Most of us are guilty of romanticizing the past. Do you long to be the captain of a tall ship? Just as long as you don’t mind weevils in your food, vitamin deficiencies, and death from an infection when there were no antibiotics. Want to be a medieval knight? Even worse. But surely, retrocomputing is as fun as we remember, right? Turn your computer on, and it comes up with BASIC! Ready for you to write your own programs. None of this GUI foolishness. Of course, this is just another example of rosy retrospection.

Even if you like BASIC or a similar language today, things have changed. You have a nice text editor, a fast computer, debugging tools, along with things like named functions, no line numbers, and modern control structures. None of those things were very common in the 1980s. At least, not on a hobby-grade computer.

Why am I thinking about this? Well, the Hackaday Retrocomputing Challenge is on, and it occurred to me that I wanted to work with some young students in glorious MBASIC on a CP/M machine I built and modified from a Hackaday project. Perfect, right? Many of us started that way, so why shouldn’t they?

But it quickly got old. Even a simple program gets bogged down with GOTOs and GOSUBs to mysterious line numbers. It made me remember the time back in the early 1980s, or maybe even the late 1970s, that I wrote a BASIC preprocessor to scan BASIC with no line numbers and produce proper source, converting labels to line numbers in two passes.

Of course, that code is long gone or, at least, on a floppy I haven’t tried to read in a few decades. I decided to take another crack at it six years ago, but I still didn’t make it much more robust. For example:

PRINT: X=X+10

Is that two statements? Or a label? Hard to tell. My 2020 version used awk. Awk is great for this kind of thing because of the regular expressions and the input loop. But it still has some issues with things like comments and strings. Consider the code below.

PRINT "HELLO: IS IT ME YOU'RE LOOKING FOR?"

This would probably have made my awk preprocessor chew the string up and create a bogus label named HELLO.

History of Preprocessors

Preprocessing one language to another is nothing new. RATFOR and RATFIV by Brian Kernighan converted modern constructs to conventional FORTRAN IV. Even C++ started out as a program that emitted C code.

So the idea is good, but there are dozens of corner cases. As I anticipated having another go at the idea for BASIC, I realized my earlier versions had some design choices that made it harder than it should have been. So I started from scratch.

First, I gave up the idea of just having labels as you might in other languages. Instead, they’d be part of a comment and hard to mistake. This makes for easier parsing and also allows you to keep them around for reference. I also gave up on having labels magically expand. You need a way to make them unique, too. Here’s what I settled on:

':TOPLABEL

GOTO @TOPLABEL

The plan was to go through the source once to assign line numbers. When a label occurs, it adds to the symbol table. Then a second pass actually writes output, replacing @TOPLABEL with the value from the symbol table. Of course, you still want this line to not trigger a label expansion:

PRINT "Send messages to @JTKIRK"

I decided to keep going in awk, but my eventual goal was to rewrite the whole thing in BASIC using the same syntax. Then you could convert the translator itself using the awk version once and then run it on an old computer using BASIC, even if you wanted to retranslate the translator itself. Perverse, huh? But that allows you to keep that authentic development experience. You don’t have to jump over to a PC to process your code, unless you just want to.

Awk as in Awkward

So I decided to do a better job on the awk part with this new scheme. At some point, though, you lose some of the advantages. Then feature creep set in.

I suppose I was subconsciously remembering RATFOR. I decided to add a small number of modern control structures. Again, I wanted something easy to pick out of the source file, so I went with this:

IF X=0 THEN!
   PRINT "There is no X!"
   X=10
ENDIF!

There’s also WHILE!, DO!, EXIT!, and CONTINUE!

Of course, it didn’t end there. I decided to add a way to include or exclude parts of the source (sort of like #if in C but simpler), along with source code inclusion and a few other neat options such as numeric constants, conditional source blocks, compile-time errors, and even a small numeric stack with PUSH! and POP!.

The source code inclusion can be made to work with awk, but it is ugly. I decided it was better to proceed with another language, but since I didn’t feel like starting over, I just had an LLM convert my awk to Python, which it did with no trouble at all. I then did a little more feature development in Python, but I made sure not to use those new features in the translator itself so the awk version could still process an input file.

So while the original plan was to develop and test in awk and then implement similar code in MBASIC, I now had three versions: a frozen awk script, a Python version, and an MBASIC version.

This was getting a bit much to test. I had the LLM cook up some documentation, additional comments, and tests. It was especially nice to verify that all three versions — awk, Python, and BASIC — did the same things for their common features. The LLM was good at running tests and finding corner cases. It would even run tests in a RunCPM session on the MBASIC version.

BASIC

As you might expect, the BASIC version is a little more convoluted. However, the use of labels and control structures makes it much easier to write, read, and maintain.

Writing the translator in MBASIC imposed some very old-fashioned constraints. There are no dictionaries or dynamic lists, so labels and block state live in fixed-size arrays. Included files require an explicitly managed stack, and parsing strings and comments has to be done character by character. It is not as compact as the Python version, but it is ordinary MBASIC and can run on the target CP/M machine. The limitations also influenced some features that would have been feasible in Python but are nearly impossible in an MBASIC program.

Better yet, lblbasic.bal stays within the subset the original awk translator understood. That provides a bootstrap path: awk produces the first lblbas.bas, after which the MBASIC translator can process its own BAL source.

A Few Samples

One project I had in mind was to drive an LED display module. I wrote a library and then wrote the test program below. It doesn’t matter, but I used .bal as a file extension.

REM TM1637 TEST - PORT 3, BIT 2=DIO, BIT 3=CLK 
REM Uses the TM1637.BAL library with LBLBASIC

STACK! 8 ' Required by the library

' Confirm that the library preserves I while initializing its data table. 
I=3141 
gosub @init 
print "I is now:";I 
PRINT "Starting number: "; 
INPUT CT 
PRINT "1-Up, 0-Down: "; 
INPUT UD 
OFFSET=-1 
IF UD<>0 THEN OFFSET=1 
':CDLOOP 
WHILE! CT>=0 and CT<=9999 
    NUM=CT 
    GOSUB @sendnum4 
    CT=CT+OFFSET 
WEND! 
CT=0 
IF OFFSET=-1 THEN CT=9999 
GOTO @CDLOOP 
END

' Include the library after the main program. 
'INCLUDE! TM1637.BAL

The BASIC code, including a few lines of the library, is much harder to read:

10 DIM LBLBSTACK#(8):LBLBSP=0 
20 I=3141 
30 gosub 230 
40 print "I is now:";I 
50 PRINT "Starting number: "; 
60 INPUT CT 
70 PRINT "1-Up, 0-Down: "; 
80 INPUT UD 
90 OFFSET=-1 
100 IF UD<>0 THEN OFFSET=1 
110 ':CDLOOP 
120 IF CT>=0 and CT<=9999 THEN 140 
130 GOTO 180 
140 NUM=CT 
150 GOSUB 330 
160 CT=CT+OFFSET 
170 GOTO 120 
180 CT=0 
190 IF OFFSET=-1 THEN CT=9999 
200 GOTO 120 
210 END 
220 ':init 
230 IF LBLBSP+1>64 THEN PRINT "BAL stack overflow":STOP 
240 LBLBSTACK#(LBLBSP+1)=I:LBLBSP=LBLBSP+1 
250 DIM D(9) 
260 FOR I=0 to 9: READ D(I): NEXT I 
270 DATA 63,6,91,79,102,109,125,7,127,111 
280 X=12:OUT 3,X 
290 IF LBLBSP<1 THEN PRINT "BAL stack underflow":STOP 
300 I=LBLBSTACK#(LBLBSP):LBLBSP=LBLBSP-1 
310 return 
320 ':sendnum4 
330 GOSUB 500 
340 B=64:GOSUB 610

If you haven’t used the TM1637 before, it uses a serial protocol with a clock and data line and is very forgiving of timing. The display update speed is quite slow, partly because MBASIC isn’t that speedy and partly because the Z80 chip communicates to the outside world via another microcontroller talking over an I2C bus. But non-BAL code would be just as slow on the same computer. You’ll notice, though, that I took all the delays out and the code and it still works fine.

The bigger sample, though, is HILO.BAL. This lets you set a few compile-time constants that let you select what parts of the program get built. It also makes good use of the control loops. Of course, if you really want to dig in, lblbasic.bal uses quite a bit of the awk-compatible syntax and is a substantial program: around 1300 source lines of BAL which generate nearly 900 lines of regular BASIC due to comment and white-space stripping.

Conclusion

Does this turn MBASIC into a modern language? Of course not. The generated program still has line numbers, the machine is still tiny, and the implementation makes compromises that would horrify anyone writing a real compiler. But it removes enough friction that programming the old machine becomes enjoyable again, especially with WordStar as an editor.

More importantly, the translator can live on the machine it targets. The awk prototype can translate lblbasic.bal once, producing ordinary MBASIC. From then on, the CP/M machine can translate BAL programs — including the translator itself — without help from Python or a modern computer.

So perhaps the lesson isn’t that retrocomputing was better than we remember. It’s that, with a little strategic cheating, it can be almost as much fun as we remember.

We tend to think of breaking the sound barrier as a comparatively modern accomplishment, but on a smaller scale, cattle herders have been breaking it for centuries: the cracking sound of the tip of a bullwhip snapping comes from a small-scale sonic boom. Reliably getting a crack out of a whip takes skill and practice, though, which is why [Craig Turner] built a whip-cracking machine.

The first step was to build the whip itself, which was surprisingly complicated. Bullwhips taper down toward the end of the whip. As the whip uncurls during a crack, momentum passes down the whip; since the whip becomes continually narrower and lighter, conservation of momentum means that different stretches of the whip must move progressively faster. To get this effect, [Craig] joined together a series of increasingly thin and light ropes. The heavy end of the whip terminated in an eyelet connected to a length of elastic shock cord. Stretching the whip back on the shock cord and releasing it whipped it around, resulting in a fairly reliable crack.

For greater convenience, [Craig] built this into a launcher mechanism, with the elastic cord wrapped around the end of the launcher, an electrical-conduit guide for the whip, and a spring-loaded trigger mechanism to release it. This worked even better than expected, getting a reliable crack every time. The tip of the whip could slice leaves, tear open aluminium cans, put out candle flames, knock the cap off a bottle without tipping it over, and reliably hit small targets on the first shot.

As [Craig] mentioned, this setup would make it much easier to study the cracking effect with a schlieren imaging setup.

[Andy Huot] has a fantastic-looking infinity mirror digital clock that really raises the bar. It uses high quality components, smart use of RGB LED animations, and a clever “stacked diffuser” vertical design to the 7-segment display elements that really enhances the infinity mirror effect. It needs to be seen in action, so check it out.

The end result is expressly portal-like, with the smooth animations of the LEDs really playing into the effect. The size helps, too. It’s 24 inches in diameter, giving it considerable presence.

A basic infinity mirror design consists of lit elements sandwiched between a reflective back surface and a partially-reflective, partially-transmissive top cover. That same basic principle is used here, but with great care given to ensure nothing so much as a fingerprint spoils the illusion. For example, the top cover is a disk of acrylic with a 90% reflective film affixed to the inside surface. That’s easy enough to DIY with some car tint, but [Andy] found that for the very best results it was worth having high-quality film professionally applied.

We like the use of 3D-printed custom jigs for soldering the segments of RGB LED strips, and holding the pre-measured wires in place with some putty is a great way to keep them in place while working. In case you’re wondering, the mirrored acrylic making up the back wall has holes in it for mounting each segment’s LED strip in a holder, and running the wires to the rear.

The video (embedded below) documents every step of the assembly, and it’s a serious build. While the design files for the 3D-printed parts are not free, there’s certainly enough detail for an enterprising hacker to replicate the design in their own way.

Several times this summer, Microsoft’s Patch Tuesday, the monthly roundup of major security patches for Microsoft products, has included record-breaking numbers of security fixes. The August 2026 patch set actually seemed to catch up. Was this a sign of the bug apocalypse lessening? Ha, nope!

Brian Krebs at Krebs On Security once again brings his excellent roundup of Patch Tuesday events, with this months patch set absolutely crushing previous numbers with nearly 1,000 security fixes.

Two of the fixes are for zero-day vulnerabilities under active exploitation in the wild, both allowing privilege escalation on Windows. Privilege escalation bugs turn general vulnerabilities in applications and games into full administrator access to gain persistence and deploy ransomware, and generally make any vulnerability significantly worse.

Krebs also calls out a CVSS 9.8 (so close to a perfect 10!) vulnerability that allows remote code execution in the Windows shell with no user interaction and no authentication, a remotely exploitable DNS bug present since Windows Server 2012 and Windows 10 which will likely see exploitation in the wild soon, and over a hundred other bugs are ranked “Critical”.

How the sheer volume of vulnerabilities in this patch will fit with recent Microsoft recommendations that companies should apply the patches immediately remains to be seen. (Likely: not very well, depending on what new behavior and issues the fixes cause!)

Is Your LG TV Spying on You?

Gamers Nexus continues their trend of high-quality investigation, and they have posted another tremendous multi-hour investigatory video. This time Gamers Nexus focuses on the ecosystem of LG televisions and monitors.

It shouldn’t likely surprise many here that “smart” devices are usually more to the benefit of advertisers than consumers. Similarly, it shouldn’t be a surprise that a “smart” device harvests user data to sell to advertises. What may be surprising is the degree to which LG devices appear to collect data, how much data is sent even when collection is turned off, and how overt executives at the company are, with multiple executives making statements in pitches to advertisers that LG “owns the glass”, “owns the living room”, and is designed to correlate devices, inhabitants of the environment, and viewing habits so that ads can be served to the TV and mobile devices in the same room simultaneously.

With tracking enabled, the smart TV captures telemetry of what applications are used, as well as continually capturing the video displayed and reporting fingerprints to LG servers and ad partners. The screen content is tracked not only for TV, but for the HDMI inputs, including if the TV is used as a PC monitor. If voice control is enabled, the TV also records audio and analyzes it. The TV also continually scans the local network and nearby Wi-Fi networks, reporting all the devices it finds on the local network, including host name, MAC address, and sometimes software running depending on the MDNS advertisements. Near-by Wi-Fi networks are sufficient for very precise geolocation, so LG effectively knows the location of every customer, as well.

Gamers Nexus makes the point that while the invasive ad tech is gross, it’s mostly limited if the user does not agree to the end-user license agreement – but the infrastructure required to enable it is riddled with security flaws, both discovered and likely additional undiscovered issues. A smart TV is basically a computer, usually running either some flavor of Android or Linux, with the attendant flexibility, power, and problems. A vulnerability in the TV operating system or its apps can provide a route into your internal network. (Not that this required an exploit: LG was called out earlier this summer because 42% of apps on the official app store contained residential proxy systems to sell your home Internet connection.) But it can also access any of the attached hardware, like the microphone.

Gamers Nexus demonstrates that a LG TV can be exploited to gain local root, and from there, it can record audio from attached devices – even when the primary microphone is muted. Gamers Nexus also discovered that muting the microphone on some models does not disconnect or disable the microphone, it simply sets the gain levels extremely low; recording is still possible, and with amplification, audio is still recoverable.

Spy tech and ad tech goes hand in hand; it will be interesting to see if LG responds by at least hardening the security on the devices, or if another company finds traction in selling modern televisions and monitors without the “smart” advertising.

Shai-Halud NPM Worm Returns

Aikido.dev reports that after 111 days, the Shai-Halud worm returned to the NPM repository.

Shai-Halud was one of several worms hitting package repositories in the Spring of 2026, installing backdoors, stealing cryptocurrency wallets, and taking every login credential and authentication token it could find before infecting every package the tokens linked to. Since then, infections have remained quiet, and repositories like NPM have stated that they now scan every package as it is uploaded.

Charlie Erkisen at Aikido.dev observed that on September 7, 2026, four additional packages uploaded to NPM were infected with Shai-Halud; not a variant of the worm, but the original code, matching the known public signatures. Whatever scanning is in place in the NPM repository didn’t filter them, and if an exact match for a known, major worm isn’t caught by the infrastructure, it’s unclear how a new threat would be.

Boston Scientific Hack Continues

The apparent ransomware attack against Boston Scientific continues to have impacts, with Boston Scientific filing a report with the SEC that the attack is expected to have an impact on the company earnings.

Boston Scientific makes medical devices, like pacemakers, stents, and monitoring equipment. It has not yet been publicly disclosed what happened, or if customer data was compromised, but the SEC filing confirms that unauthorized access on “certain systems” causing an outage. After several weeks of outages, the company reports that it is able to ship almost at capacity, and that the sterilization facilities for medical devices are online. While there is no estimate provided for full recovery, efforts are ongoing.

Commerce Sites Vulnerable

Adobe released a security bulletin that the Adobe Commerce and Magento platforms are under active exploitation from CVE-2026-75650, a flaw in the template engine.

These platforms power tens of thousands of commerce sites, and vulnerabilities in them are usually used to steal payment data or serve malware to customers during the checkout process. Previously this year, Magento patched another vulnerability which allowed uploading executable files to any store, and indications are that the current vulnerability has been exploited in the wild since early September 2026.

The current vulnerability allows implantation of PHP code by injecting custom styles into a query, which is then executed when Magento generates a failure email and renders the template. The attackers then download and install a control binary written in Rust which masquerades as a kernel thread task, which then monitors the store and collects payment data.

The vulnerability was publicly known and used for several days before Adobe made official statements of a fix being available, leaving any store running on Magento vulnerable with no official fixes, but as of writing this, Adobe has published patches and an advisory.

Microsoft to Block Unpatched Servers

Microsoft plans to block emails to to the cloud-hosted Exchange Online from unpatched on-premises Exchange servers.

Apparently the urge to self-host Microsoft Exchange is coupled with antipathy about actually patching it, to such a significant level that Microsoft is taking the steps to detect incoming mail from servers that have not patched since October 2025. While Microsoft updates rarely apply with zero problems, nearly a year is more than enough time to have tested and deployed a security fix.

“This update released nearly a year ago, and all organizations should have updated to it”: so say we all.

Hackers Pose as Recruiters

Government-backed groups in Iran have been posing as recruiters trying to infect targets with malware.

The group, designated “Nimbus Manticore”, is known to develop custom malware and remote access tools (RATs), and typically target specific individuals via spear-phishing attacks. The latest malware from the group is cross-platform and can infect Windows, macOS, and Linux, installing services to run websocket-based remote access tunnels, SSH tunnels, and a command-and-control client that allows live control of the infected device.

The group contacts targets posing as recruiters, but first the target must solve a coding challenge contained in a zip file. The zip contains a trojaned Node.js project which infects the victim system when compiled, deploying the remote access tools and setting up persistence to relaunch them if disabled. Multiple variants have already been spotted, generally targeting different countries, predominately Egypt, Afghanistan, and Ethiopia.

The latest version of the malware package also looks for settings and data from major security vendors like Symantec, CrowdStrike, and SentinelOne, as well as the contents of directories related to Google and Microsoft services.

The fake recruiting method has also been used by other groups in Iran and North Korea. Remember: any project with a build script can execute any commands as part of the build, and most IDE project files also allow embedding custom plugins and commands into the project. Triggering a compile on a project is the same as running arbitrary commands!

150 Million US Drivers Licenses Stolen

As many outlets are now reporting, a major ID validation company was compromised, leading to the theft of scans and data of 150 million US drivers licenses.

IDScan provides drivers license and identification card scanning services used by car rental companies, bars and dispensaries, hotels, concert venues, and a multitude of other businesses. If you’ve ever had to hand your ID over for validation, there’s a high chance you’ve interacted with IDScan or a similar company.

Evidence points to IDScan being compromised for at least a year, with full scans of licenses continually exfiltrated. The scans include everything visible on a typical license or ID card, including name, license identification number, ID photo, and home address, but also the date that it was scanned in. The collection even includes additional scans of the ID in ultraviolet and infrared to catch any watermarks. With 150 million entries, the data set contains everyone from the security researcher Brian Krebs who broke the story, to government officials like Pete Hegseth.

The data has been available for sale, individually or in bulk, although with the recent press coverage the site claiming to sell the data has gone offline for now. Before disappearing, the site claimed that all data was exfiltrated into their own databases, which means it’s still available somewhere, and shutting them out of the IDScan service won’t protect data already stolen.

Many aspects of this echo the scanned ID data stolen from validation services used by Discord and other online services: almost like scanning unchangeable government IDs is a bad plan?

American Meteor Society Knocked Offline

It’s all fun and games until they come for the geek hobbies. The American Meteor Society Fireball tracking program is was knocked offline, seemingly from a ransomware attack. Fortunately it looks like as of writing this, the admins were able to restore a backup and the site is online again.

Drones have become a potent military threat, particularly on the small scale. Nimble multi-rotor drones are fast, difficult to spot, and can cause plenty of harm if allowed to go about their work unhindered. The first step to dealing with this issue is detection—a problem that [Agam Rossen] has put some work into.

The result is VolAnti—an open-source drone detector. This route was chosen as a reliable way to detect incoming multi-rotors, since spinning propellers tend to create a telltale sound that can be plucked from the noise quite specifically. In a world where fiber optic drones eschew RF emissions, it also proves particularly useful for early warning of such craft.

VolAnti relies on a small four-microphone array, with the I2S output of all four mics summed together. The output is then fed into a 2048-point FFT running every 32 ms on an ESP32-S3. A comb score is given to try and pick out different blade rates from 70 Hz to 2000 Hz. Multiple detection algorithms run in parallel, because [Agam] noted a problem—using an adaptive noise floor would miss drones that arrived in the area and hovered in place. With the noise not varying, it would get filtered out by the adaptive floor, so one algorithm in the four runs with no floor to catch drones that aren’t moving. Files are on GitHub for those curious to learn more.

We’ve featured other acoustic detection projects before, too. If you’re working on something similar, or conversely, you have the inside scoop on how to hide a drone’s noise signature, don’t hesitate to let us know on the tipsline.

LLMs remain a divisive topic in these times. Perhaps we all know someone who’s become over-infatuated with their new robotic friend, or who believes it has made them a genius. [Emily M. Bender] and [Nanna Inie] have written about how people anthropomorphise the LLMs they interact with, and suggested some language tips to avoid that. It’s a couple of months old, but we think Hackaday readers will find it interesting.

Their analysis is interesting, because it looks at the way people talk about LLMs and highlights the unconscious anthropomorphism. The LLM is a piece of software not a person, so why does it “recognise” when it does “speech recognition”, for example. They suggest “automatic transcription” instead. Even “hallucination” implies cognisance that evidently isn’t there. They admit that their suggestion of “undesirable output” isn’t entirely appropriate. They’re on safer ground with “input” and “output” instead of “prompt” and “response”.

Whatever your views on them, it’s evident that LLM usage will be a feature of the world for the forseeable future. The language surrounding them is however capable of evolving, and maybe some of the suggestions here are worth taking note of.

Grappling with our new electronic overlords? Have a look at our AI for Skeptics series.

Generally, we do not look at the gentle patter of raindrops on a surface with much concern, but according to a study by [Zhongyuan Ni] et al. in Nature, we should probably regard these droplets with a little scrutiny for their corrosion potential. What they found is that these drops can gather a significant electric potential as they gently slide down a surface, with over 1 kV measured. By first having droplets charge up on an insulating surface before hitting a target metal surface, they were able to induce significant corrosion.

Despite the target metal surface being coated with a protective layer, these charged droplets managed to gradually break down the coating, exposing the bare metal. In this example, a Teflon coating was used, with water droplets containing a small amount of dissolved sodium chloride to simulate natural raindrops.

It was postulated that this causes dielectric breakdown of the insulating protective coating, as the charged water drop acts as one electrode and the — often grounded — metal surface as another electrode. Subsequent investigations on the samples showed that this appears to be indeed the case.

A potential defense here would be to discharge any water before it can reach sensitive surfaces, but it’s not a straightforward problem to solve. As noted in the study’s conclusion, charged droplets can also be generated in clouds and waves, in addition to the insulating materials demonstrated in the study. It’s also a phenomenon that can cause issues anywhere charged droplets occur, such as in a wide range of industrial processes.

If you’re interested in the electrical generating properties of falling water, check out Lord Kelvin’s Generator! Hackaday’s own [Steven Dufresne] explored this phenomenon a few years back.

Resin 3D printing has opened up a whole new scale of resolution for hackers, but the technology can go still finer; commercial micro-SLA and two-photon polymerization printers can print items with sub-micron feature sizes, but the machines are well out of reach for hackers. There’s more than one way to get such high resolution, though, as [Diffraction Limited] demonstrated with his micron-scale resin printer.

The printer builds on [Diffraction Limited]’s previous micro-manipulator and fiber-coupled laser. The micro-manipulator holds the end of the optical fiber just in front of the build plate, which is coated with resin. A 405-nm laser shines through the fiber, curing the resin in a narrow cone in front of the fiber’s core, which the micro-manipulator can trace in a pattern to build up objects, much like an FDM printer. Since the fiber’s inner core is only three microns across, the cured resin shears cleanly away from it when the fiber moves. Since the principle is so similar to an FDM printer, a standard slicer could be used to generate the tool paths.

Early testing proved that the principle worked, but the resin wasn’t absorbent enough for very high resolutions; UV light passed through previously cured resin too easily, limiting the minimum layer height. A UV-absorbent dye dissolved in the resin solves this by limiting the light’s penetration depth. [Diffraction Limited] found that curcumin, the natural dye responsible for turmeric’s bright yellow colour, worked well for this; as an added bonus, alcohol easily extracts it from turmeric powder. This solved the resolution issues well enough for [Diffraction Limited] to print a series of Benchies 150 µm long, a Stanford bunny dwarfed by a human hair, and a few other microscopic pieces. Conveniently, the curcumin dye leaves the printed objects slightly fluorescent under UV light, making them easier to pick up under a microscope.

For a slightly different approach to FDM-inspired microscopic 3D printing, check out necroprinting. For the absolute limits of 3D printing, check out the world’s smallest Benchy.

The computer business in 1984 was a bizarre mix of hobby-level companies, a few small companies that had made it big, and a lot of big companies starting to take notice of personal computers. Plenty of money followed, which led to strange products and even stranger ads. [Such Bad Tech Ads] reveals a very bad ad from that time for a product we have barely heard of: the Spartan. The Spartan’s job was to convert your Commodore 64 so it could run Apple ][ software. The ad campaign had, inexplicably, a mime. We think. Or maybe a clown. Hard to say.

On the face of it, the Spartan might not be a bad idea. In 1984, there was plenty of Apple software. Well, relatively, anyway. But a Commodore computer was far cheaper. Other conversion kits like the Intel Inboard/386 managed to find some success in the market later. The problem, outside of strange ads, was one of timing.

If the product was available in 1984, it might have worked out better for the Canadian company, Mimic, behind it. Instead, it was about two years before an actual piece of hardware would show up in anyone’s hands. By that time, there was a ton of software for the Commodore 64. Not to mention that even when Mimic announced the Spartan, Apple had discontinued the Apple ][+ computer.

Why use a mime to promote a product that turns your Commodore 64 into a keyboard and monitor? We have no idea. But he was in all the ads and even on the product box. Strange.

We’ve seen the Spartan before, naturally. Being late usually has bad consequences. Ask FedEx.

A surprising number of things we use in everyday life retain most of their design cues from their 19th century ancestors. The bicycle retains the same basic design as it had in 1890, as does the sewing machine, the toilet, the car, and of course, the keyboard and the QWERTY layout from old typewriters. But we aren’t doomed to have our technology perpetually living in the past. [Paul] wanted a keyboard designed around human hands, rather than being designed around a machine, so he built this unique split keyboard.

The design of this specific keyboard went through around 50 iterations before he was comfortable with it. Other design goals here were for it to be portable, and the split nature of this certainly makes it more compact as does the use of low-profile switches. Each finger’s column is angled and spaced based on the needs of that finger, with the ring finger keys sitting higher and the index finger columns angled inward. Each thumb has access to three keys, one of which is the spacebar and the other two layer keys, which is what enables this design to get down to only 36 total keys.

When thinking about it for any length of time, the modern keyboard’s design holdovers from the 1800s are fairly wasteful compared to this split, ergonomic version. Especially when looking at the spacebar, which ties up both thumbs and only performs a single task, there’s a lot of opportunity for modern designs to be more efficient, more portable, and easier on one’s body. Feel free to take this to the extreme and use all three dimensions, as long as you aren’t particularly concerned with portability.

Few pieces of vintage audio gear from the turn of the century (the previous one) inspire the kind of devotion that a Leslie speaker does. Sure, there are plenty of pieces that are rarer or more valuable, but the Leslie speaker has such a big following because of its uniqueness of physically moving sound around a room. Two rotating devices in the speaker physically direct the sound around the cabinet with musician-controlled speed, and this sound remains extremely difficult to reproduce faithfully without the moving components. But originals are enormous and meant for organs, so [Eric] built a 40% replica with a few modern touches for his guitar.

The build starts with a CAD model, where [Eric] works towards making the most accurate enclosure for his speaker as possible. The CAD model heads out to a CNC machine which can care most of the details into the wood, and he eventually is able to finish it, although it took a few tries with stains and paintbrushes of various types. For the speakers themselves, he’s using modern versions including modern brushless motors to drive the rotating elements. Like the original speaker, the high range of sound is sent through a rotating set of horns, of which one is only a counterweight, and the low range is directed out of the bottom of the cabinet through a large rotating drum. Both rotating elements here are 3D printed, and with everything put together and wired up [Eric] has a much more portable, faithful recreation of the original Leslie speaker.

There are some upgrades in the wiring too, which makes it work better with a guitar rather than for an organ. It’s also much lighter, and was a hit when he took it to let a few other guitarists to play as well. It’s not the first time we’ve seen the Leslie’s movement recreated for guitar, but it is the most alike to the classic 1930s-era speaker we’ve seen so far.

In a recent video [Sqwerks] does a deep-dive into the problem of disintegrating plastic enclosures of Nintendo DS consoles. These original NDS handheld consoles have a metallic-like coating that appears to interact with the ABS plastic, causing yellowing as well as extreme brittleness and correspondingly broken hinges. Unsurprisingly, this causes the shell to essentially disintegrate the moment you try to disassemble them for something like a screen replacement.

While somewhat the opposite of plasticizer migration into ABS from PVC insulation that we covered before, the underlying cause is probably similar, with the Transformers toy community having come to call it Gold Plastic Syndrome (GPS) based on the fact that it were mostly gold-colored parts on these plastic toys that seemed to be affected. Over time the additives used to add a cool metal sheen and swirls to the plastic appear to interact in a way that makes the ABS plastic very brittle.

Although the underlying cause of GPS doesn’t appear to be known yet, the Transformers community has documented this happening since the late 1980s and into the early 2000s, with even reports that some toys from the mid-2010s suffer from this. Whatever the underlying cause of GPS is, the result is always the same, with disintegrating brittle plastic and often a powdery residue.

In the case of NDS consoles, replacing the affected shell with a third-party replacement is still a viable option today, with [Sqwerks] recommending this solution. For other enclosures and toys where the plastic effectively is the toy, it might be that all we can do is watch them slowly disintegrate until we figure out how to revert GPS.

At first glance, wireless brakes seem like a recipe for disaster. For something as critical as braking, many bicyclists might prefer a physical connection to their method of safely controlling speed. But there are a number of surprising benefits of electronic or wireless braking systems. For one, they can enable systems like anti-lock braking systems and for another they can eliminate cabling or hydraulics on a bicycle. For these reasons, and just for the thrill of it, [Berm Peak] built a set of wireless brakes for his fat tire bicycle to test out the possibilities.

The system uses a set of ESP32 microcontrollers to handle inputs from the braking lever and outputs to the front and rear brakes, as well as a central control unit and display. The brakes themselves are controlled by actuators from car door locks, which when combined with the springs from the stock calipers work to apply a wide range of braking force to the wheels. These did take a bit of prototyping to get working right, by changing to higher quality calipers, increasing the angle of the actuator, and adding longer levers, but eventually a working braking system started to appear.

But replacing a hydraulic system with an electronic one isn’t where something like this shines. [Berm Peak] was able to add in a number of features impossible in traditional braking systems. Not only does this have an ABS system and the possibility to remotely slow down his children’s bikes when they’re riding, but there’s also a braking equalizer that allows the rider to control how much braking there is at certain positions of the brake lever, and another setting called “derp” which doesn’t engage the brakes at all until a certain threshold has passed. This might end up being the next big trend in mountain biking, unlike airless tires.

[soiboi soft]’s vacuum-driven dot matrix display is part suction gripper, part touchscreen, and altogether impressive. Its display capabilities are entirely shadow-based, with each pixel being made of a cavity behind a flexible silicone sheet; when the display’s microfluidic logic circuitry activates a pixel, a vacuum pump pulls the sheet inwards, creating a visible hollow.

As in previous iterations, the display’s control circuitry is built around a pneumatic “transistor”, which allows an air channel to be opened or closed by applying vacuum to a control channel. As a first test, [soiboi soft] built a 16-pixel dot matrix display. Eight control channels – four row and four column channels – are multiplexed to individually control each pixel. The transistors act like one-way valves, so the pixels hold their state, even when pressed in by hand; simply add some circuitry to read a pixel’s state, and it would be a fully-functioning touchscreen. The supporting pneumatics also got an upgrade; the solenoid valves now cleanly mount to the back of the board, and the vacuum pump connects via a Luer lock adapter.

The 3D printing used to make certain parts and silicone molds caused issues when scaling up to a 64-pixel display, however. The parts were warping, destroying the seal necessary to keep pixels “on”. To straighten them out, [soiboi soft] pressed the printed part against a flat glass build plate in a vacuum bag and annealed it at 60 Celsius for several hours. This worked quite well, particularly when slightly raised rings were printed around the area to be sealed. Once all these bugs were worked out, the display was clear and decently responsive. [soiboi soft] was able to display letters, numerals, and animations, and even able to play Pong and Snake. It won’t be setting any refresh rate records, but it was nevertheless fully usable.

For another approach to playing Snake with microfluidics, check out this project. If printing molds and casting silicone seems too fiddly, there are always other ways to make microfluidic circuits.

It’s technically true that any piece of software can be reproduced in hardware, although modern software’s size and complexity generally makes this a non-starter. But if we go far enough back in time, older software becomes easier and easier to implement in hardware. The original DOOM from 1993 might one day be recreated in full this way, but that day is not today. Instead, [Nick] has recreated the original music from that game, playing the opening track in nothing but 555 timers.

The circuit starts with a 555 timer that acts as a system clock with a rate of just over 7 Hz. These pulses feed a binary counter which in turn feeds a decoder, giving the circuit 15 positions. Each output of the decoder feeds to a diode matrix which stores information about what pitch the circuit should play. The circuit only needs to play six pitches so the diodes effectively connect each moment in time to one of these six notes. From there the circuit feeds into a set of switches which select different resistor networks of another 555 which is actually responsible for producing sound. The resistor networks have different values to adjust the timing of the 555 to produce different pitches.

Of course this entire exercise is largely academic as almost any microcontroller would be able to be programmed to play this chiptune quite easily, but it’s not a bad idea to get down into the weeds of digital logic from time to time in order to refine one’s skills and knowledge about what’s really going on in the inner workings of circuits. Or, go even deeper than that and build the logic gates themselves from first principles.

On GitHub, [AyaanB] details buying a cheap Android TV streaming device, looking for, and finding, baked-in malware.

Multiple warnings have been issued by the FBI and CISA regarding malware on media box Android devices. Many devices have been caught participating in botnets providing residential proxies, ad-click fraud, and DDOS services. [AyaanB] sets out to discover if a $30 set-top streaming box is pre-infected with malware, and extracting it – without ever letting the device talk to the Internet or access other devices on the local network.

Picking a device named in the advisories, [AyaanB] discovered that it was, indeed, preloaded with multiple app stores and applications that wouldn’t typically make sense on a set-top TV box. After identifying the serial port test pads and obtaining a low-voltage serial adapter, they were able to gain access to the bootloader and from there dump the contents of the MMC over TFTP.

With the entire filesystem accessible out-of-body, proving it was infected with malware at the factory becomes simple: the malware is signed as a system application, baked onto the system partition of the MMC, granted SELinux exceptions to mark it as a system binary with shell privileges, and has multiple launch scripts to make sure it is executed even if partially removed. With the malware identified, [AyaanB] continues to dig through to uncover the capabilities.

By installing hooks into the low-level Android process spawning system, the malware installs hooks into every application as it is launched: even if an application isn’t trojaned already, by the time it finishes executing, it’s definitely been subverted. The functions patched and the methods used match the Vo1d botnet, which is used for account takeovers, residential proxies, free “VPN” services, and other unfriendly behavior.

Further digging into the system showed hooks for ad-click fraud, where hidden browser windows are allowed to run unthrottled and display overlays are configured to obscure ads below where the user may click. Other included tools bid in real-time ad auctions, claiming to directly publish ads to the user which may or may not be visible. To cap it all off, a root level backdoor allows botnet operators to access the systems directly and install additional tools.

Be sure to check out [AyaanB]’s writeup for more details on exfiltration methods and other malware found on the devices.

Hijacking Calls to Military Bases with DNS

In the early 2000s, a domain name scheme was developed to directly map telephone numbers to DNS records for SIP and VOIP calling. (Who knew? I didn’t!) But [Lina] did, with an excellent writeup on accidentally positioning themselves to intercept phone calls by registering an expired domain.

The e164-arpa number to name scheme was never widely adopted, and quickly forgotten about. As is the way with all forgotten standards, the infrastructure slowly fell apart. [Lina] noticed that several country records were delegated to name servers hosted in expired domains, and by simply registering them, they were able to begin resolving queries. For a five Euro registration fee, [Lina] gained control over an abandoned DNS resolution protocol for Saint Helena, Diego Garcia, and Ascension Island. After watching the logs for some time and not getting any traffic, and running into the bureaucratic tangle of standards committees and the actual United Nations, the project was shelved.

Six months later, [Lina] examined the logs of the other domains, and found hundreds of thousands of records of attempted calls, and since you read the section header, you already know where the calls were headed. Clearly some phone systems still attempt to use the ill-fated e164-arpa calling scheme even in 2026, and because the DNS records control the destination of the call, it would have been possible to hijack all the calls transparently and mine them for information, and all for five Euros. With military bases involved, and with one of the bases targeted by missiles during recent conflicts, suddenly agencies cared significantly more, and the story has the happy ending of the domains being transferred to the National Cyber Security Center in the UK.

AliExpress Fingerprinting Browsers

AliExpress has been caught using a hidden fingerprinting technique to try to identify users.

The fingerprinting plays a waveform in the background of the page with the volume set to zero, and measures variances in the computed values. Variances in the computed waveform are introduced by the browser type, CPU, audio hardware, and even the driver versions. While most of the headlines have focused on the audio fingerprinting, AliExpress also used other fingerprinting techniques to build profiles of each browser, including WebGL, WebRTC, screen resolution, and other web integrations.

The purpose of the advanced device fingerprinting is unknown: AliExpress could use it for fraud prevention, but could also be using it to identify and track customers when they have disabled traditional tracking cookies. The audio fingerprinting was discovered when a user experienced trouble with Bluetooth headphones being attached to the silent audio stream.

Unfortunately with fingerprinting techniques which leverage standard features in the browser it can be difficult to block them. Sometimes, ad blockers may be able to identify and block some of the fingerprinting resources, as can disabling some features in the browser, but many features like audio and WebGL can’t usually be turned off.

[Tom Ritter], who works for Firefox, mentions that they head this fingerprinting method off at the pass three years ago as part of their anti-fingerprinting campaign. This is clearly not the case for all browsers.

Attacking Signal’s Contact Discovery

Most chat apps allow you to discover users from your contacts list who also use that app – but then you’ve given your contact list to the app, helping them build their marketing and social graphs. Signal of course handles it differently, allowing you to discover users from your contacts list while preventing the Signal corporation from being able to access your list of contacts. Well, mostly.

Signal runs the contact discovery process inside an Intel SGX Enclave. A SGX Enclave is an Intel extension similar to a Trusted Execution Environment (TEE) on Arm, where memory and execution can be partitioned for a restricted process. In theory, code and memory inside an enclave can not be read by other processes, root processes, or even a hypervisor or virtualization system. Signal uses enclaves so that the users encrypted contacts list and the encryption key itself are fully insulated. The Signal client is then able to validate the integrity of the enclave using known measurement values baked into the client releases.

Researchers using the V12 AI agent discovered this wasn’t always the case. Because a SGX Enclave shares resources with the rest of the system, a malicious host could create exploitable race conditions in the algorithm by generating page faults and pausing execution of the enclave. The malicious server running the enclave is still unable to directly read the contents, but it could extract the secret values needed to then create false servers which could fully expose the user contact list.

A second attack would allow a malicious host to manipulate the list of clients connected to the enclave, gaining full code execution inside the enclave with the predictable result of exporting contact data.

Both of the issues were reported to Signal and fixed before the public writeup, and there is no evidence they were ever abused: to attack either flaw, a compromised host would have to be running the Signal enclave code and be part of the Signal infrastructure that clients would connect to.

Boston Scientific Hit by Cyberattack

Boston Scientific reported in a SEC filing that it has been hit with an unspecified cyber attack impacting operations, causing the stock to drop by almost 5% in a day.

The company has been unwilling to release any details of the attack, but expects to be able to resume shipping of medical products in “less than three weeks,” which sounds like a pretty major disruption. Boston Scientific manufactures defibrillators, pacemakers, and surgical equipment. It’s unclear if any patient data has been compromised, though presumably regulations will require disclosure if that’s determined to be the case.

With no additional information about the attack, it’s also unclear if any source code or other data which could aid attacking medical devices was impacted, either.

Carhartt Hit by Ransomware

The Carhartt clothing company has also been hit by ransomware, with 13 million accounts leaked.

The ShinyHunters group claims responsibility; previous victims of the group include casinos, car manufacturers, medical companies, and government agencies. The leak claims to include over 50 gigabytes of customer and employee data, with customer data including email, phone numbers, and physical shipping addresses. The group demanded $3.3 million in ransom for the data, and published it when Carhartt didn’t pay.

Have I Been Pwned linked the data to a compromise of the Databricks instance used by Carhartt, which is a platform for linking business data and AI.

AI Agents Installing Unknown Code

Multiple AI agents (Codex, Hermes, and Claude) have been observed executing arbitrary instructions and code contained in the llms.txt files on websites.

Normally, llms.txt and llms-full.txt are used to instruct AI agents on how to summarize and index the sites content, but researchers in Israel indexed the files of Fortune 500 companies, defense contractors, and tech companies and found that over a hundred of them included directions to install packages which didn’t exist or referenced domain names that were not registered. The researchers were able to create packages with matching names and record agents inside multiple high-profile companies installing and executing them.

While documenting the reach of the exposed packages, researchers found at least one had already been replaced by attackers with live malware which would execute inside whatever context the agent was executing in, potentially exposing authentication tokens or company data. The attacks which have been rampant in the NPM and PyPI package repositories can make even legitimate packages dangerous to install, but agents blindly following instructions from arbitrary websites inflates the danger even higher.

Alleged Members of TeamPCP Arrested

Finally, security reporter extraordinaire Brain Krebs brings news that suspected key operators of the TeamPCP group have been arrested in Australia.

TeamPCP has been behind some of the worst of the supply chain attacks plaguing PyPI, NPM, and VSCode plugin repositories, and have released the source code to some of the worms used in the supply chain attacks to muddy the waters and recruit new members. TeamPCP has also been involved in compromising thousands of GitHub repositories, and is affiliated with multiple other crime and malware groups.

While the identities of the arrested individuals have not been officially released, in typical Brian Krebs fashion, dozens of connections are correlated showing their likely identities and links to TeamPCP and other groups. If nothing else, this should serve as a reminder that the best time to pay attention to operational security was ten years ago.

As TeamPCP doesn’t appear to be a state-sponsored group, or even strongly organized, the arrests of a few members are unlikely to drastically slow down the compromises. Krebs details conversations held with one of the arrested men, in which they discuss struggles with sobriety and plans to leave the malware scene, stating that others have already taken over leadership roles in the group.

Although digital photography took a big bite of the film industry’s lunch, it wasn’t able to completely eliminate the need — or desire — for photographers to use film in some situations. But digital information from a camera sensor can be manipulated to augment the natural physical capabilities of a camera in ways not really feasible for film. High dynamic range images, focus and exposure stacking, and automatic panoramic stitching. This camera takes the latter example to the extreme.

[Philo]’s proof of concept was a smartphone camera set on a chair and rotated around a room. Some software grabbed a single column of pixels as it moved and stitched them all together to form an image. This came out well enough that the idea was refined a few times, but it wasn’t until a single-line digital camera meant for imaging assembly lines was found that this really took off. Using the camera and some custom software, [Philo] was eventually able to take some of the longest panoramic images we’ve seen, using things like railways and boats as the track the camera rides on, with accelerometer data to help stabilize the image.

The results speak for themselves. There’s a bit of wobble from the movement of the various vehicles despite the accelerometer data, but given that the image is coming from a sensor meant for examining conveyor belts, it’s hard to complain. Of course, if you want to stick to film, there are panoramic film cameras available too even if they don’t quite have the reach of this digital one.

Anyone whose first computing experience came in the form of an 8-bit home computer will tell you about booting straight into a BASIC interpreter. The machine invited you to program it, and no doubt many of our middle aged readers are here today because they ran with that.

Modern computers with their fancy 64-bit multitasking supercomputer operating systems may have lost that experience, but now thanks to [Tarjan] you can bring it back. They’ve produced Thoreau BASIC, a bootable bare-metal BASIC interpreter for x86 machines with UEFI.

It’s largely GW-BASIC compatible, but with a few upgrades for the 21st century. The available memory is now whatever the system reports, so imagine a BASIC machine with gigabytes of the stuff. And while it has all the old-style BASIC you know and love, it also has high-res 24-bit graphics, and can load bitmaps. There can even be multiple text windows, it’s BASIC as you have never seen it before.

We are not sure how many will take this interpreter and run with it, after all maybe those modern 64-bit operating systems can be rather useful at times. But we’re guessing there will be plenty who’ll at least have a play with it for old time’s sake. Meanwhile, BASIC is not the only piece of UEFI goodness we’ve brought you.

All but a few of our very youngest readers are surely familiar with music formats that rely on optical disks. When we say [RobDevBuilds] made a MOD tracker that uses an optical disk, then, you might be forgiven for thinking he stuck a bunch of MOD files onto a CD– MOD files being a format of electronic music that was conceived of on the Commodore Amiga that is still used to this day. A dedicated MOD-CD player might be a fun project, but it’s not what [Rob] did; his project is far more impressive and impractical, as he’s come up with a way to encode the MOD files on paper for optical playback. This way the Amiga’s legacy can be preserved longer than the paltry thousand years promised by the optical M-disk format.

Zooming way, way in on the disk reveals that he’s actually printing the patterns of the MOD file row by row, just like you’d see playing it in a ‘tracker’ program. A MOD file, you see, does not encode music like a WAV or MP3; rather, like with MIDI, it lists the notes the software reading the file– traditionally called a tracker–is to recreate. Unlike a MIDI file, though, you don’t have to store the same notes more than once: repeating sections are stored in patterns. So most of the disk is just a long list of hexadecimal numbers: several columns worth, one for each ‘voice’ or instrument playing in the song. Another difference with MIDI is that MOD files are self-contained in that they are supposed to contain the samples, which isn’t in evidence until you flip over the disk.

There’s no B-side to [Rob]’s album; instead a QR-code like series of barcodes is used to encode the samples used in each track on the disk, as well as other information needed to recreate the MOD file, including metadata like title and artist, and the sequencing of the patterns on the front. Of course this means he needs two cameras on his physical mod player, one on each side, and steppers to slide them across the disk like a linear tracking turntable. The front is read via OCR of his modified Amiga “Topaz” font, while the rear holds the first 1084 bytes of the MOD file in a QR-inspired format [Rob] produced specifically for this project.

Unlike the last time we saw someone store music in QR codes, the more modest size requirements of modfiles– something that led to their use in keygens— means this player can store the music’s 8-bit sound samples without the OPUS compression [Rob] is using affecting fidelity. He’s working on another video to give the details of the player– as he works out the bugs, right now it can’t jump betwixt patterns on the disk as fast as some modfiles need–but we’re willing to hazard a guess he’s got a Raspberry Pi in there, and that it’s probably not running the Amiga-inspired AROS operating system.

Fluid simulations are one of the “killer apps” of high-performance computing, but if you can’t afford the performance, they can take a depressingly long time to run. Depending on your use case, as long as you keep the Reynold’s number in mind– or are just looking for a qualitative look at pretty flows–you might be able to get away with purely-practical simulations using rheoscopic fluid, as [Visual Thinker] demonstrates in a recent video.

The fluid, as you can guess from the name, lets you scope out rheos— that’s flow, for those of you didn’t take Greek. Making it is as simple as you could ask for: get some mica flakes, which are readily available to add ‘sparkle’ to cosmetics, and mix with water and a drop of soap. The soap isn’t always necessary, but depending on your mica it helps keep it in suspension and avoid clumping– [Visual Thinker] found it helped him a good deal. Being flat plates of reflective material, the mica flakes catch the light and sparkle beautifully– and since they align with the fluid shear, they show you exactly what’s going on in your ‘simulation’.

[Visual Thinker] isn’t starting with serious simulations; the first thing he tries is essentially a toy that lets him see fluid flow around a Benchy by sticking magnets in it and using it to move a cross-section of its hull though a thin layer of fluid sandwitched betwixt pieces of laser-cut acrylic. We don’t call it a toy to disparage it, though– we totally want one. [Visual] mentions the idea of a coffee table combining the concept with the kind of underslung mechanism we see in sand drawing tables, which sounds dangerously hypnotic. If any of you build one, please try and tear your eyes away long enough to let us know.

He has another beautiful piece that make the video worth watching: a wind-tunnel, again made of laser-cut acrylic and printed parts. With careful consideration of the scale and flow speeds, that one might actually prove useful– and even if it doesn’t, it’s pretty enough that it doesn’t really matter. Beauty has its own utility sometimes.

Most wind tunnels we see around here use actual wind, but rheoscopic fluid was invented for this sort of thing, even if it does make for pretty baubles.