

Since the late 2000s, computer chipsets have shipped with security processors like Intel Management Engine and AMD Platform Security Processor.

Part of their job is to verify that the UEFI firmware is from the computer OEM and has not been tampered with or comes from a 3rd party. /2

The QRTs to @chloetankahhui.bsky.social shows the extent of naivety that a lot of people have.

No one who does hardware security believes that any system is bulletproof, but do you really think that circumventing these things will always be a simple firmware mod or hardware hack?

Let's dive in. /1

I wonder if this is the sort of thing that might interest you @nuclearanthro.bsky.social but many weeks ago someone showed me a Yugoslav era radiation dose calculator

Hope you might enjoy this!

Can I DM you?

What I mean is that the drive is read-only by default, and you can't change the files, until you provide some credentials to prove you're authorized to modify the contents of the drive

I am still figuring out how authentication would work in practice, and I might write a program for that

Did you enjoy our zines on Archival and Data Distribution, and Vectoralism?

You can find both digital and printable PDFs on undergnd.online/zine

We don't just talk about archival and data distribution, we walk the talk! 😉

They are also available on Internet Archive: archive.org/details/@und...

This is a tool that has to be combined with operational security practices by a community (i.e who gets to know about the existence and location of such a dead drop?)

The point of deadflash is just to protect the integrity of, as well as maintain a record of who changed files on the drive

It doesn't; but you can do multiple things if you're really so dedicated, including plant such material in a community space.

Such a threat is outside the scope of the deadflash project, and no hardware project can protect against those threats anyway.

deadflash-hw A easily concealable flash drive designed for data archival and distribution in hostile environments of censorship.

Anyway, if you're interested in the hardware, it is open source!

Check out deadflash's repository at: codeberg.org/bitowlonline...

Firmware repo coming soon

As such, I am really excited for the @baochip.com to become available!

It it's in a really tiny CSP package, and has USB 2.0 HS as well as SDIO. I managed to get a devkit for this: github.com/baochip/dabao

At the time this project was conceived in November last year, the ESP32-P4 was the only thing that had USB 2.0 HS, high speed SDIO, which was in a small enough package (10x10 mm QFN) to fit on a flash drive and was reasonably priced. It was on hold until the P4 became generally available.

The purpose deadflash is to allow communities distribute files on the drive, while keeping opportunists from tampering with the contents of the drive.

The goal is not to stop a dedicated attacker (you cannot!) from tampering with the contents, but to keep out 15 minute opportunists.

The threat we are trying to protect against are far-right nuts finding out the location of dead-drops and putting material like child sexual abuse material on the drive and then calling the cops. A whole community could then be in legal hot water for no reason.

One method of distributing information in a way that would be harder to pin down would be to create "dead drops.". A flash drive could be placed a hole in the wall on the side of a building, unlocked utility boxes, etc.

But why not use a regular flash drive for this?

Utah book banners now want to make Little Free Libraries susceptible to criminal charges Conservative book banners in Utah are targeting Little Free Libraries and want to make the owners susceptible to criminal charges.

We are seeing a rise of policies designed to restrict access to information online and offline.

People in states like Utah wish to go after "Little Free Libraries" by campaigning to make owners of these libraries criminally liable for not adhering to book bans.
www.themarysue.com/utah-book-ba...

tl;dr: It's mounted read-only by default, and mountable as R/W only after authentication; the point being to distribute files in a manner you can prove no one tampered with its contents.

See @undergndonline.bsky.social zines about archival and data distribution: undergnd.online/zine#archiva...

I had been working on a project for #39C3, sadly manufacturing and shipping got severely delayed and it didn't arrive on time (I cri), but here goes anyway:

This is Deadflash. A flash drive with a ESP32-P4 as a controller. Why bother making a flash drive, and a very expensive one at that? A 🧵

How can we organize against restrictive laws such as age verification? What can hackers and organizers do to make sense of the world around us in the face of cheaply generated AI disinformation?

If you're at #39C3, come say hi!

Embedded dev while on the ICE -- can Joyce get her demo out in time for #39C3?

Parts of the internet just stopped working Outage comes around a month after Amazon Web Services outage also took much of the internet offline

First it was AWS, then it was Microsoft Azure, and now, it's Cloudflare!

www.independent.co.uk/tech/cloudfl...

The Framework forums thread got insanely unwieldy, so I wrote up a (somewhat shorter) summary post of the situation

crimier.github.io/posts/Framew...

This is amazing research by Nadia Heninger and her co-authors Wenyi Morty Zhang, Annie Dai, Keegan Ryan, Dave Levin and Aaron Schulman. TL;DR a huge number of satellite links over our heads are totally unencrypted. satcom.sysnet.ucsd.edu

This is a snippet from a document included with Amdahl UTS UNIX titled: "UTS for beginners" by Brian W. Kernighan