Show Notes
Nick Kartsioukas joined us to talk about security in embedded systems. Common Vulnerabilities and Exposures (CVE) is the primary database to check your software libraries, tools, and OSs: cve.org. Open Worldwide Application Security Project (OWASP, owasp.org) has information on how to improve security in all kinds of applications, including embedded application security. There are also cheatsheets, Nick particularly recommends Software Supply Chain Security - OWASP Cheat Sheet. Wait, what is supply chain security? Nick suggested a nice article on github.com: it is about your code and tools including firmware update, a common weak point in embedded device security. Want to try out some security work? There are capture the flag (CTF) challenges including the Microcorruption CTF (microcorruption.com) which is embedded security related. We also talked about the SANS Holiday Hack Challenge (also see Prior SANS Holiday Hack Challenges).
This episode is brought to you by RunSafe Security. Working with C or C++ in your embedded projects? RunSafe Security helps you build safer, more resilient devices with build-time SBOM generation, vulnerability identification, and patented code hardening. Their Load-time Function Randomization stops the exploit of memory-based attacks, something we all know is much needed. Learn more at RunSafeSecurity.com/embeddedfm. Some other sites that have good information embedded security: This World Of Ours by James Mickens is an easy read about threat modelling
Cybersecurity and Infrastructure Security Agency (CISA) is at cisa.gov and, among other things, they describe SBOMs in great detail
National Institute of Standards and Technology (NIST) also provides guidance:
Internet of Things (IoT) | NIST
NIST Cybersecurity for IoT Program
NIST SP800-213 IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements
There is a group of universities and organizations doing research into embedded security: National Science Foundation Center for Hardware and Embedded Systems Security and Trust (CHEST). Descriptive overview and the site is nsfchest.org
European Telecommunications Standards Institute (ETSI) - Consumer IoT Security
Camera Ubiquiti configuration issue (what not to do)
Finally, Nick mentioned Stop The Bleed which provides training on how you can control bleeding, a leading cause of death. They even have a podcast (and we know you like those). Elecia followed up with Community Emergency Response Teams (CERT). Call your local fire department and ask about training near you!
Transcript
More from Embedded
David Such joins us to discuss his new book, Embedded AI: Intelligence at the Deep Edge. We explore the boundary between classical signal processing, heuristics, and edge machine learning; IMU processing and sensor fusion; and how to determine what sort of ML fits on your processor. David also shares his experiences writing for No Starch Press and why future robotic architectures need a digital cerebellum for low-level reflexes. David Such is an electrical engineer based in Sydney. He is the director of Reefwing Software. DISCUSSION RESOURCES & LINKS David's Website & Book Resources: Embedded AI: Intelligence at the Deep Edge (No Starch Press, on Amazon)
Adam Smith from UC Santa Cruz joins us to discuss local Small Language Models (SLMs) and building open, autonomous tools. We explore his BayLeaf AI counterplatform, transagency (the "me-and-the-car" concept of human-agent collaboration), context distillation, and running models locally without relying on data-harvesting corporate clouds. Adam also shares practical strategies for working with coding agents, including why plain-text AGENTS.md files outperform model weight fine-tuning for long-term knowledge retention. He also describes how he uses open-source tools like OpenWebUI, OpenCode and OpenChamber to integrate small and local LLM integration into development environments and web chats. Discussion Resources & Links Adam's Projects & Research: BayLeaf AI Counterplatform: Hyper-local, open-source AI infrastructure built for UC Santa Cruz. See also the BayLeaf Getting Started Guide and BayLeaf Blog.
Aaed Musa joins us to talk about building robot dogs, custom actuators, and his YouTube channel. He shares how he moved from 3D-printing servo robots in his parents' garage to designing capstan drives, and how he uses reinforcement learning to train quadrupedal walking gaits. We also talk about his senior design project (CARA 2.0), his Spider-Man web-shooter build, lessons in storytelling and video editing, and why he's starting a company to bring friendly, expressive quadrupeds into the home. Aaed Musa is a mechanical engineering graduate from Purdue University, a hardware creator on YouTube, and co-founder of the robotics startup Mecha. DISCUSSION RESOURCES & LINKS AAED'S CHANNELS & PROJECTS: Aaed Musa on YouTube: Project videos covering quadrupedal robot dogs, Spider-Man web shooters, and custom actuators. Oh, and planetary gears.
Author Susan Lammers joins the show to discuss the 40th anniversary edition of her classic book, Programmers at Work. We discuss what it was like to interview young and pioneering software developers like Toru Iwatani, C. Wayne Ratliff, and Michael Hawley and how the personal computer revolution was built by individuals seeking freedom from corporate mainframes. Susan also shares her experiences as Editor-in-Chief at Microsoft Press, leading Microsoft's early interactive CD-ROM division, founding Headbone Interactive in the 1990s, and why she's bringing retro games like Elroy Goes Bugzerk back to Steam today. SUSAN'S BOOK & WEB RESOURCES: Programmers at Work: 40th Anniversary Edition – Official site featuring updated bios, excerpts, and current career paths of the 19 interviewees
Kevin Santo Cappuccio, founder of Architeuthis Flux, joins the show to discuss creating Jumperless, an open-source breadboard that replaces physical jumper wires with software-controlled analog crossbar switches. We explore the need for 445 RGB LEDs on a breadboard, using MicroPython to create scriptable circuits, some of the lessons that can be implemented with the Jumperless, and how it might be used to create new instruments. Kevin also shares the story behind his upcoming Barnacle Board. DISCUSSION RESOURCES & LINKS Jumperless Project & Hardware Resources: Jumperless Docs and Discord