ColdHeat

Sure I took out the relevant section and put it here: https://docs.google.com/document/d/e/2PACX-1vTYSTUp3eTjfD-hG...

Thanks for letting me know. I will have to take a look. I setup Ghost a long time ago and just really use it for the blogging...

Yes the exploit removes the AWS IoT connection so that updates can come from the recreated API.

There was only one type of sign but it did come in various different cases.

I actually had written more about the exploit & vulnerability in my original drafts but I cut it out because it was a bit boring to read.

You are correct that with domain control I am able to serve content to any sign but the content will only be loaded once at boot time. Any future updates would have needed to come from their defunct AWS IoT connection (ignoring full restarts).

Using the exploit I remove the connection to AWS IoT and update some of the code to better connect it to the recreated API so users can update their signs in mostly real time.

Here's my reply to him from https://news.ycombinator.com/item?id=34328461

> Good question! No signs connected to the server until I reached out to some other sign owners to try out my instructions.

I do not know how many signs are out there. I imagine most people would have just unplugged their sign after the company's API vanished since any data would be stale and useless.

Yes I reached out to another owner who was able to connect the sign to the API. I've reached out to more people but haven't gotten too many responses. It's been 5 years after all. If you know anyone with one of these signs send them this post!

Good question! No signs connected to the server until I reached out to some other sign owners to try out my instructions.

The key point here would be "did things correctly" :)

The sign did use AWS IoT for real time configuration updates however initial configuration was pulled from their HTTP server. Using the vulnerability I describe in the article I just remove the connection to AWS IoT.

I had found some tweets by the company where they talked about using an Adafruit panel that was $40. The price on Amazon was about $30 so I figured I would go with the lower price. They may have switched to a lower cost panel but my guess is that didn't happen.

EDIT: Here is the specific tweet: https://twitter.com/NYCTRAINSIGN/status/926106932573810688

Another explanation that I saw [0] was that it was for people to pop the back panel out. I think this is the most likely explanation but it didn't occur to me while working with the sign. I feel like a little notch would have been more appropriate for an actual product.

[0] https://hackaday.com/2023/01/09/iot-archaeology-leads-to-api...

Thank you for the kind words! Made my morning!

Hello, author here. Happy to answer any questions!

My apologies for the downtime, I wasn't expecting much traffic today since I submitted the post to HN yesterday but I've started scaling my server now!

With regards to 3, isn’t the management plane alone $72 for GKE without considering the cost for the nodes? How are your costs so low?

I've eaten their strawberries and they're pretty good! The berries are held in a plastic tray with the berries individually floating on plastic wrap so they don't get squished from their own weight.

While I don't think the berries are worth the price tag, I'd definitely be interested in trying some of the new products they mention in the article (tomatoes, melons).

The Gitlab integration for Pages is also pretty immature. It doesn't appear to currently work with Groups/Subgroups. I've been back and forth with people on their Discord for maybe a week now trying to just get it setup for a test.

I would be very interested if you or tsholmes could discuss the thought process behind identifying and reverse engineering the format!

It seems doable. You can edit it under runtime settings: https://aws.amazon.com/blogs/aws/aws-lambda-functions-powere....

I believe the owner is https://twitter.com/levicook https://github.com/levicook?

I used to use this site until I found https://checkip.amazonaws.com/. Switched because I wasn't sure who was behind icanhazip.com and it's tough to beat AWS. Glad to hear that it will likely be maintained for awhile longer!

Sure, I reported an issue to the Gogs maintainer over two weeks ago and he hasn't acknowledged it at all. Here's the public reference that their SECURITY.md asks for: https://github.com/gogs/gogs/issues/6534

Here's another one posted about a week ago: https://github.com/gogs/gogs/issues/6536

The gogs maintainer currently seems to not be doing much with it and seems to be ignoring security reports. I would probably recommend the gitea fork instead.

https://github.com/go-gitea/gitea

I mostly agree here but I'm not really sure that Podman has replaced Docker. I'm also curious how you're determining that Podman is superior to Docker?

Author here.

Recently I was looking for a way to sanitize user generated HTML of malicious things like JavaScript.

Solutions like bleach, html_sanitizer, and lxml's Cleaner all work but I found that their performance on complicated HTML snippets were lacking because they needed to rely on html5lib for parsing HTML5. And completely normal content would get mangled without using html5lib.

I ended up writing these Python bindings to the bluemonday library. It seems to perform much better than existing Python solutions for the same problem[2]. I suspect because more of the work can be done in native code instead of having to pass an XML tree around.

Hoping that this is useful to someone else but also looking for any feedback. Especially about how the bindings were written.

[1] https://github.com/microcosm-cc/bluemonday

[2] https://github.com/ColdHeat/pybluemonday#performance

Author here. Sadly this is true. I don't sell modchips anymore because it wasn't very economical or profitable.

I did come up with ways to assemble the chips faster but I couldn't optimize it enough so that I could remove myself from the equation. I ended up selling enough to get rid of all of the inventory I purchased and making enough profit to cover any tool/equipment purchases.

If anyone knows how I could streamline the whole modchip creation process I would be very interested!

I don't have a concrete source for this handy but I don't think this is totally accurate. For one, the plastic rails on earlier PS1 disk drives wear out and can be a source of error. Secondly, you still see failed disk drives on consoles without modchips.

I think burned discs are probably one factor but I think general hardware failure or dirty lenses are a more common cause.

Author here. I wrote this awhile ago so I wasn't expecting to see this here today but glad that it is. Happy to answer any questions.

DigitalOcean's S3 offering probably would've kept this bill down a bit. Probably about $300 versus $2000.

https://www.digitalocean.com/docs/spaces/#bandwidth

Digital Ocean may not be the best cloud platform but it's fairly cost effective.

IANAL but Maxmind has to comply with CCPA I assume because they are sourcing data from California residents. If data is sourced in an aggregate or anonymous way, it wouldn't be subject to CCPA.

> Aggregate and anonymous data is exempt from the CCPA, unless it is in any way re-identifiable. https://www.cookiebot.com/en/what-is-ccpa/

I've been trying to build open source MaxMind alternatives for a bit. (Mostly so I could distribute them with my open source projects)

IP to country is fairly easy and I open sourced all the scripts and the database itself [0].

But IP to city is much harder, I'm not actually sure it's viable for anyone to do that without relying on some other 3rd party service.

I'd be very interested to hear if anyone knows how to pull that off in an open sourceable manner.

[0] https://github.com/geoacumen/geoacumen-country

It likely uses the data published by RiRs. I wrote something similar that discusses where it sources the data and how to generate it. https://github.com/geoacumen/geoacumen-country

I've been meaning to make automatic Github releases for it.