Embedded

Chris and Elecia chat about Leapfrog toys, things they like, large company politics, awards, and open source governance. The Toy Story 5 Trailer with LilyPad toy which is suspiciously similar to the LeapFrog LeapPad tablet. Which is different from the original LeapPad which had cartridges and capacitive touch (capacitive touch was used on the globe as well… the latest globe also has a screen). Why does Elecia want an award? Who knows? But right now, she's getting ready for a listener to nominate the show (Chris and Elecia) for IEEE's Meritorious Achievement Award in Outreach and Informal Education. Probably. But we've got nominators and endorsers so that's mostly sorted. She also signed Embedded up for the Women Podcasters Award which is a popularity contest. You can vote here: www.womenpodcasters.com/awards-voting. The show is under the Science Podcasters category. Some things we like: Ctrl-R: In a command shell, ctrl-r searches your history. Better than ! because you don't have to remember as much. Data bars in Excel: This can create a plot of your data in the column. Merlin Bird ID: Want to know what bird is making that sound? Want to know the name of the bird you just saw? Merlin Bird ID is a free app that is amazing. Plucky Cards: Want to have a 1:1 where you talk about more than your status? Choose a card, any card. Or maybe just look through and have a 1:1 by yourself Just reading about Bunnie Huang's new RISCV board Dabao Evaluation Board for Baochip-1x taught us things! We're not sure what we'd use it for yet but it does spark a few ideas. The Embedded.fm Patreon Slack book club is reading Pragmatic Programmer 20th Anniversary Edition. Talking about open source projects and governance models, we referenced three contributing guidelines: Valetudo, ESPHome, and Zephyr. Some later research led to Leadership and Governance | Open Source Guides and presentation by Cornelius Schumacher – The spectrum of FOSS governance models (Slides). The link between the politics associated with the size of companies and the open source governance models clearly needs a bit more thought. Transcript

Sonia Grego speaks with us about a topic no one likes to talk about, but could be used to monitor personal dietary health and widespread disease outbreaks. Toilets! Sonia leads Duke University's Smart Toilet Lab and the spin out Coprata which makes the Microbiome Activity Tracker. As discussed in the show, when developing a project far from where it will be deployed, there are many common issues. The Lessons Learned chapter of Sonia's recent book gives an excellent introduction to the unexpected environment far from the comfort of desks. The book is (free online!) Engineering Field Testing of Non-Sewered Sanitation Systems: Compendium of Lessons Learned, See Sonia Grego at Duke Electrical & Computer Engineering, the Smart Toilet Lab as well as Sonia's company Coprata. Some terms that came up in the show: Coprolite: fossilized excrement (Wikipedia entry has great(?) pics!) Scatological: material, humor, or language that relates directly to bodily waste Helminths: parasitic worms including roundworms, tapeworms, and fluke (oh look. more great images on Wiki entry) Poop jokes Transcript

Kenneth Finnegan entertained us with stories about accidentally contributing to the internet's ability to network. Wondering how the internet works? All those terms about IPv4, IPv6, BGP, OSPF, CDN and other alphabet soup? Check out the YouTube videos by NetworkChuck. Kenneth writes about his adventures on his blog, The Life of Kenneth. Some of the posts related to this show are: Creating an Internet Exchange for Even More Fun and Less Profit Building an Anycast Secondary DNS Service Building the Micro Mirror Free Software CDN We also mention FCIX aka fcix.net or the Fremont Cabal Internet Exchange You can also find Kenneth at @[email protected] where you will find more about half-dollars, nickels, and trains. If you also secretly long to run a locomotive, take a look at the Run-A-Locomotive program at WPRM. The title is related to the XKCD comic 2347: Dependency. Transcript

Chris and Elecia apologize, discuss uses and abuses of chatbots, reach out to an uncertain manager, try to help someone out of their professor's draconian rules, and extol the joys of reading. Chabot Space & Science Center is in Oakland, CA, US. It is wonderful! Some suggestions for UncertainManager: Thanks for the Feedback: The Science and Art of Receiving Feedback Resilient Management Manager's Path Soft Skills Engineering podcast Hang in there! You are probably doing better than you think. Audio books are great! In the US, many libraries have digital libraries with extensive audio collections. There are several apps with different catalogs for the same library Libby, Kanopy, Hoopla, and Palace (check out the California shelf at Palace!). And since you are probably going to ask about the games Elecia doesn't play: Turing Complete shows how logic and logic gates work, building up a processor. Zachtronics' TIS-100 is another logic and processor design game. It is a little ugly in spots (too real world) but it is a really deep dive into learning assembly. It is the precursor to Shenzhen IO but harder to finish. Zachtronics' Shenzhen IO is about circuits and how they work . Human Resource Machine by Tomorrow Corporation is about optimizing resources, it turns out to be a lot like assembly programming. Should you have gotten here because you wanted facts about teeth, Elecia had been enjoying Bite: An Incisive History of Teeth, from Hagfish to Humans. Transcript

Mark Omo and James Rowley spoke with us about safecracking, security, and the ethics of doing a bad job. Mark and James gave an excellent talk on the development of their safecracking tools at DEF CON 33: Cash, Drugs, and Guns: Why Your Safes Aren't Safe. It included a section of interaction involving the lock maker's lawyers bullying them and how the Electronic Frontier Foundation (EFF) has a Coders' Rights Project to support security research. As mentioned in the show, the US Cyber Trust Mark baseline has a very straightforward checklist; NISTIR 8259 is the overall standard, NISTIR 8259A is the technical checklist, NISTIR 8259B is the non-technical (process/maintenance) checklist. Roughly the process is NISTIR 8259 -> Plan/Guidance; NISTIR 8259A -> Build; NISTIR 8259B -> Support. We discussed ETSI EN 303 645 V3.1.3 (2024-09) Cyber Security for Consumer Internet of Things: Baseline Requirement and the EU's CRA: Cyber Resilience Act which requires manufacturers to implement security by design, have security by default, provide free security updates, and protect confidentiality. See more here: How to prepare for the Cyber Resilience Act (CRA): A guide for manufacturers. We didn't mention Ghidra in the show specifically, but it is a tool for reverse engineering software: given a binary image, what was the code? Some of the safecracking was helped by the lock maker using the same processor in the PS4 which has many people looking to crack it. See fail0verflow :: PS4 Aux Hax 1: Intro & Aeolia for an introduction. Mark and James have presented multiple times at Hardwear.io, a series of conferences and webinars about security (not wearables). Some related highlights: 2024: Breaking Into Chips By Reading The Datasheet is about the exploit developed for the older lock version on the safes discussed in the show. USA 2025: Extracting Protected Flash With STM32-TraceRip is about STM32 exploits.

James Cameron spoke with us about programming for and operating a large telescope. The show is a blend of astronomy, engineering on the fly, and weird lady bug habitats. The Anglo-Australian Telescope (AAT) is part of the Australian National University's Siding Spring Observatory in Coonabarabran, New South Wales, Australia. The AAT has an all sky camera where you can check in on a very dark sky. James was on Embedded Episode 172: Tell Forth You Me Please where we talked about the Forth programming language and his experiences with One Laptop Per Child. Transcript Unrelated to the AAT, Chris took this image of the Andromeda Galaxy (M31) from his Zwo Seestar 50 over 9 hours (multiple days), stacking the images and processing the data.

Nathan Jones and Chris Svec give Chris and Elecia their 2025 performance review. Donations went to Elevate Tutoring, an organization that provides funding and support to low-income and first-generation college students as well as free STEM tutoring for underserved schools. Embedded has already sent in the match to the donations for a total of over $5000. Here is a list of all Embedded.fm episodes. We mentioned the Foldscope, a small but mighty microscope. Also, mentioned was the book If I Only Changed the Software, Why is the Phone on Fire? The show this week is sponsored by us. And you. Please consider supporting Embedded.fm on Ko-fi or Patreon. Or tell a friend about the show. Transcript

Sophi Kravitz joined us to talk about art, science, and engineering. You can see Messages from Space on Sophi's website /sophikravitz.com). A subset of the artwork had a short stay for a demo at Chabot Space & Science Center. The completed work will be shown in 2026. Sophi mentioned collaborating with two sonic environment artists Sofy Yuditskaya and Ria Rajan. Geiger–Müller tube is an ionizing radiation detector. Cosmic rays move through space at nearly the speed of light, generally originating far away and long ago. You can also see them in a cloud chamber, like the one at San Francisco's Exploratorium. We also talked about using sculpting in Blender (there are many online video introductions). Sophi does EE consulting and system quality checking at her company Greenlight. The show this week is sponsored by us. And you. Please consider supporting Embedded.fm on Ko-fi or Patreon. Or tell a friend about the show. Transcript

Nick Kartsioukas joined us to talk about security in embedded systems. Common Vulnerabilities and Exposures (CVE) is the primary database to check your software libraries, tools, and OSs: cve.org. Open Worldwide Application Security Project (OWASP, owasp.org) has information on how to improve security in all kinds of applications, including embedded application security. There are also cheatsheets, Nick particularly recommends Software Supply Chain Security - OWASP Cheat Sheet. Wait, what is supply chain security? Nick suggested a nice article on github.com: it is about your code and tools including firmware update, a common weak point in embedded device security. Want to try out some security work? There are capture the flag (CTF) challenges including the Microcorruption CTF (microcorruption.com) which is embedded security related. We also talked about the SANS Holiday Hack Challenge (also see Prior SANS Holiday Hack Challenges). This episode is brought to you by RunSafe Security. Working with C or C++ in your embedded projects? RunSafe Security helps you build safer, more resilient devices with build-time SBOM generation, vulnerability identification, and patented code hardening. Their Load-time Function Randomization stops the exploit of memory-based attacks, something we all know is much needed. Learn more at RunSafeSecurity.com/embeddedfm. Some other sites that have good information embedded security: This World Of Ours by James Mickens is an easy read about threat modelling Cybersecurity and Infrastructure Security Agency (CISA) is at cisa.gov and, among other things, they describe SBOMs in great detail National Institute of Standards and Technology (NIST) also provides guidance: Internet of Things (IoT) | NIST NIST Cybersecurity for IoT Program NIST SP800-213 IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements There is a group of universities and organizations doing research into embedded security: National Science Foundation Center for Hardware and Embedded Systems Security and Trust (CHEST). Descriptive overview and the site is nsfchest.org European Telecommunications Standards Institute (ETSI) - Consumer IoT Security Camera Ubiquiti configuration issue (what not to do) Finally, Nick mentioned Stop The Bleed which provides training on how you can control bleeding, a leading cause of death. They even have a podcast (and we know you like those). Elecia followed up with Community Emergency Response Teams (CERT). Call your local fire department and ask about training near you! Transcript