RE: mastodon.uno/@filippodb/115510…

chi parte bene... partenza fantozziana, treno alle 6:45 e mi sono alzato dal letto alle 6:30, la sveglia non ha suonato 😅

Vestizione al limite delle possibilità umane corsa in bici e treno successivo delle 7 preso al volo, in tempo per prendere la coincidenza per mestre.

Paolo Villaggio maestro di vita. 🙏🤣

Ci si vede al Festival #Glocal a parlare dal vivo di @fediverso social network e come prendere i treni al volo! Vedi messaggio quotato (così testiamo la funzione anche con questo account)

filippodb ⁂

2025-11-07 20:05:52

🚀 L'8 Novembre sarò a Varese per il Festival Glocal!

Parteciperò al panel “Social network senza algoritmo, community e informazione locale”, insieme agli admin di varese.social @emanuelecariati , bologna.one @victorvandort e vivere.uno @michele 👉

🔗 festivalglocal.it/incontro/soc…

📍 Quando: dalle 16:00 alle 18:00
📍 Dove: Sala Corsi Materia, via Confalonieri 5, Castronno (VA)

Se siete da queste parti, passate a trovarci!

👉 Seguiteci anche nel gruppo @fediverso

#fediverso #mastodon #glocal

Social Network senza algoritmo, community e informazione locale - Festival Glocal

Da dove nasce l’esigenza di social network senza algoritmo e senza un padrone che possa usarlo per i propri scopi? Mastodon e il Fediverso possono rispondere a questa esigenza? Come i social liberi si interfacciano con l’informazione? Le esperienze d…

^{Festival Glocal}

CORSO NIS2 SENZA SEGRETI: LA FORMAZIONE PER AZIENDE E PROFESSIONISTI FIRMATA RED HOT CYBER!

👉Iscriviti all'Academy per vedere l'anteprima gratuita del corso: academy.redhotcyber.com/course…
👉Scrivici ad academy@redhotcyber.com o Whatsapp al 3791638765

📌 𝗔𝗰𝗰𝗲𝘀𝘀𝗼 𝗳𝗹𝗲𝘀𝘀𝗶𝗯𝗶𝗹e: Segui il corso in e-learning con contenuti sempre disponibili
📌 𝗟𝗶𝘃𝗲𝗹𝗹: è richiesta una conoscenza di base della valutazione del rischio
📌 𝗦𝘂𝗽𝗽𝗼𝗿𝘁𝗼 𝗮𝗹 𝗰𝗼𝗿𝘀𝗼: docente disponibile via e-mail

#redhotcyber #hacking #cti #ai #online #it #cybercrime #cybersecurity #threat #OnlineCourses #Elearning #DigitalLearning #RemoteCourses #VirtualClasses #CourseOfTheDay #LearnOnline #OnlineTraining #Webinars #academy #corso #formazioneonline #direttivanis #nis2

ABCCAD is Voxels Meets Legos in AR

We get it, CAD software can be daunting to learn. Somehow [Boaztheostrich] found it so daunting he procrastinated his way into a AR voxel-based CAD app he calls “ABCCAD”, written in Godot for the Meta Quest 3.

The app is simplicity itself: pressing A or X on the controller spawns a cube, which you can place wherever you like in virtual space by moving the controller in real space. The trigger then saves the cube position. Grabbing a cube uses the controller’s grab buttons. You can even change colors (with B or Y), but like in OpenSCAD it appears that’s not actually going to have any effect on the exported STL. Check it out in action in the demo video embedded below.

As far as CAD applications go, this is as simplistic as it gets, but there’s a certain charm to its simplicity. It’s almost like virtual legos. Besides, TinkerCAD wasn’t much more complicated when it started out, and look at it now.

Sure, one could say if [Boaz] wanted to do CAD he’d have been better off putting the time into learning good old OpenSCAD or FreeCAD (which can now get you SolidWorks certs, apparently), but this is a fun little app that let him stretch his chops in Godot, another great open-source tool. ABCCAD is, itself, open-source under an MIT license.

Thanks to [Boaztheostrich] for the tip.

We seem to have a paucity of posts under the Godot tag, so if you’ve got a hack that uses the open-source game engine, please send us a tip.

youtube.com/embed/4YC3ZkCB1po?…

hackaday.com/2025/11/06/abccad…

2025 Component Abuse Challenge: Reverse Biasing an NPN BJT

For the Component Abuse Challenge our hacker [Tim Williams] observes that N-P-N reads the same way forwards and backwards, so… what happens if we reverse bias one? (Note: this remark about N-P-N reading the same forward and backward is a lighthearted joke; in fact the level of doping in the emitter and collector is different so those Ns are not fungible and will exhibit different properties and have different characteristics.)

In the margin you can see how the question was originally posed by Bob Pease back in March 18, 1996.

In his article [Tim] mentions that some transistors are specifically designed to operate when reverse biased, which [Tim] calls “inverted mode”, whereas most transistors are not designed to work in this fashion and that’s the sort of abuse that could damage the component and lead it to malfunction.

But what is V_out? [Tim] reports that he measured approximately -0.4 volts using his high-impedance meter. We tried this experiment in the lab ourselves but we were not able to duplicate [Tim]’s result; however there is a long list of potential reasons for such an outcome. If you do this experiment yourself we would love to hear about your results in the comments section!

If you’re still learning about transistors you might like to check out our five part series on transistors as amplifiers, starting here: Won’t Somebody, Please, Think Of The Transistors!

Thanks to [Tim] for his submission, we wish him the best of luck in the competition!

hackaday.com/2025/11/06/2025-c…

Making Steam-Powered LEGO Machines

Over the decades we have seen a lot of methods for powering LEGO-based contraptions, ranging from LEGO Technic pneumatics to electric motors, but what about steam power? We have all seen those cute little model steam engines that can definitely put out some power. Sure, you can just drop those in like a kind of confused internal combustion engine, or you can try to make a steam engine that actually tries to be directly compatible with LEGO.

While exploring this topic, [Jamie’s Brick Jams] on YouTube found that the primary concern here is simply the very hot steam produced by the boiler. While not a surprise to anyone who has ever run a model steam engine, this poses a major challenge to the thermoplastics used by LEGO.

Obviously a boiler cannot be made out of plastic, but the steam turbine can. That said, material selection here is key, as the hot, wet steam produced by the boiler demolishes PLA parts and ruined the original and very unsafe copper boiler in the process. Ultimately a LEGO Technic-compatible steam turbine was printed in high temperature resistant PAHT-CF and PC filament, which enables a steam-powered LEGO walker to come to life, albeit with a distinct lack of power.

Model steam engine enthusiasts are of course quick to point out that you should try to create dry steam through superheating, definitely add a safety valve and so on, all of which should make for an even more powerful and safe LEGO steam engine. For a rundown of how steam engines work, [Lawrie] did an excellent video on the basics a while back, as well as a video playlist full of demonstrations of both classical Mamod model engines and questionable modern takes.

Suffice it to say that although model steam engines look like toys, they involve fire, hot steam and other fascinating ways to melt things, light them on fire and cause painful injuries, so definitely follow a safety briefing before attempting any of it at home.

youtube.com/embed/g07xCV3uOJw?…

hackaday.com/2025/11/06/making…

2025 Component Abuse Challenge: Overdriven LEDs Outshine the Sun

Tagging wildlife is never straightforward in the best of times, but it becomes a great deal more complicated when you’re trying to track flying insects. Instead of trying to use a sensor package, [DeepSOIC] attached tiny, light retroreflectors to bees and hornets, then used a pulsed infrared light mounted on a drone to illuminate them. Two infrared cameras on the drone track the bright dot that indicates the insect, letting the drone follow it. To get a spot bright enough to track in full sunlight, though, [DeepSOIC] had to drive some infrared LEDs well above their rated tolerances.

The LEDs manage to survive because they only fire in 15-µs pulses at 100 Hz, in synchrony with the frame rate of the cameras, rather like some welding cameras. The driver circuit is very simple, just a MOSFET switch driven by an external pulse source, a capacitor to steady the supply voltage, and a current-limiting resistor doing so little limiting that it could probably be removed. LEDs can indeed survive high-current pulses, so this might not really seem like component abuse, but the 5-6 amps used here are well beyond the rated pulse current of 3 amps for the original SFH4715AS LEDs. After proving the concept, [DeepSOIC] switched to 940 nm LEDs, which provide more contrast because the atmosphere absorbs more sunlight around this wavelength. These new LEDs were rated for 5A, so they weren’t being driven so far out of spec, but in tests they did survive current up to 10A.

We’ve seen a similar principle used to drive laser diodes in very high-power pulses a few times before. For an opposite approach to putting every last bit of current through an LED, check out this low-power safety light.

youtube.com/embed/cRh2XufYJws?…

hackaday.com/2025/11/06/2025-c…

Share Your Projects: Imperfectionism

Everyone has a standard for publishing projects, and they can get pretty controversial. We see a lot of people complain about hacks embedded in YouTube videos, social media threads, Discord servers, Facebook posts, IRC channels, different degrees of open-sourcing, licenses, searchability, and monetization. I personally have my own share of frustrations with a number of these factors.

It’s common to believe that hacking as a culture doesn’t thrive until a certain set of conditions is met, and everyone has their own set of conditions in mind. My own dealbreaker, as you might’ve seen, is open-sourcing of code and hardware alike – I think that’s a sufficiently large barrier for hacking being repeatable, and repeatability is a big part of how hacking culture spreads.

This kind of belief is often self-limiting. Many people believe that their code or PCB source file is not a good contribution to hacking culture unless it meets a certain cleanliness or completeness standard. This is understandable, and I do that, too.

Today, I’d like to argue against my own view, and show how imperfect publishing helps build hacking culture despite its imperfections. Let’s talk about open-source in context of 3D printing.

The Snazzy Ugly Duckling

One little-spoken aspect of 3D printing is how few models are open-source. Printable models published exclusively as STLs are commonplace, STEPs are much less popular, and from my experience, it’s soul-crushingly rare to see a source file attached to a model on Printables. I struggle to say that’s a good thing, and quite obviously, that negatively impacts 3D printing culture – getting into 3D modeling is that much harder if you can’t reference the sources for 95% of models you might get inspired by.

Of course, part of that is that 3D CADs are overwhelmingly closed-source paid software, and there are like five different ones with roughly equal shares of usage. It’s hard to meaningfully share sources from within a paywalled siloized market. Also, unlike software source code, STLs are very much cross-platform. Electronics has a way better analogy for STLs, they’re just like gerbers – gerbers are easy to export, and to inexperienced people, they’ll feel like all that anyone would ever need.

For a quick example – out of these eight Printables models taken at random, only the “drawers mini-cabinet” has a source file attached.

Then, there’s a self-consciousness and perfectionism. While rare, I’ve seen “I will clean this up and publish later” happen in 3D printing spaces too – it’s a thoroughly non-viable promise there too, but I get why people say that, I’ve personally made and failed on such promises a good few times myself. I’m glad that this isn’t a popular excuse so far, but, as more people adopt OpenSCAD, Blender, and FreeCAD, with their universally-accessible files, maybe we’ll see it resurface.

Asking for 3D model sources should probably become part of hacker culture, just like it helped with software. I don’t think it’s great that 3D printing so often implies closed-source 3D models, and undoubtedly that has limited the growth of 3D modeling as a hobby. I strongly wish I could git clone the 3D model projects I find online, and there’s a whole lot of models that are useless to me because I can’t git clone and modify them.

At the same time? 3D printing carries the hacker flag quite strongly, despite the imperfections, and you can notice it by just how often 3D printing appears on our pages. We can and should point at aspects of hacker culture that 3D printing doesn’t yet represent, and while at it, we benefit from the technology, as much as its imperfections hurt us.

Where Is Hackerdom Found?

Would I argue the same about Discord servers? Mastodon-hosted threads? YouTube videos? GitHub repos with barely-documented code? For sure. There’s no shortage of criticism about those, mostly about accessibility issues. Servers and videos are often not externally discoverable, which is surprisingly painful for hacker culture’s ability to thrive and grow. At the very least, we are badly missing out – for instance, I’d say Discord servers and YouTube videos alike are in dire need of external log/transcript hosting capabilities, and tech-oriented Discord servers specifically could benefit from public logs in the same way that modern Discourse forums have them from the get-go.

That’s for the disadvantages. As for upsides, YouTube videos make hardware hacking into entertainment for potential hackers not enthralled by scrolling through a blog interspersed with pictures, and, they position hacking culture in front of people who’d otherwise miss out on it. Let’s take [DIY Perks], a hugely popular YouTube channel. Would that dual-screen laptop build we covered have worked out great as a blog post, or maybe as a dual post-video, as some hackers do? For sure. At the same time, it gets hacking in front of people’s faces.

Discord blows as a platform, and I’ve written a fair bit about just how much it blows. One such snippet is in the article I wrote about the Beepy project, where the Discord server was crucial to growing Beepy as a community-contributed project. Would people benefit from the Beepy project having publicly available logs? Most certainly, and I’d argue it’s hurt the Beepy project being more externally discoverable. Is that all?

Discord has been an unprecedented communications platform for the Beepy project, and we’d outright lose out if there weren’t hardware hacking communities thriving on Discord, like Hackaday Discord does. I think we should remedy these kinds of problems by building helper tools and arguing for better cultural norms, just like we did with software licenses, because giving up on platforms like Discord currently has a significantly subpar cost-benefit analysis.

What about imperfect code? Sometimes, a hacker figures out a small part of a sensor’s protocol or a basic feature, and as much as the code might be insufficient or hastily written, they publish it. Have you ever stumbled upon such a repository? I have, sometimes I was happy, and sometimes I was disappointed, but either which way, such code tend to require extra work. In the end, I’ve noticed that it almost always helped way more than it hurt, which in turn has eventually led to me publishing more and more.

I think we’d benefit from a culture where “publish later after cleanup” is replaced by “here’s the code, and I might push some cleanup commits later”. It’s a better contribution to hacker culture and to people who enjoy your work, and the “might” part makes it more honest. It’ll also get your publishing muscles in better shape so that you’re quick to post about things you really ought to post about. For what it’s worth, I don’t think it hurts if this is assisted by social media likes, too.

Strength Through Presence

Survival of hacker culture has so far heavily relied on its presence in media all across, and an ability to press the “maybe I can hack too” button in other people’s brains through that presence. That said, every non-open 3D model, Discord server with non-public logs, YouTube channel with non-transcribed videos, or a completely ephemeral TikTok channel, still palpably paves a way for future hackers to join our communities, wherever hackerdom might be within ten years’ time.

I think the key to informational impedance mismatches is making it easier for people to meet the high standards we expect, and helping people meet them where appropriate, in large part, by example. It looks like hacking is strongest when present everywhere, even when some seams, and I hope that this kind of overwhelming presence helps us overcome modern-day unique cultural hurdles in a way we couldn’t hope for just a decade ago.

hackaday.com/2025/11/06/share-…

Cisco risolve vulnerabilità critiche in ASA, DTD e Unified Contact Center Express

Cisco ha reso noto recentemente di aver scoperto una nuova tipologia di attacco informatico mirato a compromettere i dispositivi che operano con i software Cisco Secure Firewall Adaptive Security Appliance (ASA) e Cisco Secure Firewall Threat Defense (FTD). I bug rilevati dal ricercatore di sicurezza Jahmel Harris sono monitorati con i codici CVE-2025-20333 e CVE-2025-20362.

Mentre lo sfruttamento riuscito di CVE-2025-20333 consente a un aggressore di eseguire codice arbitrario come rootutilizzando richieste HTTP contraffatte, attraverso il CVE-2025-20362 si può accedere a un URL limitato senza autenticazione. i prodotti interessati sono:

• Cisco Unified CCX versione 15.0 (corretto in 15.0 ES01)
• Cisco Unified CCX versione 12.5 SU3 e precedenti (corretto in 12.5 SU3 ES07)

L’aggiornamento arriva mentre Cisco ha risolto due falle di sicurezza critiche in Unified Contact Center Express (Unified CCX) che potrebbero consentire a un aggressore remoto non autenticato di caricare file arbitrari, aggirare l’autenticazione, eseguire comandi arbitrari ed elevare i privilegi a root.

“Questo attacco può causare il ricaricamento inaspettato dei dispositivi non aggiornati, dando luogo a condizioni di negazione del servizio (DoS)”, riporta Cisco allertando le aziende di effettuare le attività di patching quanto prima.

Entrambe le vulnerabilità sono state divulgate alla fine di settembre 2025, ma non prima di essere sfruttate come vulnerabilità zero-day in attacchi che veicolano malware come RayInitiator e LINE VIPER , secondo il National Cyber Security Centre (NCSC) del Regno Unito.

Oltre alle due vulnerabilità, Cisco ha distribuito patch per un bug DoS di gravità elevata (CVE-2025-20343, punteggio CVSS: 8,6) in Identity Services Engine (ISE) che potrebbe consentire a un aggressore remoto non autenticato di causare il riavvio imprevisto di un dispositivo vulnerabile.

“Questa vulnerabilità è dovuta a un errore logico durante l’elaborazione di una richiesta di accesso RADIUS per un indirizzo MAC che è già un endpoint rifiutato”, si legge nell’avviso di CISCO . “Un aggressore potrebbe sfruttare questa vulnerabilità inviando una sequenza specifica di più messaggi di richiesta di accesso RADIUS contraffatti a Cisco ISE.”

Sebbene non vi siano prove che una delle tre falle di sicurezza sia stata sfruttata indiscriminatamente, è essenziale che gli utenti applichino gli aggiornamenti il prima possibile per una protezione ottimale.

L'articolo Cisco risolve vulnerabilità critiche in ASA, DTD e Unified Contact Center Express proviene da Red Hot Cyber.

Rust si ribella! Nasce il fondo per pagare i manutentori dell’Open Source

La Rust Foundation ha annunciato il lancio del Maintainers Fund, un nuovo programma progettato per supportare gli sviluppatori responsabili della stabilità e dello sviluppo dell’ecosistema Rust. Questo passo mira ad affrontare uno dei problemi più antichi e urgenti del software open source: la mancanza di un supporto finanziario sostenibile per le persone che da anni lavorano sul codice e sull’infrastruttura.

Per ora, questa è solo una dichiarazione preliminare priva di dettagli. I rappresentanti della Fondazione non hanno divulgato l’entità del budget, il processo di distribuzione delle sovvenzioni o le condizioni di partecipazione.

La dichiarazione afferma semplicemente che il progetto si basa sull’esperienza precedente della Rust Foundation e mira a diventare una piattaforma permanente per supportare il nucleo tecnico della comunità. L’organizzazione ha promesso trasparenza e intende pubblicare dati su come vengono spesi i fondi e sulle attività che affrontano.

Nel mondo open source, questi specialisti si fanno carico del peso del lavoro. Controllano gli aggiornamenti, correggono i bug, esaminano le modifiche apportate da altri e monitorano la compatibilità dei componenti. Questo lavoro viene spesso svolto volontariamente, portando a burnout e perdita di interesse. I manutentori diventano eroi invisibili, senza i quali qualsiasi soluzione software si degrada rapidamente.

Rust ha dovuto affrontare sfide simili da tempo. Nel 2024, uno degli ingegneri a capo del progetto affermò che il numero di partecipanti che abbandonavano la community a causa dell’esaurimento emotivo era molto alto e che molti di quelli rimasti erano sull’orlo del baratro. Pertanto, ricompense simboliche come gadget gratuiti non vengono più prese sul serio: sono necessari veri e propri meccanismi di supporto.

La presidente del consiglio di amministrazione della Rust Foundation, Nell Shamrell-Harrington, ha sottolineato che il destino di qualsiasi progetto open source dipende dalle persone che ne garantiscono il funzionamento quotidiano. Secondo lei, il linguaggio non può evolversi e rimanere sicuro senza un sistema sostenibile di supporto per i suoi manutentori. Il nuovo programma mira a creare le condizioni affinché i manutentori del codice possano farlo in modo permanente.

Sebbene fosse stata promessa la massima trasparenza possibile nell’implementazione, la fonte dei finanziamenti e il processo di distribuzione rimangono poco chiari. I giornalisti hanno inviato richieste di informazioni sulla provenienza dei fondi e sui meccanismi di selezione dei partecipanti, ma non hanno ancora ricevuto risposta. La fondazione ha promesso di divulgare i dettagli solo man mano che le prime fasi del programma saranno sviluppate e di pubblicare una tempistica di lancio.

Il problema, tra l’altro, si estende ben oltre un singolo linguaggio. Alla conferenza State of Open 2025, gli esperti hanno discusso delle crescenti aspettative di utenti e aziende, che richiedono nuove funzionalità ma raramente forniscono risorse. Nel luglio dello stesso anno, GitHub ha pubblicato un rapporto in cui riconosceva che la maggior parte dei progetti open source continua a soffrire di una carenza di finanziamenti.

La creazione del Maintainers Fund può essere considerata un tentativo di cambiare la situazione in almeno un segmento dell’ecosistema. I rappresentanti della Rust Foundation riconoscono che non esistono soluzioni universali: ogni iniziativa richiede un approccio flessibile e la considerazione delle esigenze specifiche della comunità. Il loro obiettivo è semplice: fornire a coloro che mantengono Rust stabile e dinamico una base permanente per il loro lavoro e una meritata ricompensa per il loro impegno, finora passato in gran parte inosservato.

L'articolo Rust si ribella! Nasce il fondo per pagare i manutentori dell’Open Source proviene da Red Hot Cyber.