TechyMagThings

For how useful USB thumb drives are for quickly toting around and copying files from one computer to another, they can be a bit of a security headache. Programs can be loaded on them with all kinds of malware; they can be obscured in some ways that are difficult to detect, and they can be set up to execute certain programs when they’re plugged in. The general wisdom is to simply avoid untrusted USB devices completely, but that sort of abstinence-only policy rarely works in the real world. If, for some reason, an untrusted USB device absolutely needs to be used, many of these security issues can be mitigated with this tool.

Built by [Novamostra], the device is simple on the surface: it’s a Raspberry Pi Pico mated to a 2-in-1 USB splitter cable. But with the USB Neutralizer software they have written loaded onto the Pico, it automatically destroys the ability of any connected USB thumb drive to load files. The program works by deleting the first and last 34 Logical Block Addressing (LBA) sectors on the drive immediately when it’s plugged in, without doing anything else. This effectively corrupts the drive bad enough to prevent malicious software in the partitions from doing anything, allowing the user to (relatively) safely put the USB drive into their computer and format it for re-use. The code for this tool is also open-source and reviewable on the project’s GitHub page.

Of course, this isn’t a perfect security solution for all USB attacks. It doesn’t erase or replace the firmware on the drive itself, and although firmware-level attacks are rare they’re not out of the question for all users, all the time. It also won’t prevent a malicious physical attack like this high-voltage one, and it may also not stop hidden or obscured partitions or devices programmed for storage and some other nefarious purpose simultaneously, like a USB HID. But still, this solves a great many of the problems associated with getting new drives from semi-untrustworthy sources, like retailers or friends whose computer skills we don’t fully trust.

When you hear the word TV, you probably think of a big LED screen, maybe even the old CRT TVs, but in either case it’s something large and fairly complicated. However, thanks to the persistence of vision, it doesn’t have to be. In this handheld-sized project from [Ancient], the Scanwheel is born, a miniature mechanical TV that uses a spinning disk and some LEDs to produce an image.

The electronics of the Scanwheel are pretty straightforward. The smarts come from a Raspberry Pi Pico, an A4988 motor driver, a couple of LEDs, and a small 21-02485 stepper motor. The Raspberry Pi Pico is used to command the motor speed as well as coordinate the LEDs to turn on at the right time. The case is 3D printed; the base includes space for the various support electronics as well as some small light baffles to ensure the LEDs don’t bleed over outside their intended area. The top of the case is a disk that includes 20 small holes spaced evenly around the perimeter at varying heights, allowing light to only leave the disk when one of these holes is in front of the LEDs.

When you put all these pieces together, spin the motor up to roughly 900 RPM, and turn the LEDs on in a precise order, you end up with a really cool result: a miniature TV. And due to the five different LEDs in this build, you actually have a color 20×20 pixel display in the center and, on either side of that, two more 20×20 black-and-white displays capable of showing different images. Thanks [Ancient] for sharing this awesome build that takes advantage of the persistence of vision effect to create a unique display. Be sure to check out the video below as well as the instructions on how to build your own. And if you enjoy this sort of thing, check out some of our other persistence-of-vision projects as well.

Optical cavities – two mirrors arranged to reflect light multiple times between them – form the basis of lasers and certain optical filters. Since any angle between the two mirrors results in light being scattered away, parallel alignment is essential, yet difficult to maintain. Nevertheless, [Timothy Giles] managed to 3D-print and align such an optical cavity, and used it to detect minute shifts in space and wavelength.

The cavity has two semi-transparent mirrors facing towards each other. One mirror is held in a 3D-printed mount, and the other is attached to the diaphragm of a speaker with a hole drilled through the center. The hole avoids the speaker coil, and allows light exiting the optical cavity through the semi-transparent mirror to appear on a paper target, which is monitored by a webcam. On the other side of the optical cavity, a laser diode coupled to a single-mode fiber shines in through the other mirror. Alignment is challenging, but the webcam makes it easier; as the mirrors tilt relative to each other, the pattern seen on the paper target changes, providing feedback for more precise adjustment.

Light reflected within the cavity can interfere constructively or destructively with incoming light, changing the brightness of the emitted beam. [Tim] used the speaker as a linear actuator to vary the cavity’s length, which, by counting the peaks in brightness, allowed him to measure the diaphragm’s displacement. This also demonstrated a laser diode’s wavelength instability: when the cavity was set to a constant length and the laser started up, the output brightness would cycle a few times. As the diode was warming up, its output wavelength was shifting, creating the same changing interference pattern.

To get a Gaussian beam distribution, [Tim] used a fiber-coupled laser; if you’d like to build one, we’ve seen a coupling mechanism built before. Most lasers are built around an internal optical cavity, but some instead use an external cavity.

At a time when so-called “artificial intelligence” seems inescapable, we were encouraged to see news that Amazon will be cracking down on third-party sellers that use AI-generated images for their product listings. They won’t be prevented from using the images, but they will need to clearly indicate that they don’t represent reality and were produced via artificial means. This comes in response to a recently enacted New York law that requires the disclosure of AI in advertisements.

But it’s not quite a clear cut as it might seem on the surface, as the New York law is actually about AI-generated people rather than products. Specifically, it’s designed to make it clear when a “synthetic performer” has been used in place of a human actor. As such, it would appear that the easiest way for Amazon sellers to dodge the new rule is to simply not include any humans in their AI slop images and videos. In other words, they can continue to post fake pictures of products without having to inform the consumer so long as they don’t show a fake person holding it.

Under normal circumstances we’d leave something like this next one for our weekly security column, but the utter lack of security in the Pope’s official “Click To Pray” mobile application revealed by researcher BobDaHacker on Friday is just too good a story to pass up. For one thing, who knew that there was an “official” prayer app? We don’t dabble in theology around these parts, but we’re fairly sure the good book didn’t mention anything about requiring a smartphone to give praise.

In any event, the service was so poorly constructed that you could simply step through the sequentially assigned numerical user IDs via the endpoint at api.clicktopray.org — because of course there’s a prayer API — and download any user’s personal information such as their full name, email address, and date of birth. There wasn’t even any rate limiting, so BobDaHacker was able to write simple script to quickly suck up the account details for each one of the service’s 700,000+ faithful users.

After waiting six months for a response from anyone at the Pope’s Worldwide Prayer Network, BobDaHacker took the story to the press. That seemed to get the pontiff’s attention, as the issue has now been addressed. Amen.

We know many readers appreciate a more minimalist approach to software, and still others are operating older devices that struggle with the admittedly ponderous bulk of the modern web. Both groups will likely appreciate brolly.sh, which provides a plain-text weather forecast for anywhere on Earth using data from Open-Meteo. It doesn’t just look the part either — we’re happy to report that if you pull down the forecast page for your location using something like wget, the resulting file is plain HTML which could be further parsed with grep and friends if you’re on a machine that doesn’t have a browser.

Speaking of older devices, Android Authority is reporting that Google has finally phased out support for Android 6.0 Marshmallow in Play services. This means that while devices running the older version of the mobile operating system will still be usable, they won’t be able to download software from the Play Store. Given that Marshmallow was released in October of 2015, this probably shouldn’t come as much of a shock. Any device out there that’s still running such an old release of the OS obviously hasn’t received any security updates in years, so the inability to download the latest mobile game should be the least of your worries if you are actually still using such a device as a daily driver.

Finally, given the impact Neuromancer has had on the hacker and maker communities over the decades, we felt obligated to point out that Apple has finally released a trailer for their upcoming adaptation. The ten episode series kicks off in January, and until now we haven’t had a good look at the aesthetic they were going for. Part of what made the novel so influential was how it described the world and the technology within it, but bringing those concepts to life on screen in a way that impresses modern audiences is going to be a unique challenge.

With how many hackers have put together their own real-world versions these last several years, we’re especially interested in the show’s depiction of cyberdecks. The novel itself doesn’t actually go into much detail about what they supposedly looked like, but contemporary illustrations were heavily influenced by 8-bit computers of the era from the likes of Amstrad and Atari. As much as we’d like to see something along those lines, we imagine a big-budget prestige television series probably demands something a bit sexier.

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line; we’d love to hear about it.

After previously using the fermenting of sugar to obtain ethanol fuel, [Hyperspace Pirate] figured that it’d be a waste to just blast the other half of the yeast production in the form of carbon dioxide into the air. This poses the slight problem that gaseous CO₂ is fairly bulky, while compressing it into a liquid isn’t exactly for the faint of heart. This of course means that it’s a fun challenge, involving a beach ball, vapor-compression and various compressors.

Although at room temperature compressing CO₂ into a liquid requires quite extreme pressures, if you lower it to freezing temperatures it becomes quite feasible to use more typical off-the-shell compressors.

In the video both oil-less and regular compressors are used, mostly because ultimately you want to get pure CO2 into the bottle, without oil or water. Here a few methods are explored, including a pre-cooler with the oil-less compressor as it cannot quite hit the same pressures. With a typical compressor linked to an oil-separator you can directly fill the tank, which is pretty nice, though even with this removal of water turned out to be a chore.

Desiccating the gas that comes out of the fermentation vat, is attempted using a converted water filter that’s filled with desiccant beads, but as the later tests show, this isn’t quite good enough to prevent moisture to make it into the bottle and clogging its nozzle. Of course, moisture here is more acceptable than oil for most applications, so with some more work this could be quite a feasible method to fill bottles with liquid CO₂ for various nefarious applications like paintball guns and more.

A lot has been made about the increase of automated traffic on the Internet, with the past years LLM-related crawlers having quite literally swarmed the picture here. Not only does this drive up traffic, it also increases load on web servers, whose owners find themselves faced with increased hosting costs. This recently led to The-Numbers.com going offline for a while as automated traffic was quite literally destroying their bottom line.

This saga is covered by [Stephen Follows], who had a chance to talk with the founder and CEO of the site, [Bruce Nash], after the site went basically offline for a few months. Since the website both licenses data for commercial purposes as well as offering the free access on its website, there were accusations of this being a ‘rug pull’.

The site was started in 1997, as a static HTML site on Geocities where [Bruce] provided box office analyses for investment purposes. Since that beginning traffic was generally polite, with human visitors and usually well-behaved search engine crawlers. Then around 2024 the first wave of scraper bots arrived, followed by a larger wave around December of 2025.

Despite implementing a few mitigations, such as LLM-targeted text, the increased traffic and the resulting load on a site architecture that was never designed for this ultimately led to a collapse. One of the major sources of traffic turned out to be from so-called ‘prediction markets’, like Polymarket, whose bots absolutely hammered the site.

Fortunately for [Bruce] and his team they do not rely on the free website for income, but they have had to massively rework the site’s architecture to bring back a semblance of the original features. As noted in the article, the amount of crawling traffic by these LLMs and ‘agentic AI’ tools is logarithmically more than that for search engines, which makes this a major challenge.

Issues like these is why services such as Cloudflare are offering blocking features for such automated traffic. After all, unless such traffic is of use to you, you may as well treat it like a DDoS attack and cut it off at the root.

Thanks to [Ben] for the tip.

The sport of fencing requires keeping score, just like so many other similar pastimes. When their club’s existing scoring rig broke, [jc0025] stepped up to build a scoring box of their own, using the typical tools of the maker trade.

The brains of the operation is an Arduino Nano, running the venerable ATmega328P. It’s set up to drive a pair of 8×8 WS2812B addressable LED panels. It’s also hooked up to a pair of fencing socket blocks, which hook up to the lamé (jacket), weapon, and guard of each player for electronically scoring hits. The Arduino is thus programmed to respond to various conditions, lighting the LEDs in turn. For example, the tip of one player’s weapon hitting the other player’s lamé will fire a colored light, allowing the hit to be scored. Meanwhile, a tip hitting the floor will fire a white light, indicating off-target. There’s also a buzzer for sonic indication, as well. Everything is wrapped up in a tidy 3D-printed housing, while power is courtesy of a USB-C charger hooked up to the unit.

If you’re looking to replace some old broken fencing scoring gear on the cheap, this project is probably a good place to start. We’ve featured some other great scoreboard projects over the years, too. Meanwhile, if you’re whipping up your custom own gear for your local sporting club, we might like to hear about it on the tipsline.